Umowa o przetwarzaniu danych

1. Definitions

“GDPR” means Regulation (EU) 2016/679. “Personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meanings given to them in the GDPR.

“Services” means the Beskos workspace: email, calendar, contacts, files, documents, chat, meetings, wiki, boards and the assistant, together with the administration console.

“Customer Data” means all data the Controller or its users submit to, store in, or generate through the Services, including the content of messages, files and documents.

“Sub-processor” means a third party engaged by the Processor to process personal data on behalf of the Controller.

2. Roles of the parties

The Controller determines the purposes and means of the processing of Customer Data. The Processor processes Customer Data only on behalf of the Controller.

Where the Controller is itself a processor acting on behalf of a third-party controller, the Processor acts as a sub-processor, and this DPA applies accordingly.

The Processor acts as an independent controller in respect of account administration data (billing details, the identity of administrators, security and audit logs). That processing is described in the Privacy Policy and is not governed by this DPA.

3. Scope and instructions

The Processor processes Customer Data only on documented instructions from the Controller. The Terms of Service, this DPA and the Controller's use of the features of the Services constitute those instructions.

The Processor does not use Customer Data for its own purposes. In particular, the Processor does not sell Customer Data, does not use it for advertising, and does not use it to train artificial intelligence models, whether its own or those of any third party.

The Processor informs the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection law. The Processor may suspend the execution of that instruction until it is confirmed or withdrawn.

Where the Processor is required by Union or Member State law to process Customer Data other than on the Controller's instructions, it informs the Controller of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

4. Confidentiality

The Processor ensures that persons authorised to process Customer Data are bound by an obligation of confidentiality, and that access is limited to those who need it to provide, secure or support the Services.

Administrative access to production systems is restricted to authorised personnel, granted on the principle of least privilege and reviewed as roles change.

5. Security of processing

The Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as required by Article 32 of the GDPR.

The measures in force are described in Annex II. The Processor may update them, provided the level of security is not reduced. Annex II describes measures that are in place; it does not describe planned measures.

6. Sub-processors

The Controller gives the Processor general written authorisation to engage sub-processors. The current list is published at beskos.com/sub-processors and forms part of this DPA.

The Processor gives at least 14 calendar days' notice before engaging a new sub-processor or replacing an existing one. Notice is given by email to the addresses registered for billing and administration and by updating the published list.

The Controller may object to a new sub-processor on reasonable data-protection grounds within those 14 days, by writing to privacy@beskos.com. The parties will discuss the objection in good faith. Where it cannot be resolved and the Processor nonetheless engages the sub-processor, the Controller may terminate the affected Services and receive a refund of any prepaid fees for the unused period.

The Processor imposes on each sub-processor data protection obligations no less protective than those set out in this DPA, and remains fully liable to the Controller for the performance of the sub-processor's obligations.

7. International transfers

Customer Data is processed and stored within the European Union. The application, database and mail servers are located in the European Union; files are held in storage under European jurisdiction; artificial-intelligence processing takes place in European data centres.

Certain sub-processors are companies established in the United States, notwithstanding that the data is processed within the European Union. Where personal data is transferred to, or is accessible from, a third country, the transfer is governed by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) or Module Three (processor to processor) as applicable, supplemented by the measures described in Annex II.

The Processor does not represent that no provider in its supply chain is subject to foreign legislation. The published sub-processor list states, for each provider, where the data is processed and which transfer mechanism applies.

If the Processor receives a legally binding request from a public authority for disclosure of Customer Data, it notifies the Controller before disclosure unless prohibited by law; where prohibited, it uses reasonable efforts to obtain a waiver of that prohibition and challenges the request where there are reasonable grounds to consider it unlawful.

8. Assistance to the Controller

Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in fulfilling its obligation to respond to requests from data subjects exercising their rights under Chapter III of the GDPR. The administration console allows the Controller to access, export, correct and delete the data of its users without the Processor's involvement.

Where a data subject contacts the Processor directly in relation to Customer Data, the Processor does not respond to the substance of the request but refers the data subject to the Controller and informs the Controller without undue delay.

The Processor assists the Controller in ensuring compliance with Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to the Processor.

9. Personal data breaches

The Processor notifies the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data.

The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where the information is not available at once, it is provided in phases without undue further delay.

The Processor does not notify supervisory authorities or data subjects on the Controller's behalf unless the Controller instructs it to do so in writing.

10. Return and deletion

During the term of the Services the Controller may export Customer Data at any time and without the Processor's assistance: email over IMAP, calendars in iCalendar format, contacts in vCard or CSV, and files by download, including whole folders as archives.

On termination of the Services the Processor deletes Customer Data within 30 days, unless Union or Member State law requires its retention. Backups, where they exist, are deleted in accordance with their retention cycle.

The Processor certifies deletion in writing on request.

11. Information and audits

The Processor makes available to the Controller the information necessary to demonstrate compliance with Article 28 of the GDPR, including this DPA, the published sub-processor list, the Security page and the answers to reasonable written questions.

The Processor holds no security certification at the date of this DPA. It does not claim conformity with ISO 27001, SOC 2 or any comparable standard.

The Controller may audit the Processor's compliance no more than once in any twelve-month period, on 30 days' written notice, during business hours, and in a manner that does not disrupt the Services or compromise the confidentiality of other customers' data. Where an audit is required by a supervisory authority, or follows a personal data breach, that limitation does not apply.

12. Term, precedence and liability

This DPA applies for as long as the Processor processes Customer Data on behalf of the Controller, and the obligations in clauses 4, 7 and 10 survive its termination.

In the event of a conflict between this DPA and the Terms of Service, this DPA prevails in respect of the processing of personal data. In the event of a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service, to the extent permitted by applicable law. Nothing in this DPA limits any liability that cannot be limited under the GDPR.

This DPA is governed by Polish law. The English text is the authentic version; any translation is provided for convenience only and, in the event of a discrepancy, the English text prevails.