Data Processing Agreement

Annex 2 to the Terms of Service and Sale of prostrona.pl

Effective date: 18 October 2026

§1. Parties and conclusion

1. This Data Processing Agreement (the "DPA") is concluded between the Client to whom the Provider supplies Website creation and maintenance or CRM services (the "Controller") and Jan Czerwiński, a sole trader with the business address ul. Rubinowa 2, 09-400 Ludwikowo, Poland, Polish tax ID (NIP) 5842816986, REGON 521841905 (the "Processor"). The agreement covering those services is referred to as the "Service Contract". CRM means a private workspace for managing the Controller's contacts, submissions and cases; it may operate independently of the Website.
2. The DPA is concluded together with the Service Contract by accepting the Terms or by separately agreeing its content in a documented form. It constitutes the contract referred to in Article 28(3) of Regulation (EU) 2016/679 (the "GDPR"). Activating CRM for a Client with an earlier contract requires that service to be covered by the DPA agreed with that Client.
3. Capitalised terms not defined in this DPA have the meaning given to them in the Terms. The terms "personal data", "processing", "personal data breach" and "processor" have the meaning given to them in Article 4 GDPR.
4. This version applies to new Service Contracts concluded on or after the stated effective date. Earlier contracts are subject to the amendment rules in §18 of the Terms. Publishing a new version or technically creating a CRM workspace does not amend the content previously accepted by the Controller.

§2. Subject matter, nature and purpose of processing

1. The Controller entrusts the Processor with processing personal data to the extent necessary to perform the Service Contract. The purpose is to maintain the Website and, to the extent agreed, enable the Controller to manage its contacts, submissions and cases in CRM. The Processor processes the data only for those purposes and on the Controller's instructions.
2. Depending on the functions ordered and enabled, the processing includes:
   • hosting the Website, including storing its content, files and backups,
   • operating the Website's contact form — receiving submissions and delivering them to designated e-mail addresses, saving them in the Controller's selected CRM, or doing both, according to the form configuration,
   • operating CRM: storing and updating contacts, cases, their stages and fields, notes, tasks and deadlines; making data available to authorised team members and exporting and deleting it,
   • keeping visit statistics for the Website with an analytics tool that does not store cookies on the visitor's device,
   • processing technical traffic and service data (server logs, protection against attacks and abuse, content delivery through a CDN),
   • changing the content of the Website on the Controller's instructions, including with AI Editing,
   • managing the Website's domain and SSL certificate.
3. Nature of the processing: collection, recording, storage, organisation, structuring, consultation, updating, transmission, disclosure to authorised persons, export and erasure of data in IT systems.
4. Visit statistics for the Website are collected in a shared instance of the analytics tool and kept apart by website address. The Processor uses them only to make them available to the Controller, maintain the Website and keep it secure. The private CRM workspace is excluded from visit analytics and user session recording.
5. Private CRM data is not used for the Processor's own marketing or passed to its sales CRM or messaging tools. Plugins operate only to the extent enabled on the Controller's instructions. This DPA does not cover Outlook integration, AI document analysis or storage of case attachments; making such functions available requires the processing scope and data recipients to be separately specified.

§3. Types of data and categories of data subjects

1. The processing concerns the following categories of data subjects and data, to the extent actually provided by the Controller or collected on its instructions:
   • visitors to the Website — IP address, date and time of the visit, address of the subpage visited, referring page and technical data about the browser and device,
   • people who use the Website's contact form — the data entered in the form, in particular name, e-mail address, phone number, message content and other fields defined by the Controller,
   • clients, prospective clients and other people concerned by CRM contacts or cases, including their representatives, counterparties and case participants — identification and contact details, company name and role, submissions, case description and category, stage, configured field values, notes, tasks and deadlines,
   • people authorised by the Controller to work in CRM — account identifier, name, e-mail address, role, task assignments, authorship and entry timestamps; account data processed by the Provider on its own behalf is described in the separate Service Privacy Policy,
   • people whose data the Controller places in the content of the Website (e.g. employees, associates, customers quoted in reviews) — in particular name, image, job title, contact details and review content.
2. The standard service scope does not cover special categories of personal data (Article 9 GDPR), including health data, or data relating to criminal convictions, offences or related security measures (Article 10 GDPR). Before collecting such data through a form, entering it in CRM or publishing it on the Website, the parties must separately agree and document the categories of data and data subjects, purpose, scope and duration of processing, and appropriate safeguards. The Controller identifies the applicable legal basis, including a condition under Article 9(2) or the requirements of Article 10 GDPR where applicable.
3. Selecting a law-firm CRM template or a medical case category does not constitute that agreement or a legal basis for processing. The Controller limits form, field and note content to what is needed for the agreed purpose and observes any professional secrecy duties that apply to it.

