Parties and application
This document has been prepared in Polish and English. In the event of any discrepancy between the language versions, the Polish version shall prevail, unless mandatory law provides otherwise.
This Data Processing Agreement (“DPA”) is Appendix 1 to the Terms and applies where the Client, as controller, entrusts the Service Provider with processing personal data in connection with ContentDeliver.
The Service Provider acts as processor particularly for data of staff, Partners, invitees, communication recipients and other data placed by the Client in Materials. For Client account, billing, security and its own marketing data, the Service Provider may act as an independent controller under the Privacy Policy.
Subject matter, duration, nature and purpose
The subject matter is hosting, organising, making available and technically processing data in the Service, sending invitations and notifications, storing Materials, publishing to social platforms on the Client’s or Partner’s instruction, and processing deletion requests.
Processing continues for the term of the Agreement and the time necessary for deletion, return, anonymisation, backups, legal obligations and claims.
Operations may include collection, recording, organisation, storage, adaptation, transmission, disclosure, restriction, deletion and anonymisation in accordance with documented Client instructions.
Categories of data subjects and data
Data subjects include Client representatives, employees and contractors, Partners and their personnel, invitees, message recipients, persons appearing in Materials and social-account users whose data the Client lawfully places in the Service.
Data categories may include identification and contact data, business email addresses, roles and permissions, communications, social-account identifiers, texts, photographs, videos, technical data, operation and publication history, and other data submitted by the Client.
The Service is not intended for deliberate processing of special categories of data or criminal-conviction data. The Client will not submit them unless necessary, lawful and agreed with the Service Provider in advance.
Instructions and Client obligations
The Terms, account configuration, User actions and separate arrangements constitute documented Client instructions. The Service Provider processes data only on that basis unless law requires otherwise.
The Client ensures that instructions comply with law, that legal bases exist, required notices are given and data are lawfully disclosed to the Service Provider, Partners and Third-Party Platforms.
If an instruction infringes the GDPR, the Service Provider will inform the Client and may suspend execution until the instruction is clarified or changed.
Confidentiality and access
Persons authorised by the Service Provider are bound by confidentiality and receive access only as necessary for maintenance, support, security, billing and execution of instructions.
Administrative access and technical ability to decrypt a token may be used only for justified operational, diagnostic or security purposes and should be access-controlled and appropriately logged.
Security
The Service Provider applies measures appropriate to risk, including password hashing, encryption of social tokens, HTTPS, secure cookie attributes, CSRF protection, access control, organisation isolation, rate limiting, webhook signature verification, secret redaction in logs, idempotency, retries and a protected deletion process.
The Client is responsible for managing its Users, roles, passwords, devices, social-account security, automation scope and timely revocation of permissions.
Measures may evolve with technology provided the overall level of protection is not materially reduced.
Sub-processors
The Client grants general authorisation to use sub-processors listed in the current Sub-processor List. The Service Provider ensures that each sub-processor is bound by data-protection obligations appropriate to the service.
The Client will be informed at least 14 days before adding or replacing a material sub-processor, unless an urgent change is required for security, law or service continuity.
The Client may raise a reasoned data-protection objection. The parties will seek a reasonable solution; if none is possible, the Client may stop using the dependent functionality or terminate at the end of the paid period, without refund for a period already commenced.
International transfers
Data are primarily hosted in Poland. Use of Stripe, Meta, Google, LinkedIn or Cloudflare may result in access or transfer outside the EEA. The Service Provider relies on transfer mechanisms made available by those providers, including adequacy decisions, the Data Privacy Framework or standard contractual clauses, depending on the relevant flow.
Where required by the nature of a transfer, the Client authorises the Service Provider to enter into standard contractual clauses on its behalf to the extent necessary to provide the Service.
Assistance to the Client
Taking account of the nature of processing, the Service Provider reasonably assists the Client with access, rectification, deletion, restriction, objection and portability requests. Standard deletion functions are available in the Service; other requests should be sent to [email protected].
The Service Provider also assists, based on available information, with security, breach, impact-assessment and supervisory-consultation obligations. Assistance beyond standard functionality may be charged at an agreed rate unless required due to a breach caused by the Service Provider.
Personal data breaches
The Service Provider will notify the Client without undue delay after becoming aware of a breach involving entrusted data, providing available information on the nature, possible consequences, measures taken and contact point.
Notification does not constitute admission of fault or liability. The Client is responsible for notifications to authorities and individuals unless otherwise agreed.
Deletion and return
After termination, the Service Provider deletes or anonymises entrusted data under the Service process, except data required by law, data needed for claims and backups retained for up to 30 days.
The Client should download required Materials before termination. The Service Provider is not required to maintain a custom export after irreversible purge begins.
Audits
Upon reasoned request, the Service Provider will provide information necessary to demonstrate compliance with Article 28 GDPR. An audit must have at least 30 days’ notice, occur no more than annually, avoid disruption and protect other clients’ data and trade secrets.
The Client bears audit costs unless the audit identifies a material breach by the Service Provider. Remote or documentary audit takes precedence over an on-site visit.
Precedence and liability
In case of conflict, this DPA prevails over the Terms on processing matters. Liability under this DPA is subject to the Terms’ limitations to the fullest extent permitted by law, without prejudice to rights of data subjects and authorities under the GDPR.