Data Processing Agreement (template)

This Data Processing Agreement ("DPA") under Article 28 GDPR forms part of the Terms of Service between the Business Customer ("Controller") and IBB MEDIA Roman Rozenberger, Kargowska 12, 66-133 Klenica, Poland, NIP 929 179 66 80 ("Processor"). It applies when submitted pages or content contain personal data. A signed copy is available on request at roman@rozenberger.com.

1. Subject, duration, nature and purpose

• Subject: analysis of web pages and content submitted by the Controller against spam and quality rules.
• Duration: for the term of the Terms, plus the retention periods below.
• Nature: fetching, storage, automated analysis by language models, reporting, deletion.
• Purpose: providing the Service to the Controller only.

2. Data and data subjects

• Categories of data: personal data that may appear in submitted pages or content (for example names, contact details or opinions of authors and persons mentioned), URLs, and data of the Controller's users.
• Data subjects: authors and persons mentioned in analysed pages; the Controller's users.
• The Controller must not submit special categories of data (Article 9 GDPR) unless strictly necessary.

3. Processor obligations

The Processor:

1. processes data only on documented instructions of the Controller (the Terms, settings such as private mode, and API requests), including for transfers to third countries;
2. ensures that persons authorised to process data are bound by confidentiality;
3. implements the measures in Annex 1 (Article 32 GDPR);
4. assists the Controller with data subject requests, security, breach notification, DPIAs and prior consultation, taking into account the nature of processing;
5. notifies the Controller of a personal data breach without undue delay, and in any case within 48 hours of becoming aware of it;
6. at the end of the service deletes the data (content and reports within 30 days), unless law requires storage, and confirms deletion on request;
7. makes available information necessary to demonstrate compliance and allows audits, primarily by providing documentation; on-site audits on 30 days' notice, at the Controller's cost, no more than once a year.

4. Sub-processors

The Controller gives general authorisation for sub-processors. The current list is in section 3 of the Privacy Policy. The Processor informs the Controller at least 14 days before adding or replacing a sub-processor; the Controller may object on reasonable grounds and, if no solution is found, terminate. The Processor imposes the same data protection obligations on each sub-processor.

5. International transfers

Transfers outside the EEA rely on an adequacy decision or the Standard Contractual Clauses (2021/914, Module 3 processor-to-processor where applicable) with supplementary measures.

6. Retention

Page content: 30 days after the job ends (private mode: deleted when the job ends). Reports: 90 days during the beta or until the Controller deletes them. Logs: 30 days, host only.

7. Liability and precedence

Liability follows the Terms, subject to Article 82 GDPR. In case of conflict on data protection, this DPA prevails over the Terms.

Annex 1 - Technical and organisational measures

• Encryption in transit (TLS) and, where supported by the hosting provider, at rest.
• URL normalisation removing tracking and secret parameters; keyed hashes of URLs; private mode.
• Organisation and project isolation; role-based access; API keys and tokens stored only as hashes.
• Logs without full URLs, passwords or keys; access to production limited to authorised staff.
• Outbound fetching with network guards against internal addresses (SSRF protection).
• Backups and documented incident response.