Data Processing Agreement

For the purposes of this Agreement, the Controller and the Processor establish the following meanings for the terms listed below:

1. Personal Data - data within the meaning of Article 4(1) of Regulation 2016/679, i.e., any information relating to an identified or identifiable natural person;
2. Processing of Personal Data - any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction within the meaning of Article 4(2) of Regulation 2016/679;
3. Agreement - this agreement;
4. Main Agreement - the service agreements concluded between the Controller and the Processor with the content defined by the Terms of Service;
5. Regulation 2016/679 (or GDPR) - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

The Parties represent as follows:

1. The Parties declare that this Agreement has been concluded in order to fulfill the obligations referred to in Article 28 of Regulation 2016/679 in connection with the conclusion of the Main Agreement,
2. The person concluding the Main Agreement and transferring personal data to the Processor holds appropriate authorization to represent the Controller,
3. The Controller declares that it is the controller of Personal Data within the meaning of Article 4(7) of Regulation 2016/679, i.e., the entity which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data,
4. The Processor declares that it is a processor within the meaning of Article 4(8) of Regulation 2016/679 under this Agreement, which means that it will process Personal Data on behalf of the Controller.

1. The Controller entrusts the Processor with the Processing of Personal Data, and the Processor undertakes to process it in accordance with applicable law and this Agreement.
2. This Agreement is concluded for the duration of the Main Agreement and until the fulfillment of all obligations arising from this Agreement and the Main Agreement.

1. The Processor may process Personal Data exclusively within the scope and for the purpose provided for in this Agreement.
2. The purpose of entrusting the Processing of Personal Data is the performance of the Main Agreement, including in particular the provision by the Processor of access to the "Orderye" tool and the performance of services through it.
3. The scope of Personal Data processed by the Processor under this Agreement covers the categories of Personal Data entrusted for processing each time by the Controller through the "Orderye" tool, i.e., first name, last name, email address, phone number, and delivery address.
4. The scope of Personal Data processed by the Processor under this Agreement covers data of the Controller's customers.
5. The Processor processes Personal Data only on documented instructions from the Controller. The instruction to process data contained in the Main Agreement constitutes a documented instruction.
6. When processing Personal Data, the Processor shall comply with the rules set out in this Agreement.

1. Prior to commencing the Processing of Personal Data, the Processor shall implement security measures for Personal Data as referred to in Article 32 of the GDPR, and in particular:
   1. taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Processor is obliged to apply technical and organizational measures ensuring the protection of processed Personal Data to ensure a level of security appropriate to that risk. The Processor shall appropriately document the application of these measures and update them in consultation with the Controller,
   2. ensures that any natural person acting under the authority of the Processor who has access to personal data processes it only on instructions from the Controller, including according to its guidelines and instructions, for the purposes and within the scope provided for in this Agreement,
   3. maintains a record of all categories of processing activities carried out on behalf of the Controller, as referred to in Article 30(2) of Regulation 2016/679, and makes it available to the Controller upon request, unless the Processor is exempt from this obligation under Article 30(5) of Regulation 2016/679.
2. The Processor ensures that persons having access to the Processing of Personal Data keep the data and the security measures confidential, with the confidentiality obligation continuing after the performance of this Agreement and after the termination of employment or cooperation with the Processor. For this purpose, the Processor shall admit to data processing only persons who have signed an undertaking to keep personal data and its security measures confidential.

1. The Processor undertakes to assist the Controller in ensuring compliance with the obligations set out in Articles 32-36 of Regulation 2016/679; in particular, the Processor undertakes to provide the Controller with information and follow its instructions regarding applied Personal Data security measures, and undertakes to notify the Controller of any Personal Data breaches within 24 hours of detecting an event constituting a personal data breach.
2. The Processor undertakes to assist the Controller, by appropriate technical and organizational measures, in fulfilling the obligation to respond to requests for exercising the data subject's rights laid down in Articles 15-22 of Regulation 2016/679; in particular, the Processor undertakes to inform the Controller of any request submitted by a data subject within 5 days of receiving such a request.
3. The Processor undertakes to comply with any guidelines or recommendations issued by a supervisory authority or an EU advisory body dealing with Personal Data protection regarding the Processing of Personal Data, in particular with respect to the application of Regulation 2016/679.
4. The Processor undertakes to immediately inform the Controller (using the method of contact or notification specified in the Main Agreement) of any proceedings, in particular administrative or judicial proceedings, concerning the Processing of entrusted Personal Data by the Processor, of any administrative decision or court ruling concerning the Processing of entrusted Personal Data addressed to the Processor, and of any audits or inspections concerning the Processing of entrusted Personal Data by the Processor, in particular those conducted by a supervisory authority.

