Data Processing Agreement

Parties

Controller:   (company name), registered office:  , tax ID:  , represented by:   (the “Controller”, the “Customer”),

Processor: Konrad Bejger, a sole trader operating under the business name “Konrad Bejger”, entered in the Polish Central Register and Information on Economic Activity (CEIDG), ul. Magellana 6/64, 80-288 Gdańsk, Poland, tax ID (NIP) 8781795948, REGON 367501781, e-mail: [DO UZUPEŁNIENIA: e-mail kontaktowy] (the “Processor”, “Footler”).

§ 1. Definitions and subject matter

1. “Personal data”, “processing”, “personal data breach” and other terms have the meaning given in Regulation (EU) 2016/679 (the “GDPR”). The “Main Agreement” is the contract for the Footler services concluded under the Terms of Service, and the “Service” means the services provided under it.
2. The Controller entrusts the Processor with processing personal data to the extent and for the purpose set out in this Agreement, and the Processor undertakes to process it in accordance with this Agreement, the GDPR and other data protection law.

§ 2. Nature, purpose and scope of processing

1. Purpose: providing the Service – creating, storing and hosting e-mail signatures (PNG images and animated GIFs) and online contact cards of the people the Controller designates, recording animations, sending e-mails related to the Service, counting contact card opens and helping with signature installation.
2. Nature: collection (data entered by the Controller), storage, organisation, adaptation (generating images and animations), disclosure (making signatures and contact cards publicly available at links the Controller puts in its messages) and erasure, and, in AI-based features, analysis.
3. Categories of data subjects: employees, collaborators, contractors and other people whose signatures the Controller creates in the Dashboard, and the Controller’s contact persons.
4. Categories of data: name, job title, phone numbers, e-mail address, social media profiles (e.g. LinkedIn), photo, slogan and other signature texts, company data (name, address, website, logo) and the number of contact card opens.
5. The Controller does not entrust special categories of data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10 GDPR).
6. Duration: for the term of the Main Agreement and, after it ends, until the data is deleted or returned under § 9.

§ 3. Processor’s obligations

1. The Processor processes the data only on documented instructions from the Controller, including with regard to transfers to a third country, unless required to do so by law – in which case it informs the Controller before processing, unless the law prohibits this. The instructions are this Agreement, the Terms of Service and the Controller’s actions in the Dashboard (e.g. adding a person, changing data, choosing a design).
2. The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law.
3. The Processor ensures that people authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.
4. The Processor takes the security measures required by Article 32 GDPR, described in Annex 2.
5. The Processor helps the Controller respond to requests from data subjects (Chapter III GDPR): through the Dashboard’s features (editing and deleting people) and by responding to the Controller’s requests within 7 days. It forwards any request addressed directly to it to the Controller without undue delay.
6. The Processor helps the Controller comply with Articles 32–36 GDPR (security, breach notification, impact assessment, prior consultation), taking into account the nature of processing and the information available to it.
7. The Processor keeps a record of categories of processing activities where Article 30(2) GDPR requires it.

§ 4. Sub-processors

1. The Controller gives general authorisation to engage the sub-processors listed in Annex 1.
2. The Processor informs the Controller by e-mail at least 14 days in advance of any intended addition or replacement of a sub-processor. The Controller may raise a reasoned objection during that time; if the parties do not reach agreement, the Controller may terminate the Main Agreement without additional costs.
3. The Processor imposes on sub-processors, by contract, the same data protection obligations as in this Agreement and is liable for their acts as for its own.

§ 5. Transfers outside the EEA

Data may be transferred to countries outside the European Economic Area only with the safeguards of Chapter V GDPR set out in Annex 1.

§ 6. Personal data breaches

1. The Processor notifies the Controller of a breach affecting the entrusted data without undue delay and no later than 48 hours after becoming aware of it.
2. The notification contains at least the information listed in Article 33(3) GDPR, as far as available; the Processor provides missing information as soon as it obtains it.
3. The Processor cooperates with the Controller in investigating the breach and limiting its consequences.

§ 7. Information and audits

1. The Processor makes available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR.
2. The Controller or an auditor it authorises, bound by confidentiality, may carry out an audit or inspection after giving the Processor at least 14 days’ notice, no more than once every 12 months (unless there has been a breach or a supervisory authority requires it), on working days and without access to other customers’ data. Audits are carried out primarily through written questions and documents.
3. The Controller bears the costs of an audit unless the audit reveals a material breach of this Agreement by the Processor.

§ 8. Controller’s obligations

The Controller ensures that it has a legal basis for processing the entrusted data and for making it publicly available in signatures and contact cards, that it has informed the data subjects about this (Articles 13 and 14 GDPR), and that the data is accurate.

§ 9. Deletion or return of data

1. After the Main Agreement ends, the Processor – at the Controller’s choice – deletes the entrusted data or returns it in electronic form (e.g. CSV or JSON) and deletes existing copies, within 30 days, unless the law requires further storage.
2. Data in backups, if backups are made, is deleted as part of their rotation, at the latest within 90 days.
3. Once the data is deleted, the signatures and contact cards are no longer available at their previous links.

§ 10. Liability

The parties are liable in accordance with Article 82 GDPR. Otherwise, the liability provisions of the Terms of Service apply, to the extent permitted by the GDPR.

§ 11. Final provisions

1. This Agreement remains in force for the term of the Main Agreement and until the obligations in § 9 are fulfilled.
2. In matters of personal data protection, this Agreement takes precedence over the Terms of Service.
3. Changes to this Agreement require documentary form or the procedure for changing the Terms of Service.
4. This Agreement is governed by Polish law. Disputes are resolved by the court set out in the Terms of Service. If the Polish and English versions differ, the Polish version prevails.

Annex 1. Sub-processors

Annex 2. Technical and organisational measures

• encrypted connections (HTTPS/TLS);
• passwords stored only as salted scrypt hashes; session identifiers stored as hashes; HttpOnly, SameSite and Secure session cookie;
• random, long links that cannot be guessed for dashboards, contact cards and proposals pages;
• access control to the Dashboard: an account with a password set after confirming the e-mail address, or a private key;
• request limits and abuse protection; verification of incoming mail senders (DKIM, DMARC);
• blocking access to private network addresses when fetching websites, with size and time limits;
• content of received e-mails treated as untrusted – never displayed as HTML on the Service’s pages;
• data minimisation: the AI model receives only the data needed for the task; the Service does not record who displayed a signature or when;
• access to production data only for the Processor and authorised people bound by confidentiality;
• infrastructure at a hosting provider with physical and network security of its data centres;
• regular software updates and a breach handling procedure (§ 6).