Personal data processing agreement (DPA)

This agreement is concluded between the Customer, [Customer name and details] (the Controller), and MOST WANTED sp. z o.o., NIP 9522205728, Kuznocin 55, 96-500 Sochaczew (the Processor), pursuant to Art. 28 GDPR. It covers personal data entrusted in connection with use of the Zaksio Service under the terms and conditions.

The Processor processes data solely for the purpose of providing the Service.

• Categories of data subjects: the Customer's employees and associates, counterparties and their representatives, account users.
• Categories of data: identification and contact data, employment and salary data, PESEL numbers (stored in encrypted form), transaction and billing data.
• Operations: storage, retrieval, analysis and classification (including using AI models), preparation of documents and returns.

• Processing only on the Controller's documented instructions (the instructions are the Agreement and the Service settings).
• Ensuring the confidentiality of persons authorised to process the data.
• Applying technical and organisational measures appropriate to the risk (Art. 32 GDPR), described in Annex B.
• Assisting the Controller in fulfilling data subjects' rights and in carrying out data protection impact assessments.
• Not using the Controller's data to train AI models. [Commitment to be confirmed with the model provider.]

The Controller consents to the use of the sub-processors listed in Annex C. The Processor notifies the Controller of an intended change of sub-processor [X] days in advance, and the Controller may object. Sub-processors are bound by obligations at least equivalent to those in the Agreement.

The Processor notifies the Controller of a personal data breach without undue delay, and no later than [X] hours after becoming aware of it, together with the information needed to assess the incident.

The Processor makes available the information necessary to demonstrate compliance with the Agreement and allows audits carried out with reasonable notice and in a way that does not disrupt the provision of the Service.

Data is stored in the European Union. Transfer outside the EEA requires the Controller's consent and a basis under Chapter V of the GDPR.

After the Service ends, the Processor, at the Controller's choice, returns the data in a structured, machine-readable format or deletes it, unless the law requires it to be retained. The Agreement remains in force for the duration of the Service.

• Annex A: detailed description of the processing (categories of data subjects, data and purposes).
• Annex B: technical and organisational measures: isolation of company data (row-level security), encryption of sensitive fields, audit log, two-factor authentication, encrypted backups. Described on the Security page. [Subject to formal approval.]
• Annex C: list of sub-processors (hosting, email, payments, AI model), made available to the Customer on request.