Data Processing Agreement

01Parties and roles

The CONTROLLER of the data entered into a workspace is the CUSTOMER — the organisation the workspace was created for. The customer decides the purposes and means of processing.

Where the customer runs projects in the workspace in which it processes data on behalf of its own contracting party, that party remains the controller, the customer is its processor, and we are a further processor. The customer represents that it holds the controller’s authorisation for such further processing; this agreement then applies accordingly.

The PROCESSOR is Jacek Bobowik „JCBSOFT", ul. Jabłoniowa 9, 39-400 Tarnobrzeg, VAT ID 8671007677 (hereinafter “JCBSOFT”). We process the data solely to provide the service and solely on the customer’s instructions.

This agreement is concluded when it is accepted at the creation of the workspace and lasts as long as the service contract, and after it ends — for the retention periods described in the section on deletion.

02Subject matter and purpose

The subject matter is the administration of the customer’s project portfolio: keeping registers of projects, risks, changes, decisions, documents, working time and absences, and sharing reports with recipients the customer designates. The operations comprise collection, storage, organisation, consultation, disclosure, export and erasure of data.

The purpose is solely to provide the service in the scope the customer has chosen. We do not use the entrusted data for our own purposes, in particular not for product development on customer data, profiling or marketing.

03Types of data

Identification and contact data of users: name, e-mail address, login, role in the organisation, job title, and telephone number where the customer enters one.

Work data: time records, assignments to projects and tasks, absences (vacation, sick leave, training, other), and billing rates where the customer keeps them.

Content entered by users: descriptions, comments, notes, attachments, minutes and event log entries. These are free-text fields and their content depends on the customer.

Third-party data the customer enters into the registers: stakeholders, contact persons at counterparties, and recipients of materials shared through the stakeholder portal.

04Categories of data subjects

Employees, collaborators and subcontractors of the customer who use the workspace.

Persons named by the customer in project data who do not use the service themselves.

Persons to whom the customer shares materials through the stakeholder portal.

05Special category data

The absence module allows an absence to be marked as SICK LEAVE. Such information, attached to a named person, is health data within the meaning of Article 9 GDPR. The note field on an absence is free text and may contain such data as well.

The decision to use that feature belongs to the customer, who is responsible for securing a basis for the processing. Where the customer uses it, we process such data only to the extent needed to run the service, taking into account the heightened risk arising from its nature. We recommend that an absence note carry only the information needed to record the absence and not describe the person’s state of health.

06The controller’s instructions

We process the data solely on the customer’s documented instructions. Instructions are: use of the service for its intended purpose, the configuration the customer applies to their workspace, and separate requests sent to the address given below.

If we consider an instruction to infringe the GDPR or other data protection law, we will inform the customer without delay and may suspend its execution pending clarification.

There is one exception to acting solely on the customer’s instructions: processing required by European Union or Polish law. In that case we inform the customer of the requirement before processing, unless the law prohibits it. Server services, the database and file storage operate within the European Union; the cases in which data may be accessible from outside the European Economic Area, and the basis for such access, are described in the privacy policy.

07Confidentiality and authorisations

Access to customer data is granted only to persons who need it to provide the service, on the basis of an authorisation and after a confidentiality undertaking. The undertaking remains binding after the cooperation ends.

Staff access to workspace data uses separate accounts, and operator actions concerning a workspace are recorded in the operator trail.

08Security measures

We apply technical and organisational measures appropriate to the risk, providing for the separation of individual customers’ data, restriction of access in line with granted permissions, protection of authentication data and access keys, recording of significant operations and encryption of transmission.

We enforce the separation of customers’ data in the database layer, not in the application alone; the aim is that data in one workspace is not accessible from another. Technical privileges are split according to the principle of least necessary access — the internet-facing component holds privileges limited to serving user requests.

Access to the application requires authentication with an identity provider, separate for each workspace. The number of failed sign-in attempts is limited, the session is held in a way inaccessible to page scripts, and transmission takes place over an encrypted channel only.

Significant operations are written to a log protected against alteration of an individual entry. Entries are removed together with an entire workspace, or on the customer’s instruction, as they may delete entries in their own workspace older than a number of days they choose, no fewer than 30.

A detailed and current description of the measures applied is a confidential document; we provide it at the customer’s request, under the procedure in the section on information and audits. The agreement states the categories of measures, because their specific form changes as the service develops.

09Sub-processors

The customer gives general authorisation for our use of sub-processors. As at the conclusion of this agreement they are:

• Vercel Inc. (Delaware, Stany Zjednoczone) — hostowanie warstwy frontowej (statyczne strony i aplikacja przeglądarkowa).

• Scaleway SAS (Francja) — hostowanie usług serwerowych i dostawcy tożsamości, w regionie Warszawa.

