Data Processing Agreement

01Parties, scope and precedence

1. This Data Processing Agreement (the “DPA”) is concluded between the Customer (the “Controller”) and [●] (the “Processor”) and forms an integral part of the Terms of Service (the “Main Agreement”). It applies from the conclusion of the Main Agreement without a separate signature; a signed copy is available on request.
2. It applies to personal data that the Controller or its Users enter, upload or otherwise make available in the Service (“Controller Personal Data”).
3. Where the Customer itself processes this data on behalf of its own client (as a processor) and the Processor is its sub-processor, the Customer ensures that its instructions are consistent with those of its controller.
4. In case of conflict on personal data, the DPA prevails over the Terms; standard contractual clauses, where they apply, prevail over both.

02Subject matter, nature, purpose and duration

The subject matter is the processing of Controller Personal Data in order to provide the Service: hosting, storing, organising, displaying, retrieving, transmitting (e-mail, SMS, webhooks), backing up and deleting data, and providing support and security. Processing lasts for the term of the Main Agreement and the period needed to return or delete data (section 10). Details are in Annex 1.

03Controller's instructions

1. The Processor processes data only on the Controller's documented instructions. The instructions are the Main Agreement and this DPA, the Controller's use of the Service's features (configuration, data entry, automations, integrations) and reasonable written instructions consistent with the Service.
2. If EU or Member State law requires the Processor to process in another way, it will inform the Controller before processing, unless that law prohibits such information.
3. The Processor will immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions (Art. 28(3)(h) GDPR).
4. The Processor does not process Controller Personal Data for its own purposes, except to: provide, maintain and secure the Service; compile operating statistics that do not contain the content of the Controller's data; and comply with legal obligations.

04Confidentiality and personnel

The Processor ensures that persons authorised to process data are bound by confidentiality (also after the engagement ends), have access only to the extent needed for their duties and are trained in data protection.

05Security

The Processor applies the technical and organisational measures described in Annex 2, appropriate to the risk (Art. 32 GDPR). It may update them provided it does not lower the overall level of protection.

06Sub-processors

1. The Controller gives general written authorisation to use the sub-processors listed in Annex 3.
2. The Processor will inform the Controller of any intended addition or replacement of a sub-processor at least 30 days in advance (by e-mail to the Workspace owner or by updating Annex 3). The Controller may object within 14 days on reasonable data protection grounds.
3. If the parties cannot resolve an objection, the Controller may terminate the affected part of the Service and the Processor will refund fees for the period after termination.
4. The Processor imposes on sub-processors obligations at least equivalent to those in this DPA and remains liable to the Controller for their performance (Art. 28(4) GDPR).

07Assistance to the Controller

1. Data subject requests: within 5 business days the Processor forwards to the Controller any request it receives, without responding on the merits, and provides features that allow requests to be fulfilled (search, export, edit, delete).
2. Impact assessments and consultations: on request it provides the information needed for data protection impact assessments and prior consultation with the supervisory authority (Arts. 35–36 GDPR).
3. Breaches: it notifies the Controller of a personal data breach affecting Controller Personal Data without undue delay and in any case within 48 hours of becoming aware of it, giving the information available (nature of the breach, categories and approximate number of persons and records, likely consequences, measures taken), and cooperates in resolving it.
4. Assistance is part of the Service and carries no separate charge; if it requires disproportionate effort the parties will agree a reasonable fee in advance.

08Information and audits

1. The Processor makes available to the Controller the information necessary to demonstrate compliance with Art. 28 GDPR.
2. The Controller (or an independent auditor bound by confidentiality) may audit no more than once every 12 months (and after a personal data breach), on 30 days' notice, during business hours, without disrupting operations and without access to other customers' data. The Controller bears the cost of the audit.
3. The Processor may satisfy this obligation by providing current independent reports or certifications or by completing a questionnaire. The powers of the supervisory authority are unaffected.

09Transfers to third countries

The Processor aims to process data in the European Economic Area; the processing locations of each sub-processor are given in Annex 3. A transfer outside the EEA takes place only on documented instructions and with the safeguards required by Chapter V GDPR (an adequacy decision, standard contractual clauses or another valid basis).

10Return and deletion

After the Main Agreement ends, the Controller may export its data for 30 days using the Service's features. The Processor then irreversibly deletes Controller Personal Data from production systems; backups are overwritten within a cycle not exceeding 35 days. On request it confirms deletion. The exception is data the Processor must keep under the law.

11Liability

The parties' liability is governed by the Main Agreement, without prejudice to data subjects' rights under Art. 82 GDPR.

12Term and final provisions

This DPA applies for as long as the Processor processes Controller Personal Data. It is governed by Polish law and disputes are decided by the courts as set out in the Main Agreement. It may be changed in the way the Terms are changed (section 14 of the Terms) or in writing.

Annex 1 — Details of the processing

Annex 2 — Technical and organisational measures

• Access control and authentication: passwords stored as Argon2id hashes; multi-factor authentication (authenticator app, SMS code, passkeys, backup codes) which can be enforced for the whole team; session policy with an absolute and an idle limit, new-device sign-in alerts, remote session revocation, optional IP allow-list; user roles and permissions (owner, admin, manager, staff, viewer).
• Encryption: data in transit encrypted (TLS); secrets stored in the database (API keys, mailbox passwords, webhook and TOTP secrets) encrypted with AES-256-GCM, with the key held outside the database.
• Data separation: every record is bound to the customer's company identifier and access is enforced on the server side.
• Logging and accountability: a change log that cannot be edited or deleted through the interface (who, what, when, IP address) and a sign-in log; the ability to restore deleted records (soft delete).
• Abuse protection: rate limiting; outbound connections (webhooks, mailboxes) to private and internal networks blocked; API keys stored only as hashes and shown once.
• Continuity: regular backups of the database and files; separation of the web interface and background-job processes.
• Organisation: confidentiality undertakings, least-privilege access, an incident response and breach notification procedure, supplier assessment, a data deletion procedure.

Annex 3 — Sub-processors

The Processor uses the following sub-processors:

Services that the Controller itself connects to the Service — including its own Stripe account (booking payments), its own mailbox (IMAP/SMTP), HubSpot or Pipedrive (migration) and webhook endpoints — are not sub-processors of the Processor; the Controller is responsible for its agreements with them.