Data Processing Agreement (Annex to the Website Care Terms of Service)

This agreement is concluded under Article 28(3) GDPR. Article 28(9) GDPR expressly allows the electronic form, so acceptance together with the Terms of Service is sufficient — no signature is required.

1. Roles

The Customer is the controller. The Provider (PLSoft, Paweł Lipowczan) is the processor.

2. Subject matter, duration, nature and purpose

The Provider processes personal data solely in order to operate and maintain the Customer's website under the Terms of Service. Processing lasts for as long as that agreement is in force.

3. Types of personal data and categories of data subjects

Category of data subject	Personal data
People sending an enquiry through the website	name, e-mail address, telephone number, content of the message
Website visitors	technical data in server and access logs, including IP address
Customer's own staff with panel access	e-mail address, sign-in events

The Provider does not process special categories of data under Article 9 GDPR. The Customer must not place such data into the website's data store.

4. Instructions

The Provider processes personal data only on the Customer's documented instructions, including as regards transfers to third countries, unless required to do otherwise by EU or member state law; in that case the Provider informs the Customer before processing, unless the law prohibits it. The Terms of Service and this annex are the Customer's initial documented instructions.

The Provider informs the Customer if, in its opinion, an instruction infringes the GDPR.

5. Confidentiality

The Provider ensures that any person authorised to process the personal data is bound by confidentiality.

6. Security

The Provider implements appropriate technical and organisational measures under Article 32 GDPR, including: encryption of data in transit, access control with individual credentials and multi-factor authentication where available, separation of each customer's data store, regular backups, and restriction of access to those who need it to deliver the service.

7. Sub-processors

The Customer grants a general authorisation for the use of sub-processors. Those engaged at the effective date are:

Sub-processor	Role	Processing location
Vercel Inc.	website hosting and delivery	EU region, company established in the USA
Supabase	database and file storage	EU regions, company established in the USA
Resend	transactional e-mail	EU region, company established in the USA

The Provider informs the Customer by e-mail at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data-protection grounds; if the objection cannot be resolved, the Customer may terminate the Terms of Service with effect from the date of the intended change. The Provider imposes on each sub-processor obligations no less protective than those in this annex.

8. International transfers

Data is stored in EU regions. Where a sub-processor may access the data from outside the EEA, the transfer is covered by the Standard Contractual Clauses approved by the European Commission, as incorporated in that sub-processor's own data processing agreement:

Sub-processor	Transfer mechanism
Vercel Inc.	Standard Contractual Clauses, or processing limited to countries covered by an adequacy decision
Supabase	Standard Contractual Clauses (data importer: Supabase Pte. Ltd, plus the UK addendum)
Resend	Standard Contractual Clauses, Module Two (controller to processor)

None of the three relies on an adequacy decision for the United States as its sole basis.

9. Assistance to the Customer

The Provider assists the Customer, taking into account the nature of the processing and the information available to it, in:

a) responding to requests from data subjects under Chapter III GDPR — the Provider forwards any such request received directly to the Customer without undue delay and does not respond to it itself, unless instructed to; b) meeting the obligations under Articles 32–36 GDPR; c) notifying personal data breaches — the Provider informs the Customer without undue delay, and in any case within 24 hours of becoming aware of a breach, with the information needed for the Customer's own notification.

10. Deletion and return

On termination of the Terms of Service, the Provider, at the Customer's choice, returns the personal data to the Customer or deletes it, and deletes existing copies within 30 days, unless EU or member state law requires storage. Where the Customer has requested a transfer of the website under clause 8 of the Terms of Service, the transfer counts as the return.

11. Audit

The Provider makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates — once per calendar year, on at least 14 days' notice, during business hours and without disrupting the service. More frequent audits are allowed after a personal data breach.