• Supabase Pte. Ltd. (Singapur) — baza danych i składowanie plików, w regionie Unii Europejskiej.

• Prociv Sp. z o.o. (Wrocław, NIP 8971776931) — serwis domenomania.pl — wysyłka wiadomości systemowych pocztą elektroniczną.

We impose on each sub-processor, by contract, the same data protection obligations as those under this agreement. We remain liable to the customer for that sub-processor’s performance of its data protection obligations, in accordance with Article 28(4) GDPR.

We give at least 14 days’ notice of an intention to add or change a sub-processor, to the workspace owner’s address. The customer may raise a reasoned objection within that time; if it cannot be accommodated, the customer may terminate the service contract with effect from the day the change takes place.

10AI provider integrations

AI-supported features are off by default and work only where the customer enables them, providing their own access key. Without the customer’s key we pass no data to a provider.

THE CUSTOMER CONTRACTS THE AI PROVIDER and is the party to that agreement; the provider acts on terms the customer has accepted and bills the customer. We do not contract the provider in our own name, nor do we use it for our own purposes.

TRANSMITTING THE CONTENT TO THE PROVIDER IS NONETHELESS OUR PROCESSING and is covered by this agreement. The request leaves our service: we take the content covered by a specific user instruction, attach the customer’s key and pass it to the provider at the moment the feature is invoked. We do not retain the content of the request or of the response outside the customer’s workspace — the log keeps the fact of the call together with the provider, model, purpose and character counts.

We admit only providers whose terms exclude training models on customer content, provide for a processing agreement and state retention. The privacy policy describes which providers are currently admitted, and the condition is enforced in the system, not merely declared in a document.

11Assistance with data subject rights

We provide the customer with tools supporting the handling of data subject requests — access, rectification, erasure and export of data from their workspace — and we give them the necessary assistance.

Where a request requires action on our side, we take it without undue delay following the customer’s request sent to biuro@jcbsoft.pl.

If a data subject’s request reaches us directly, we do not handle it ourselves — we pass it to the customer and inform the person who made it.

12Personal data breaches

We notify the customer of a breach of the entrusted data without undue delay after becoming aware of it, to the workspace owner’s address.

The notification states the nature of the breach, the categories and approximate number of persons and records concerned, the described consequences and the measures taken or proposed — to the extent we hold that information at the time of notifying. The rest follows in phases, as it is established.

Notifying the supervisory authority and the data subjects is the customer’s duty as controller. We assist them to the extent of the information we hold.

13Information and audits

We make available to the customer the information necessary to demonstrate compliance with the obligations under Article 28 GDPR, and we allow for and contribute to audits, including inspections, conducted by the customer or an auditor they mandate.

Verification is carried out in the first instance on the basis of documentation, which does not exclude the right to inspect. Planned audits take place no more than once in a calendar year, on at least 14 days’ notice, on business days. Those limits do not apply where an additional audit is justified by a personal data breach affecting the customer’s workspace or by a request from a competent supervisory authority.

An audit takes place with confidentiality preserved, with the data of other customers and our trade secrets protected, and with disruption to the service kept to a minimum.

We assist the customer in performing the obligations under Articles 32–36 GDPR — securing the processing, notifying breaches, data protection impact assessments and prior consultation with the supervisory authority — taking into account the nature of the processing and the information available to us.

14Deletion and return of data

After the service contract ends the workspace becomes read-only for 14 days, which lets the customer export the data themselves. We then keep it for a further 6 months, after which it is deleted from live systems.

Deletion before that deadline takes place at the customer’s request sent from the workspace owner’s address.

Backups of the DATABASE are taken daily and kept for no longer than 7 days. Data cannot be removed from an existing backup, so it leaves the backup when the backup expires.

File content is held in object storage and is NOT covered by the database backup. We cannot restore a deleted file within the service — we hold no copy of it.

After an earlier backup is restored we re-apply the deletion instructions issued after it was taken — both deletions of entire workspaces and deletions of individual accounts. This is a fixed step of the restore procedure, not something done on request: the instructions are recorded outside the database before the deletion takes place, so restoring a backup does not erase them.

This does not cover deletions of individual records inside a workspace — a project, a document or a time entry, for example. We notify the customer of every restore, and we repeat such deletions at their request.

ONLY our own accounting documents are excluded from deletion: the invoices we issue to the customer for the service and the related records, whose retention is required by tax and accounting law. This does not cover documents or data the customer has entered into the workspace — those are deleted on the terms described above.

15Final provisions

In matters concerning the protection of data entrusted by the customer, this agreement prevails over the terms of service. Otherwise the terms of service, Polish law and the GDPR apply.

Amending this agreement requires publishing a new version and its acceptance. The version the customer accepted is stored together with the date of acceptance and can be downloaded.

Data protection contact: biuro@jcbsoft.pl.