§4. Duration of processing

1. The Processor processes the data for the duration of the relevant service under the Service Contract and, after it ends, for the time necessary to return or delete the data in accordance with §12. Where CRM operates independently of the Website, ending Website maintenance does not itself end the agreed CRM service.
2. The Controller determines CRM retention periods according to the purposes and legal bases of processing and instructs deletion or deletes data using the available functions. Closing or archiving a case, disconnecting a form or disabling a plugin does not delete data already stored or start an automatic deletion period.

§5. Obligations of the Processor

1. The Processor:
   • processes personal data only on documented instructions from the Controller, including with regard to transfers to a third country, unless required to do so by Union or Polish law — in which case it informs the Controller of that legal requirement before processing, unless the law prohibits such information,
   • ensures that persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality,
   • takes the technical and organisational measures required under Article 32 GDPR and set out in §9,
   • engages other processors only on the terms set out in §7,
   • assists the Controller, insofar as possible and taking into account the nature of the processing, in responding to requests from data subjects (§10),
   • assists the Controller in complying with the obligations under Articles 32–36 GDPR, taking into account the nature of the processing and the information available to it,
   • deletes or returns personal data at the end of the provision of services in accordance with §12,
   • makes available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR and allows for audits in accordance with §13.
2. The Controller's documented instructions are the Service Contract, the Terms, this DPA and instructions given in the Panel or CRM (including form, plugin and access settings), in AI Editing of the Website or by e-mail.
3. The Processor informs the Controller without delay if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

§6. Obligations of the Controller

1. The Controller declares that it processes personal data lawfully and in particular has a legal basis for the processing entrusted to the Processor.
2. The Controller is responsible for informing data subjects, in particular for the content of the Website's privacy policy. The Processor may provide a template for such a policy, which the Controller should review and complete where necessary.
3. The Controller keeps recipient e-mail addresses up to date, selects the correct destination CRM and manages its members' access rights. It is responsible for the scope and retention of collected data and for further processing of copies received by e-mail or exported from CRM.
4. The Controller does not give the Processor unlawful instructions.

§7. Sub-processors

1. The Controller gives the Processor general authorisation to engage other processors ("Sub-processors"). On the effective date of this DPA, they are:

2. The artificial intelligence providers (Anthropic, OpenAI) receive only the content and code of the Website, the Controller's instructions and screenshots of the Website. They do not receive form submissions, visit statistics or private CRM data. Private CRM data is not stored in the Website source code repository. Where a submission is sent only to CRM, its content is not passed to Resend. The Controller does not include private CRM data in instructions for AI Editing of the Website.
3. The Processor notifies the Controller by e-mail of any intended addition or replacement of a Sub-processor at least 14 days before the change. Within that period, the Controller may raise a reasoned objection. If the parties cannot reach an agreement, the Controller may terminate the Service Contract with effect before the date of the change.
4. The Processor imposes on each Sub-processor, by contract, data protection obligations equivalent to those in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. The Processor remains liable to the Controller for the performance of the Sub-processor's obligations.

§8. Transfers outside the European Economic Area

Some Sub-processors are established in the United States or process data outside the European Economic Area. Such transfers are based on the European Commission's adequacy decision (the EU–US Data Privacy Framework) for organisations certified under it, or on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR).

§9. Security of processing

The Processor applies technical and organisational measures appropriate to the risk, in particular:

• encryption of data in transit using TLS (HTTPS) on the Website, in the Panel and CRM, and in communication with Sub-processors,
• access to systems and data limited to authorised persons, protected by authentication and limited to what is necessary for their tasks; CRM uses roles and server-side permission checks, and the Processor's administrative access serves service maintenance and support,
• data minimisation: where a form is configured only for e-mail delivery, its content is not stored in the Processor's database; when CRM delivery is enabled, it is stored in the Controller's selected private CRM. Technical submission data, including identifiers used to prevent duplicates, does not require a further copy of the form content,
• protection of the form against spam and abuse (honeypot field, completion-time check, submission limits),
• regular database backups and ongoing software updates,
• logical separation of the data of individual Websites and CRM workspaces, with CRM access restricted according to assigned permissions,
• disabling visit analytics and session recording in the private CRM workspace; public Website statistics are kept without cookies and without storing IP addresses.