1. The Processor may use the services of another processor (sub-processor).
2. The Controller consents to the sub-entrustment of the processing of entrusted Personal Data, in particular to companies cooperating with the Processor and entities providing HR, accounting, and IT services to the Processor.
3. In the event of sub-entrusting the processing of Personal Data, the sub-processing shall be based on an agreement under which the subcontractor (sub-processor) undertakes to perform the same obligations that are imposed on the Processor under this Agreement.
4. The Processor shall ensure that subcontractors (sub-processors) to whom data processing is sub-entrusted apply at least an equivalent level of Personal Data protection as the Processor.

1. The Controller is entitled to verify the Processor's compliance with the rules for processing Personal Data arising from Regulation 2016/679 and this Agreement by exercising the right to request all information regarding the entrusted Personal Data.
2. The Controller also has the right to conduct audits or inspections of the Processor with respect to the compliance of processing operations with the law and this Agreement. The audits or inspections referred to in the preceding sentence may be conducted by third parties authorized by the Controller. Audits and inspections shall be conducted after prior agreement between the Parties on the date and manner of conducting them.
3. The Processor undertakes to immediately inform the Controller if, in the Processor's opinion, an instruction given to it infringes Regulation 2016/679 or other data protection provisions.

1. The Processor is liable for damages incurred by the Controller or third parties as a result of the Processor's Processing of Personal Data in breach of this Agreement. The Processor's liability for the actions and omissions of subcontractors (sub-processors) is excluded.
2. In the event of non-performance or improper performance of this Agreement by the Processor and breach of personal data processing regulations, the Processor undertakes to pay compensation; however, the total liability of the Processor (towards the Controller and third parties) is limited to the amount of 500 EUR.

1. Upon completion of the provision of services related to processing, the Processor, at the request of the Controller and subject to section 2, is obliged to cease the Processing of Personal Data and delete all Personal Data and existing copies thereof from its records and IT systems.
2. Notwithstanding the cessation of services related to the entrusted Processing of Personal Data, the Processor is entitled to process data confirming the performance of the service for the Controller.
3. Deletion of personal data as referred to in section 1 means the destruction of Personal Data or such modification thereof that no longer allows identification of the data subject.
4. Data deletion shall be documented by a written statement signed by persons authorized by the Processor. The Processor undertakes to provide the Controller with a statement of deletion of Personal Data within 7 days of the Controller submitting such a request.
5. Termination of the Main Agreement at any time and in any manner by either Party results in the expiration of this Agreement.
6. The Controller is entitled to terminate this Agreement with immediate effect if:
   1. a supervisory authority determines that the Processor does not comply with the rules for processing personal data with respect to data entrusted by the Controller,
   2. the Controller, as a result of an audit referred to in § 8 of this Agreement, determines that the Processor does not comply with the rules for the Processing of Personal Data with respect to data entrusted by the Controller and a 14-day period to remedy the breaches has expired without effect,
   3. the Processor used Personal Data contrary to this Agreement or applicable law, improperly processed entrusted Personal Data despite a prior request to change the manner of processing, or entrusted the processing of Personal Data to another entity without the Controller's consent.

1. To be valid, any amendments to this Agreement require documentary form.
2. This Agreement is concluded in electronic form by accepting its terms via selecting the appropriate checkbox in the system provided by the Processor.
3. In matters not regulated by this Agreement, the provisions of the Act of 23 April 1964 - the Polish Civil Code and the provisions of Regulation 2016/679 shall apply.
4. Disputes related to the performance of this Agreement shall be resolved by the court having local jurisdiction over the Processor's place of business.