Data Processing Agreement

1. Parties, authority and priority

The Processor is Paweł Gruszka, trading as VESPY PAWEŁ GRUSZKA, CEIDG, ul. Warszawska 40/2A, 40-008 Katowice, Poland, NIP 6342331938, REGON 278021009 (Operator). Contact for instructions, rights, incidents and audit: info@dinpanel.com; urgent escalation: +48 664 660 230. No continuous staffing or fixed incident-response-hour guarantee is agreed.

The DINPanel User is the individual or organisation whose full name is declared on adoption. The accepting account representative and declared role are recorded with the exact document version, language and decision. The representative confirms authority to bind that DINPanel User. A DINPanel User acting as a processor confirms that the upstream controller has authorised this further processing. This agreement does not create a fictitious controller role for purely personal or household use outside the GDPR.

The DINPanel User is the person or organisation using DINPanel and entering into this agreement, not their client whose details appear in a project. The controller decides the purposes and means of processing personal data; a processor processes it on the controller's behalf. The DINPanel User acts as controller or, where authorised by another controller, as processor. The Operator processes on the DINPanel User's instructions, as processor or subprocessor respectively.

For processing controlled by the DINPanel User, these terms prevail over inconsistent general service provisions. The Operator remains a separate controller for its own account administration, sales, security, legal evidence and other purposes identified in the Privacy Policy.

2. Subject, purpose, people and data

The subject is hosted electrical project planning and documentation, selected procurement/invoice integrations, support on the DINPanel User's instructions and optional voice/AI functions. Processing consists of receiving, storing, organising, displaying, editing/versioning, transcribing/extracting on deliberate instruction, generating documents, exporting, transmitting to selected recipients, restricting and erasing. Processing continues while required by the DINPanel User's service instructions and then only for return/deletion or a specific legal requirement.

People may include the DINPanel User's clients and prospects, site occupants/owners, personnel and contractors, supplier contacts and people incidentally included in submitted material. Data may include names, business/contact/tax details, addresses and location, technical free text and geometry, drawings/images, recordings/transcripts, AI inputs/results, history/undo/snapshots, purchase/order copies and generated documents. User and access identifiers can link those records to people.

The service is not designed for special-category or criminal-offence data. The DINPanel User must avoid unnecessary material and ensure any exceptional processing has the required legal basis and safeguards; uploading it does not establish either. No sale, unrelated advertising or general-purpose model training on DINPanel User content is authorised by this agreement.

3. Instructions and DINPanel User duties

Documented instructions comprise this agreement, the selected service and authorised account actions, plus verified written instructions sent to the contact above. The DINPanel User determines necessity, lawful basis, notices, recording authority, data accuracy and authorised recipients. The DINPanel User controls its users, devices and downloaded files and ensures upstream authority where needed. Microphone/map permission is not a data subject's consent.

The Operator processes only on lawful documented instructions, including for transfers, except where Union or Member State law requires otherwise. It informs the DINPanel User before legally compelled processing unless the law prohibits that notice on important public-interest grounds. It immediately informs the DINPanel User if an instruction infringes applicable data protection law and seeks a lawful resolution. It does not use that instruction as authority for unrelated processing.

4. Confidentiality and security schedule

Access is limited to authorised persons who need it, act under instructions and are subject to confidentiality commitments or statutory confidentiality. The Operator manages access and revokes it when no longer needed. Support uses minimal diagnostics; it does not automatically copy full projects, profiles, recordings or transcripts into tickets or staff notifications.

The Operator must maintain measures appropriate to the risk under Article 32 GDPR. The service controls include account/project authorisation, restricted administration, protected transmission, encrypted integration credentials, private response cache controls, minimised diagnostic content and scoped deletion with retry and protection against late writes. DINPanel User endpoint security and deliberately exported copies remain within the DINPanel User's control. No assurance of whole-project encryption at rest, perfect security or independent certification is given.

