Data Processing Agreement

§1. Parties and conclusion

This agreement is concluded between the Owner of a Workspace in Velunta (the “Controller”) and Bajeczne Balony Oleh Serhiienko, NIP (tax ID) 6832090873, ul. Ciesielskiego 6, 31-589 Kraków, Polska (the “Processor”).

The agreement is an integral part of the Terms of Service and is concluded when they are accepted. It applies for as long as Velunta is used.

§2. Subject, nature and purpose

The Controller entrusts the Processor with processing personal data entered into the Workspace solely to provide the Velunta services described in the Terms.

Processing covers: recording, storing, organising, displaying, making available to Workspace team members, exporting and deleting data.

§3. Categories of people and data

• People: the Controller's clients, contact persons of suppliers and business partners, Workspace team members, other people whose data the Controller enters.
• Data: name or company name, phone number, email address, delivery addresses, order and payment details, notes, photos and documents in attachments (may show a person's image).

The Controller should not enter special categories of data (Art. 9 GDPR) or data on criminal convictions (Art. 10 GDPR).

§4. Processor's obligations

The Processor:

• processes data only on the Controller's documented instructions — using Velunta's features is the instruction; if an instruction infringes the law, the Processor informs the Controller,
• ensures that persons authorised to process the data are bound by confidentiality,
• applies the security measures required by Art. 32 GDPR (§7),
• helps the Controller respond to data subjects' requests — among other things through editing, export and deletion features in the app,
• helps the Controller meet its obligations under Art. 32–36 GDPR,
• notifies the Controller of a personal data breach without undue delay, no later than 48 hours after becoming aware of it,
• makes available the information needed to demonstrate compliance with Art. 28 GDPR and allows audits — primarily as written explanations and, if needed, inspections agreed at least 14 days in advance.

§5. Sub-processors

The Controller gives general authorisation to engage the following sub-processors:

The Processor imposes on sub-processors data protection obligations no less strict than those in this agreement. It announces any planned change or addition of a sub-processor at least 14 days in advance (in the app or by email). The Controller may object; if the objection is not accommodated, the Controller may terminate the agreement by deleting the Workspace or the account.

§6. Transfers outside the EEA

Database and attachment data is stored in the EU (Frankfurt). Where sub-processors transfer data outside the European Economic Area, this is based on an adequacy decision (EU-US Data Privacy Framework) or Standard Contractual Clauses.

§7. Security measures

• encrypted connections (HTTPS/TLS) and encryption of data stored at the provider,
• separation of Workspace data and database-level access control (Row Level Security) that respects roles and branches,
• private file storage available only to Workspace members,
• administrative keys used only on the server, never in the browser,
• passwords stored as cryptographic hashes,
• Processor access to data limited to what is necessary (e.g. handling a support request at the Controller's request).

§8. End of processing

After a Workspace or account is deleted, the Processor deletes the data immediately, and providers' backups and logs are overwritten within a cycle of no more than 30 days, unless the law requires further storage. Before deletion the Controller can download the data with “Export data”.

§9. Liability and final provisions

Liability for damage resulting from breaches of data protection law is governed by Art. 82 GDPR; otherwise the Terms of Service apply.

Matters not covered here are governed by the GDPR, Polish law and the Terms. The Polish version of this agreement is binding.