Data processing agreement (DPA)

Draft for review

Working draft dated 25 October 2026 for legal review. This is not binding terms, an approved policy or a concluded processing agreement. It does not change existing order terms.

Operator: Przedsiębiorstwo Techniczne MTC Wiktor Suska. Address: ul. Jezuicka 24A, 05-230 Kobyłka, Poland. Polish tax ID (NIP): 1251751514. Contact: [email protected], tel. +48 534 166 163. Privacy: [email protected].

1. Parties and processing agreement

This is a draft processing agreement under GDPR Article 28. The organization using the service is the controller of entrusted data, and Przedsiębiorstwo Techniczne MTC Wiktor Suska, identified above, is the processor. Organization details and representative authority must be recorded before conclusion. Opening this page, paying for an export or holding the Platform Owner privilege does not conclude a processing agreement.

2. Subject, nature and scope

Processing covers storing, organizing, searching, disclosing to authorized persons and exporting data in selected modules and saved documents to provide the ordered service. Categories may include customers, contacts, personnel and document parties, with identification, contact and operational data. An annex to the agreed version specifies the actual scope and duration. Special-category and criminal-offence data require a separately agreed basis and safeguards; this draft does not include them by default.

3. Documented instructions

The processor acts only on documented controller instructions, including for transfers, unless processing is required by law. It informs the controller beforehand where legally permitted and reports instructions it considers contrary to data protection law. Entrusted content is not used for the processor’s own marketing or AI training without a separate lawful basis. The controller is responsible for lawful collection and its own instructions.

4. Confidentiality and permissions

Only persons bound by confidentiality and authorized to the necessary extent may access the data. Current organization membership and permissions are checked when reading history and downloading documents. A payer does not retain permanent access to an organization document after permission is revoked. Platform administration does not replace an explicit basis for tenant data access.

5. Security measures

Measures must match the risk and cover access control, organization isolation, encrypted transport, secret protection, incident handling and controlled recovery. Uploaded attachments undergo quarantine and inspection; an unavailable scanner does not mean a file is safe. A detailed technical annex must confirm actual encryption at rest, backups, recovery, monitoring and deletion periods. This description does not claim certification or a completed audit of these measures.

6. Subprocessing and transfers

A subprocessor requires prior specific or general written controller authorization and equivalent data protection duties. Under general authorization, the controller must be informed of intended additions or replacements and be able to object. The list must identify exact entities, activities, locations and transfer safeguards. The names Cloudflare, Supabase, Resend and Stripe alone are not a sufficient annex. Stripe’s role for billing must be assessed separately rather than automatically treating it as subprocessor for all organization data.

7. Breaches and cooperation

The processor notifies the controller of a personal data breach without undue delay after becoming aware of it. It provides available details on the nature, scope, possible effects and measures taken, adding information as established. It assists with authority and individual notifications and risk assessment without replacing controller decisions. Incident contacts and escalation procedures must be confirmed in the operational annex.

8. Individual rights and audit

Taking account of the nature of processing, the processor assists with individual rights and GDPR Articles 32–36 obligations. It provides information necessary to demonstrate compliance and permits required audits and inspections. Verification must not expose other organizations’ data or security secrets. Instructions come from authorized organization representatives; paying for the service alone is insufficient.

9. End of service and data

At the end of processing services, the controller chooses return or deletion of entrusted data and deletion of existing copies, unless law requires retention. The agreed annex specifies the return format, operational deadline and backup deletion cycle. Payment expiry is not by itself such an instruction. The operator’s own accounting duties require a separate basis and retention period.

10. Annexes required before agreement

Items awaiting approval are: party and contact identification; services, data and individual categories and duration; specific technical and organizational measures; subprocessors and transfers; and incident, audit, return and deletion procedures. Incomplete annexes mean this is a draft, not a completed processing agreement. This page does not replace the agreed version or evidence of conclusion.

To confirm before approval

Retention and deletion periods, providers and transfers, required annexes and external review of the content and translations remain to be confirmed. This version remains a draft until then.