DRAFT 2026-10-draft – to be reviewed by a lawyer. Marked sections [TO BE COMPLETED] require approval prior to publication.

Data Processing Agreement

Version 2026-10-draft · effective from 12 October 2026 · concluded pursuant to Article 28(3) of the GDPR

The contract is concluded automatically upon ordering a Service in which the Customer stores or processes personal data (hosting, VPS, dedicated servers, gaming servers, streaming, GPU, AI model APIs, email). Acceptance of the order constitutes the conclusion of a contract in electronic form.

§1. Parties and subject matter

  1. The data controller is the Customer. The data processor is Sprzedaje.tv sp. z o.o., 13a Xawerego Dunikowskiego Street, 41-407 Imielin, KRS 0001059914, NIP 6463006982 (‘the Processor’).
  2. The Controller entrusts the Processor with the processing of personal data to the extent necessary to provide the Services described in the Terms and Conditions, for the duration of the contract for the provision of Services.

§2. Scope of processing

Nature and purposeHosting, sharing computing resources, transferring data over a network, taking backups (whilst the data is within the Service), and processing data submitted to the AI model API to generate responses.
Data typesData that the Controller places on the Service – in particular, identification and contact details, data relating to the Controller’s customers and users, the content of correspondence, and logs; and potentially also special categories of data, should the Controller place such data on the Service.
Categories of peopleCustomers, business partners, employees, users of the Controller’s websites and applications, and other individuals whose data the Controller processes.
LocationThe Processor’s own data centre in Imielin (13a Xawerego Dunikowskiego Street, 41-407 Imielin, Poland). Backup copies are also stored off-site using the OVH service, at a data centre in Warsaw (see sub-processors). Data is not transferred outside the European Economic Area.

The Data Processor does not examine the content of the Controller’s data and does not process it for its own purposes. Access to the data is granted only where necessary to provide the Service, to resolve a fault, or at the Controller’s instruction (e.g. a support ticket).

§3. Obligations of the Data Processor

  1. It processes data solely on the basis of a documented instruction from the Controller – such instructions include, in particular, the contract, the Service configuration and requests from the Controller. If an instruction contravenes the law, the Processor shall notify the Controller of this without delay.
  2. It ensures that those authorised to process data have undertaken to maintain confidentiality.
  3. It applies the security measures set out in Article 32 of the GDPR, including:
    • control of physical access to the server room and administrative access (SSH keys, multi-factor authentication for management panels);
    • the separation of client environments (system accounts, virtualisation, networks);
    • firewalls, protection against attacks and blocking of attempted breaches;
    • transmission encryption (TLS) for dashboards and APIs;
    • security updates for infrastructure systems;
    • backups as described in the Service;
    • logging of administrative access and security events.
  4. It assists the Controller, to the extent possible and taking into account the nature of the processing, in fulfilling the rights of data subjects and the obligations set out in Articles 32–36 of the GDPR.
  5. It provides the information necessary to demonstrate compliance with its obligations and facilitates audits – upon written request, with at least 14 days’ notice, during working hours, no more than once a year (unless a breach has occurred), without access to other customers’ data. The costs of the audit shall be borne by the Controller.

§4. Data breaches

  1. The Data Processor shall report any detected data breach to the Controller without undue delay, and no later than 24 hours after it has been detected, to the Controller’s email address via the Customer Portal.
  2. The notification shall include, where available: a description of the breach, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken and proposed.
  3. It is the Data Controller’s responsibility to submit a report to the President of the Personal Data Protection Office and to notify the individuals concerned.

§5. Sub-contracting (sub-processors)

  1. The Data Controller grants general consent to the use of the sub-processors listed on the ‘Sub-processors’ page.
  2. The Processor shall give at least 14 days’ notice of any planned change (addition or replacement of a sub-processor) by email or via the Customer Portal. The Controller may, within this period, raise a justified objection; if the parties fail to reach an agreement, the Controller may terminate the contract with effect from the date of the change.
  3. The data controller imposes the same data protection obligations on sub-processors and is responsible for their actions as if they were its own.

§6. Conclusion

  1. Upon completion of the Service, the Processor shall delete the Controller’s data at the end of the period specified in §10 of the Terms and Conditions, during which the Controller may retrieve them, unless the law requires them to be retained for a longer period.
  2. Backups containing data are deleted in accordance with their rotation cycle, no later than 30 days after the data has been deleted from the servers (§10 of the Terms and Conditions), i.e. as a general rule, no later than 60 days after the Service has ended.

§7. Liability and final provisions

  1. The liability of the parties for damages arising from a breach of this agreement is governed by Article 82 of the GDPR; in relations between parties who are businesses, the limitations set out in §8 of the Terms and Conditions shall apply to the extent permitted by law.
  2. In matters not covered herein, the Terms and Conditions, the GDPR and Polish law shall apply. In the event of any conflict with the Terms and Conditions regarding data protection, this agreement shall take precedence.
  3. The Data Protection Officer for the Data Controller: Daniel Bryniarski, contact: rodo@cyberplaneta.pl.