There is currently no operational DINPanel backup system. Recovery infrastructure is a later stage and no recovery-time or maximum-loss SLA is agreed. This disclosed limitation is not a waiver of Article 32 or other mandatory duties. The Operator must assess and address availability/recovery risks; the DINPanel User should maintain usable exports of important documentation.

Changes to security must preserve legally required and agreed protection. Any future backup arrangement must define scope, location, access, retention, deletion and restoration that reapplies accepted removals before ordinary access or jobs resume. The Operator evaluates relevant controls and supplies evidence reasonably needed to assess them.

5. Named subprocessors and changes

The DINPanel User gives general written authorisation for the following named subprocessors, only for the described functions and data needed to provide the selected service: Hetzner Online GmbH (Germany), hosting infrastructure for the application, database and files; OpenAI Ireland Ltd (Ireland), OpenAI API transcription, extraction, text and image processing of material deliberately sent through AI functions; Zoho Corporation B.V. (Netherlands), Zoho Mail delivery and mailbox processing for correspondence on the DINPanel User's instructions and necessary support content. The Zoho route uses smtppro.zoho.eu and the AI route api.openai.com; these endpoints do not establish all processing locations.

The Operator must bind each subprocessor to substantively equivalent data protection obligations, assess sufficient guarantees and remain responsible to the DINPanel User for performance of those obligations. Actual infrastructure location, onward providers, access countries and applicable transfer instruments are supplied on request and in any relevant change notice. This DINPanel User authorisation does not itself execute an agreement between the Operator and a vendor or certify an account-specific setting.

The Operator gives at least 30 days' advance written notice of a proposed addition or replacement, identifying the legal entity, purpose, data, locations and safeguards. The DINPanel User may object on substantiated data protection grounds within 15 days of notice. The parties seek a reasonable alternative; an unresolved objection permits termination of the affected function and lawful return/deletion before the new processing starts. Urgent legally necessary security changes receive as much prior notice as practicable, an explanation and an effective objection/resolution route; urgency is not blanket permission for undisclosed processing.

Suppliers selected by the DINPanel User and invoice providers are recipients under the DINPanel User's instruction and applicable direct arrangements, not automatically Operator subprocessors. PayU and Fakturownia/KSeF for the Operator's own subscriptions serve the separate own-sales purpose. Google Maps and optional analytics require their purpose-specific notices and roles; this list does not grant unlimited authority to disclose client data to them.

6. International transfers

The Operator may arrange a third-country transfer or remote access only within the documented instruction and an applicable GDPR Chapter V basis. An EEA contracting entity is not a promise of EEA-only processing. OpenAI and Zoho services may involve their authorised affiliates or onward providers outside the EEA, including the United States or India as applicable to the service.

Where required, the Operator uses an applicable adequacy route or appropriate safeguards such as the Commission's standard contractual clauses, with the necessary assessment and supplementary measures. It provides relevant destination/safeguard information and copies on request, subject to proportionate redactions protecting other DINPanel Users and security. This agreement is an Article 28 agreement and is not itself a Chapter V transfer instrument.

7. Rights, assessments and assistance

The Operator forwards requests concerning data controlled by the DINPanel User without undue delay and assists the DINPanel User with access, rectification, restriction, erasure and portability. It does not independently determine the DINPanel User's response unless instructed or legally required. For its own controller purposes it determines and communicates its own response.

Taking account of the processing and information available, the Operator assists with security, breach assessment, impact assessments and prior consultation under Articles 32-36 GDPR. The parties use verified contacts and minimum necessary identifiers rather than full unrelated project content. Assistance must allow the DINPanel User to meet its applicable deadlines. Any reasonable charge for exceptional assistance must be agreed in advance and cannot obstruct a mandatory duty or correction of the Operator's own breach.

8. Personal data breaches

The Operator notifies the DINPanel User without undue delay after becoming aware of a personal data breach affecting DINPanel User data. Notice goes to the verified account/instruction contact and contains available details of nature, affected data/people, likely consequences, mitigation and follow-up contact. Information may be supplied in phases; incomplete facts are not a reason to wait for a finished investigation.

