Data Processing Agreement

Annex 2 to the Terms of Service and Sale of prostrona.pl

Effective date: 13 October 2026

§1. Parties and conclusion

1. This Data Processing Agreement (the "DPA") is concluded between the Client for whom the Provider creates and maintains a Website (the "Controller") and Jan Czerwiński, a sole trader with the business address ul. Rubinowa 2, 09-400 Ludwikowo, Poland, Polish tax ID (NIP) 5842816986, REGON 521841905 (the "Processor").
2. The DPA is concluded together with the Contract for the Website, when the Client accepts the Terms, and constitutes the contract referred to in Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR").
3. Capitalised terms not defined in this DPA have the meaning given to them in the Terms. The terms "personal data", "processing", "personal data breach" and "processor" have the meaning given to them in Article 4 GDPR.

§2. Subject matter, nature and purpose of processing

1. The Controller entrusts the Processor with processing personal data to the extent necessary to perform the Contract for the Website, and the Processor undertakes to process that data only for this purpose and in accordance with this DPA.
2. The processing includes in particular:
   • hosting the Website, including storing its content, files and backups,
   • operating the Website's contact form — receiving submissions and delivering them by e-mail to the addresses designated by the Controller,
   • keeping visit statistics for the Website with an analytics tool that does not store cookies on the visitor's device,
   • processing technical traffic data (server logs, protection against attacks and abuse, content delivery through a CDN),
   • changing the content of the Website on the Controller's instructions, including with AI Editing,
   • managing the Website's domain and SSL certificate.
3. Nature of the processing: storage, organisation, structuring, transmission, disclosure to the Controller and erasure of data, carried out by automated means in IT systems.
4. Visit statistics for the Website are collected in a shared instance of the analytics tool that the Processor uses for all the websites it operates, where they are kept apart by website address. The Processor uses the Website's statistics only to make them available to the Controller (in particular in reports), to maintain the Website and to keep it secure. It does not use them for its own purposes or share them with anyone else.

§3. Types of data and categories of data subjects

1. The processing concerns the following categories of data subjects and data:
   • visitors to the Website — IP address, date and time of the visit, address of the subpage visited, referring page and technical data about the browser and device,
   • people who use the Website's contact form — the data entered in the form, in particular name, e-mail address, phone number and message content, as well as any other fields defined by the Controller,
   • people whose data the Controller places in the content of the Website (e.g. employees, associates, customers quoted in reviews) — in particular name, image, job title, contact details and review content.
2. The processing does not cover special categories of personal data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR). The Controller does not collect such data through the Website's form or place it in the content of the Website without first agreeing this with the Processor.

§4. Duration of processing

The Processor processes the data for as long as the Contract for the Website remains in force and, after it ends, for the time necessary to delete the data in accordance with §12.

§5. Obligations of the Processor

1. The Processor:
   • processes personal data only on documented instructions from the Controller, including with regard to transfers to a third country, unless required to do so by Union or Polish law — in which case it informs the Controller of that legal requirement before processing, unless the law prohibits such information,
   • ensures that persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality,
   • takes the technical and organisational measures required under Article 32 GDPR and set out in §9,
   • engages other processors only on the terms set out in §7,
   • assists the Controller, insofar as possible and taking into account the nature of the processing, in responding to requests from data subjects (§10),
   • assists the Controller in complying with the obligations under Articles 32–36 GDPR, taking into account the nature of the processing and the information available to it,
   • deletes or returns personal data at the end of the provision of services in accordance with §12,
   • makes available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR and allows for audits in accordance with §13.
2. The Controller's documented instructions are the Contract for the Website, the Terms, this DPA and instructions given by the Controller in the Panel (including in AI Editing) or by e-mail.
3. The Processor informs the Controller without delay if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

§6. Obligations of the Controller

1. The Controller declares that it processes personal data lawfully and in particular has a legal basis for the processing entrusted to the Processor.
2. The Controller is responsible for informing data subjects, in particular for the content of the Website's privacy policy. The Processor may provide a template for such a policy, which the Controller should review and complete where necessary.
3. The Controller keeps the e-mail addresses of recipients of form submissions up to date and is responsible for any further processing of submissions it has received.
4. The Controller does not give the Processor unlawful instructions.