§10. Data subject rights

1. If the Processor receives a request concerning data processed on the Controller's behalf directly from a data subject, it forwards the request to the Controller without delay, and no later than within 5 business days, and does not respond to it itself unless the Controller authorises it to do so.
2. At the Controller's request, the Processor provides information and carries out the technical steps needed to fulfil the request (e.g. locating, providing, deleting or correcting data in the Website content or CRM, including related notes and tasks).

§11. Personal data breaches

1. The Processor notifies the Controller of a personal data breach concerning data processed on the Controller's behalf without undue delay, and no later than 48 hours after becoming aware of it.
2. The notification contains, where possible, the information referred to in Article 33(3) GDPR: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed to address it. Where information cannot be provided at once, the Processor provides it in phases without undue further delay.
3. The Processor cooperates with the Controller in investigating the breach, mitigating its effects, notifying the supervisory authority and communicating the breach to data subjects.

§12. Return and deletion of data after the service ends

1. After the relevant service ends, the Processor, at the Controller's choice, deletes personal data processed for that service or returns it to the Controller and then deletes its copies, no later than within 30 days after the service ends, subject to the backup provisions in paragraph 3, unless Union or Polish law requires retention. Ending the Website service includes taking it offline and deleting data from the database, stored files and the current source code. Ending the CRM service includes contact and case data, fields, notes, tasks, links and technical submission identifiers. Data still needed for another agreed, ongoing service is processed only within that service's scope.
2. The Controller may specify how the data should be returned before the service ends or promptly afterwards. Return covers data processed on its behalf, including Website content and CRM data with notes and tasks, in an agreed, commonly used electronic format. The CSV export available in CRM may cover only part of that data; the Controller may request a full return from the Processor regardless of whether the export plugin is enabled. Submissions routed only to e-mail have no content copy in the Processor's database; copies delivered to the Controller's mailboxes and downloaded exports remain under its control.
3. Data contained in backups is deleted in the normal backup rotation cycle. Until deletion, backups are protected in the same way as other data and are used only for necessary disaster recovery. If a backup is restored, earlier deletion instructions are applied again.
4. Personal data contained in the Website content that remains in the version history of the source code repository is kept only in a secured, non-public repository and is not used for any other purpose. After the relevant service ends, the deletion obligation in paragraph 1 also covers that data in the version history. This does not apply to private CRM data, which is not stored in that repository.
5. Where e-mail delivery is selected, submission messages held by the delivery provider are deleted according to that provider's retention period. The Processor also fulfils return or deletion obligations in relation to Sub-processors for the data entrusted to them.

§13. Information and audits

1. At the Controller's request, the Processor makes available the information necessary to demonstrate compliance with the obligations under Article 28 GDPR, in particular a description of the security measures applied and the current list of Sub-processors.
2. The Controller may carry out an audit, including an inspection, itself or through an authorised auditor bound by confidentiality, after giving the Processor at least 14 days' notice, on business days and in a way that does not disrupt the Processor's business. Audits take place no more than once every 12 months, unless they relate to a personal data breach or a request from a supervisory authority. The Controller bears the costs of the audit.

§14. Liability

The parties' liability for damage caused in connection with the processing of personal data is governed by the GDPR, in particular Article 82, and by the Polish Civil Code.

§15. Final provisions

1. This DPA remains in force for the duration of processing under the Service Contract, subject to the obligations set out in §12.
2. In matters of personal data protection, the provisions of this DPA take precedence over those of the Terms and the Service Contract.
3. This DPA is amended in the manner provided for amendments to the Terms (§18 of the Terms), except for changes to the list of Sub-processors, which are governed by §7(3).
4. Matters not covered by this DPA are governed by the GDPR, the Polish Personal Data Protection Act of 10 May 2018 and the Polish Civil Code. This DPA is governed by Polish law.
5. This DPA is available in Polish and English on the terms set out in §19(4) of the Terms.