Data Processing Agreement

1. Parties and scope

This agreement is between the customer that accepted the V77 Trust Terms of Use (the controller) and Vertex77 spółka z ograniczoną odpowiedzialnością, ul. Świeradowska 47, 02-662 Warszawa, Poland, KRS 0001217415 (the processor). It applies to personal data the processor handles on the controller's behalf when providing V77 Trust, and forms part of the Terms of Use. If it conflicts with them on data protection, this agreement prevails.

2. Details of the processing

• Subject matter and duration: providing the V77 Trust service for the subscription term, plus the deletion period in section 10.
• Nature and purpose: hosting, storing, organising, analysing and displaying data the controller enters or connects, to support AI governance, compliance, testing and monitoring.
• Data subjects: the controller's users and staff; people named in records, evidence or incidents; people whose data appears in AI agent activity the controller sends for monitoring.
• Categories of data: names, work contact details, account and log data, and any personal data contained in uploaded evidence, findings, incidents or agent events. Agent event text is masked for personal data and secrets before it is stored.
• Special categories: not required by the service. The controller decides whether to upload them and must have a legal basis.

3. Processor obligations

The processor will:

• process personal data only on the controller's documented instructions (the Terms of Use, this agreement and the controller's use of the service), unless EU or Member State law requires otherwise, in which case it will inform the controller first unless the law forbids it;
• tell the controller if, in its opinion, an instruction infringes data protection law;
• make sure everyone authorised to process the data is bound by confidentiality;
• take the technical and organisational measures in Annex 1 (Article 32 GDPR);
• help the controller, taking into account the nature of the processing, to answer data subjects' requests (Articles 15–22), including through the in-app export and deletion tools;
• help the controller with security, breach notification, impact assessments and prior consultation (Articles 32–36).

4. Sub-processors

The controller gives general authorisation for the sub-processors listed below and on the Trust Centre. The processor imposes data protection obligations on each sub-processor that are no less protective than this agreement, and remains liable for them.

The processor will announce any new or replacement sub-processor at least 30 days before it starts processing. Subscribe below to receive the notice by email. The controller may object on reasonable data-protection grounds within that period. If the parties can't resolve the objection, the controller may terminate the affected service and receive a pro-rata refund of prepaid fees.

5. Location and international transfers

Customer data is stored in Cloudflare's EU jurisdiction: the D1 database and the R2 evidence bucket are created with EU jurisdiction, so data at rest stays inside the European Union. Requests are served from Cloudflare's global network, so data in transit may pass through edge locations outside the EU.

Where a sub-processor processes personal data outside the EEA, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified) or the European Commission's Standard Contractual Clauses, with supplementary measures where needed.

6. Personal data breaches

The processor will notify the controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the controller's data. The notice will describe what is known (nature of the breach, categories and approximate numbers of data subjects and records, likely consequences, measures taken) and will be updated as more becomes known.

7. Audits

The processor makes available the information needed to show compliance with Article 28, including security documentation and, once available, third-party certifications and audit reports. The controller, or an independent auditor bound by confidentiality, may audit once a year with at least 30 days' notice, during business hours, at the controller's cost, and more often after a breach or at a regulator's request.

8. AI-specific commitments

• The processor does not use the controller's data to train AI models.
• Data is sent to an AI model provider only when the controller turns that feature on, and only for that feature.
• Agent monitoring events are masked for personal data and secrets before storage and deleted after 90 days.

9. Liability

Each party's liability under this agreement is subject to the limits in the Terms of Use, except where the law doesn't allow a limit.

10. Return and deletion

The controller can export its data at any time. When the subscription ends, the processor keeps the data for 30 days so it can be exported, then deletes it from live systems. Backups are overwritten within a further 35 days. Data that the law requires the processor to keep, such as invoices, is kept only for that purpose.

11. Governing law

This agreement is governed by Polish law. The courts with jurisdiction over the processor's registered office decide disputes, unless mandatory law says otherwise.

Annex 1: Technical and organisational measures

• Encryption: TLS 1.2+ in transit; encryption at rest for the database and evidence storage; connector credentials and integration secrets additionally sealed with AES-256-GCM.
• Access control: role-based access in every workspace; two-step sign-in available to all users and enforceable per workspace; SAML single sign-on and SCIM provisioning; staff access to customer workspaces only read-only, time-limited, with a reason that the customer can see in its activity log.
• Separation: every record is scoped to its workspace and checked on every request.
• Logging: an append-only, hash-chained audit log of changes in each workspace; staff actions logged separately.
• Availability: hosting on Cloudflare's global network; point-in-time database recovery for 30 days; monitored uptime published on the status page.
• Secure development: code review, automated tests on every change, dependency scanning, and secrets kept out of source code.
• People: confidentiality obligations for staff and contractors; least-privilege access to production; prompt removal of access when roles change.
• Incidents: a documented process for detecting, assessing and notifying breaches within the timeline in section 6.