§7. Sub-processors

1. The Controller gives the Processor general authorisation to engage other processors ("Sub-processors"). On the effective date of this DPA, they are:

2. The artificial intelligence providers (Anthropic, OpenAI) receive only the content and code of the Website, the Controller's instructions and screenshots of the Website. They do not receive data about visitors to the Website — in particular, no form submissions and no data from the visit statistics.
3. The Processor notifies the Controller by e-mail of any intended addition or replacement of a Sub-processor at least 14 days before the change. Within that period, the Controller may raise a reasoned objection. If the parties cannot reach an agreement, the Controller may terminate the Contract for the Website with effect before the date of the change.
4. The Processor imposes on each Sub-processor, by contract, data protection obligations equivalent to those in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. The Processor remains liable to the Controller for the performance of the Sub-processor's obligations.

§8. Transfers outside the European Economic Area

Some Sub-processors are established in the United States or process data outside the European Economic Area. Such transfers are based on the European Commission's adequacy decision (the EU–US Data Privacy Framework) for organisations certified under it, or on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR).

§9. Security of processing

The Processor applies technical and organisational measures appropriate to the risk, in particular:

• encryption of data in transit using TLS (HTTPS) on the Website, in the Panel and in communication with Sub-processors,
• access to systems and data limited to authorised persons, protected by authentication and limited to what is necessary for their tasks,
• data minimisation: submissions from the Website's form are delivered by e-mail — they are not stored in the Processor's database or passed to its customer relationship system (CRM) or messaging tools (only technical delivery data is stored, without the content of the submission), and visit statistics are kept without cookies and without storing IP addresses,
• protection of the form against spam and abuse (honeypot field, completion-time check, submission limits),
• regular database backups and ongoing software updates,
• logical separation of the data of individual Websites.

§10. Data subject rights

1. If the Processor receives a request concerning data processed on the Controller's behalf directly from a data subject, it forwards the request to the Controller without delay, and no later than within 5 business days, and does not respond to it itself unless the Controller authorises it to do so.
2. At the Controller's request, the Processor provides information and carries out the technical steps needed to fulfil the request (e.g. deleting or correcting data in the content of the Website).

§11. Personal data breaches

1. The Processor notifies the Controller of a personal data breach concerning data processed on the Controller's behalf without undue delay, and no later than 48 hours after becoming aware of it.
2. The notification contains, where possible, the information referred to in Article 33(3) GDPR: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed to address it. Where information cannot be provided at once, the Processor provides it in phases without undue further delay.
3. The Processor cooperates with the Controller in investigating the breach, mitigating its effects, notifying the supervisory authority and communicating the breach to data subjects.

§12. Deletion of data after the Contract ends

1. Within 30 days after the Contract for the Website ends, the Processor takes the Website offline and deletes the personal data processed on the Controller's behalf from the database, from stored files and from the current version of the Website's source code, unless Union or Polish law requires it to be retained.
2. Before the Contract for the Website ends, the Controller may ask for the content of the Website (texts and files) to be handed over. Form submissions are not stored by the Processor — the Controller has them in its e-mail inbox.
3. Data contained in backups is deleted in the normal backup rotation cycle. Until then, backups are protected in the same way as other data and are not used for any other purpose.
4. Personal data contained in the content of the Website that remains in the version history of the source code repository is kept only in a secured, non-public repository and is not used for any other purpose. At the Controller's request, the Processor also removes it from the version history.
5. Messages containing form submissions that are stored by the e-mail delivery provider are deleted in line with that provider's retention period.

§13. Information and audits

1. At the Controller's request, the Processor makes available the information necessary to demonstrate compliance with the obligations under Article 28 GDPR, in particular a description of the security measures applied and the current list of Sub-processors.
2. The Controller may carry out an audit, including an inspection, itself or through an authorised auditor bound by confidentiality, after giving the Processor at least 14 days' notice, on business days and in a way that does not disrupt the Processor's business. Audits take place no more than once every 12 months, unless they relate to a personal data breach or a request from a supervisory authority. The Controller bears the costs of the audit.

§14. Liability

The parties' liability for damage caused in connection with the processing of personal data is governed by the GDPR, in particular Article 82, and by the Polish Civil Code.

§15. Final provisions

1. This DPA remains in force for as long as the Contract for the Website and expires with it, subject to the obligations set out in §12.
2. In matters of personal data protection, the provisions of this DPA take precedence over those of the Terms and the Contract for the Website.
3. This DPA is amended in the manner provided for amendments to the Terms (§18 of the Terms), except for changes to the list of Sub-processors, which are governed by §7(3).
4. Matters not covered by this DPA are governed by the GDPR, the Polish Personal Data Protection Act of 10 May 2018 and the Polish Civil Code. This DPA is governed by Polish law.
5. This DPA is available in Polish and English on the terms set out in §19(4) of the Terms.