The Operator contains the incident, preserves proportionate evidence, coordinates relevant subprocessors and assists required notifications. The DINPanel User decides notifications for its controller purposes; the Operator decides those for its own. The processor duty is not a general allowance to wait 72 hours.

9. Recorded lifecycle instructions

Archive closes ordinary editing irreversibly and removes designated client identity/contact/company/tax/address/location fields and covered copies. It preserves technical text, names, drawings, geometry and technical transcripts for read-only use; these can remain personal. Ordinary project Delete is soft deletion and is not physical erasure. Note removal deletes the covered note/history/merged copies but does not undo independently applied project data.

Full account deletion instructs removal of complete attributable project/application content, including technical content, histories, files, recordings and AI copies. It disables access before cleanup and preserves retry and late-write fences. Necessary own-controller financial, legal or security evidence is separately scoped by purpose and retention; it is not a reason to retain whole client projects. Another account's independently owned data is not deleted merely because it was referenced.

The DINPanel User may give a separate scoped rights instruction about retained technical text. An ordinary edit or Archive is not automatically sufficient for such a request. Delivered third-party mail, supplier/invoice records, downloads and permanently disconnected devices require the applicable recipient/owner follow-up. Neither party may certify those copies erased without evidence.

10. Return, end of processing and retention

When the instructed processing ends, the DINPanel User chooses return or deletion of DINPanel User personal data, including existing copies, unless Union or Member State law requires specific retention. Available project data is returned in JSON and available documents/media in their usual downloadable formats; the Operator provides other covered data through an authenticated request in a commonly used machine-readable format where appropriate. DINPanel User data and necessary metadata must be meaningfully usable, without disclosing another DINPanel User's data or protected provider material.

A request can be made through Support or info@dinpanel.com without accepting unrelated new terms or buying another plan. Unless the DINPanel User instructs earlier erasure, a return opportunity remains for at least 30 days after the processing ends. The Operator acts without undue delay and completes the instructed active-store return/deletion within 30 days of the verified instruction; any lawful necessity preventing that requires prompt explanation, restricted access and an agreed or legally required next step, not a false completion message.

A confirmed full account deletion is a choice of erasure and does not require keeping content for an unwanted return period. Failed cleanup remains fenced, monitored and retryable. The Operator supplies a content-free completion statement on request, identifying scope and any lawful remaining exception. Minimum replay/lifecycle records are kept only to prevent actual reintroduction or for a separately justified retention criterion; linkable identifiers are not anonymous.

There is no general backup or provider exception to erasure. If a specific legal retention duty applies, the Operator records the fields, purpose and expiry, informs the DINPanel User where permitted, restricts ordinary use and deletes when the duty ends. Future recovery must not resurrect accepted removals.

11. Information and audit

The Operator makes available information necessary to demonstrate Article 28 compliance and permits and contributes to audits, including inspections, by the DINPanel User or its mandated auditor. Existing relevant evidence may be supplied first. Reasonable scope, notice, confidentiality and secure access protect other DINPanel Users and the service; they cannot exclude a justified inspection, urgent incident review or supervisory access.

If either party identifies a material inability to comply, it promptly informs the other, contains the affected processing and seeks a lawful solution. An unresolved material failure allows ending the affected processing with return/deletion.

12. Liability, adoption and changes

The Terms' lawful ordinary-business damages allocation applies only insofar as it does not reduce mandatory processing duties, data-subject remedies, the Article 82 responsibility/contribution regime or supervisory powers. Neither DINPanel User instructions nor an indemnity transfer the Operator's own statutory duties. No blanket reimbursement of fines is agreed.

Adoption requires an affirmative acceptance of this identified agreement and a representation of authority for the recorded DINPanel User; a Privacy acknowledgment is insufficient. The Operator preserves the exact agreed text and minimum adoption evidence and makes the accepted version available. Material replacement terms require the applicable notice and agreement process, while cancellation, export, erasure and rights channels remain accessible. Polish law applies without overriding mandatory applicable law.