Data Processing Agreement

Version: 1.3 · Last updated: 15 May 2026

§ 1. Parties

Processor:

ARI.CODE Arkadiusz Rosłoniec
sole proprietorship
Gostomia 17, 26-420 Nowe Miasto nad Pilicą, Poland
Tax ID (NIP): 7972027390
email: kontakt@zbierajmadrze.pl

Controller:

The User of the Application who enters personal data of third parties (in particular employees and contractors).

§ 2. Subject matter and purpose

1. The Controller entrusts the Processor with processing personal data to the scope and for the purpose specified in Annex A.
2. The Processor shall process entrusted data solely to the extent necessary to provide the services defined in the Terms of Service, in particular: storage, making data visible to the Controller and to users authorised by the Controller, performing settlement calculations, backups and securing the data.
3. The Processor shall not process entrusted data for its own purposes and shall not use them for marketing or statistical purposes beyond providing the service to the Controller.

§ 3. Duration

1. This DPA is in force for the duration of the main agreement concluded under the Terms of Service between the Controller and the Processor concerning the „Zbieraj Mądrze" Application.
2. Upon termination of the main agreement, § 10 of this DPA applies.

§ 4. Type of data and categories of data subjects

Detailed lists are set out in Annex A.

§ 5. Processor's obligations

1. The Processor processes data only on the Controller's documented instructions. Actions performed via the Application (entry, edit, deletion, export) are considered such instructions.
2. The Processor ensures that persons authorised to process the data (Processor's staff and contractors) have committed themselves to confidentiality or are under a statutory obligation of confidentiality.
3. The Processor implements appropriate technical and organisational measures as set out in § 8.
4. The Processor assists the Controller, as far as possible, in fulfilling the Controller's obligation to respond to requests from data subjects (Articles 12–22 GDPR).
5. The Processor assists the Controller in ensuring compliance with obligations under Articles 32–36 GDPR (security, breach notification, DPIA, prior consultation with the supervisory authority).
6. The Processor immediately informs the Controller if, in its opinion, an instruction infringes GDPR or other data protection law.

§ 6. Controller's obligations

1. The Controller declares that it has a valid legal basis for processing the personal data entrusted to the Processor (e.g. employment contract, statutory obligation, legitimate interest).
2. The Controller undertakes to fulfil the information obligations under Articles 13 and 14 GDPR towards data subjects (its own employees and contractors), including informing them about the entrusted processing.
3. The Controller is responsible for the scope, content and lawfulness of data entered into the Application.

§ 7. Sub-processors

1. The Controller grants the Processor general authorisation to use sub-processors listed in Annex C.
2. The Processor shall inform the Controller of any intended changes regarding the addition or replacement of sub-processors at least 14 days in advance by email or in-app notice. The Controller may object; in such case the parties will negotiate an alternative in good faith, and failing that the Controller may terminate the main agreement effective on the date of the proposed change.
3. The Processor ensures that sub-processors are bound by data protection obligations no less strict than those set out in this DPA.

§ 8. Security of processing (Art. 32 GDPR)

The Processor applies the technical and organisational measures listed in Annex B, including:

• encryption of traffic between client and server;
• authentication and access-control mechanisms for the Application;
• organisational and technical restrictions on access to data for authorised persons only;
• logging of selected security and administrative events;
• measures intended to restore data availability and service continuity appropriate to the scale of processing.

§ 9. Personal data breaches

1. The Processor notifies the Controller of any detected breach of the security of the entrusted personal data without undue delay, by email or another agreed communication channel.
2. The notification includes information required by Art. 33(3) GDPR to the extent available to the Processor, in particular: the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to mitigate the effects.

§ 10. Return or deletion of data

1. At the end of the service, the Processor - at the Controller's choice - shall delete or return the entrusted personal data to the Controller and delete existing copies, unless Union or Polish law requires retention.
2. After the service ends, data is deleted or returned in accordance with the parties' arrangements and applicable retention rules, subject to legal obligations or technical periods necessary for secure service termination.
3. If the Controller requests earlier deletion, the parties shall agree on the method and timing taking into account security and legal obligations.

§ 11. Audit

1. The Processor makes available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR and allows for audits.
2. An audit takes place at a mutually agreed date with at least 14 days' notice, no more often than once every 12 months (except following a detected breach), during the Processor's working hours and at the Controller's cost.
3. The Processor may provide the results of an audit performed by an independent body (e.g. SOC 2 or ISO 27001 certification of the hosting provider, or internal audit report) in lieu of a direct audit, to the extent such documents address the audit subject.

§ 12. Liability

1. The parties are liable as set out in Art. 82 GDPR and in the Terms of Service.
2. The Processor is liable to the Controller for damage caused by breach of this DPA only where it has failed to fulfil obligations GDPR imposes directly on processors or acted outside or contrary to lawful documented instructions of the Controller.

§ 13. Final provisions

1. In matters not regulated by this DPA, GDPR, the Polish Data Protection Act and the Terms of Service apply.
2. In case of a conflict between this DPA and the Terms - in matters of personal data protection - this DPA prevails.
3. Changes to this DPA are made under the amendment rules applicable to the Terms of Service, unless the parties agree an individual change in documentary form (e.g. by email) or sign an updated version.

Annex A - Type of data, categories of data subjects, purpose and duration

Annex B - Technical and organisational measures

• Encryption of transmissions for client-server connections.
• Authentication and access-control mechanisms for the Application.
• Data isolation between different customers to the extent provided by the system architecture.
• Logging of selected technical and security events.
• Abuse protection for public-facing endpoints.
• Restricted access to production data for authorised personnel only.
• Security maintenance and updates appropriate to the scale of the service.

Annex C - List of sub-processors

The GoatCounter statistics mechanism available at stats.zbierajmadrze.pl is self-hosted by the Processor on the infrastructure listed in the first row above and is not a separate sub-processor.

The current list of sub-processors is published on the Application's website. The Processor will notify of any planned changes (addition or replacement of a sub-processor) in accordance with § 7.