Data Processing Agreement

Parties

Controller: the business on whose behalf the Account in Footler was created, identified by the details given in the Account and at payment (the “Controller”, the “Customer”),

Processor: Konrad Bejger, a sole trader operating under the business name “Konrad Bejger”, entered in the Polish Central Register and Information on Economic Activity (CEIDG), ul. Magellana 6/64, 80-288 Gdańsk, Poland, tax ID (NIP) 8781795948, REGON 367501781, e-mail: contact@getfootler.com (the “Processor”, “Footler”).

§ 1. Definitions and subject matter

1. “Personal data”, “processing”, “personal data breach” and other terms have the meaning given in Regulation (EU) 2016/679 (the “GDPR”). The “Main Agreement” is the contract for the Footler services concluded under the Terms of Service, and the “Service” means the services provided under it.
2. The Controller entrusts the Processor with processing personal data to the extent and for the purpose set out in this Agreement, and the Processor undertakes to process it in accordance with this Agreement and the GDPR.

§ 2. Nature, purpose and scope of processing

1. Purpose: providing the Service – creating, storing and hosting e-mail signatures (PNG images and animated GIFs) and online contact cards of the people the Controller designates, recording animations, sending e-mails related to the Service, counting contact card opens, helping with signature installation and – where the Controller uses it – installing signatures across the company (Google Workspace, Microsoft 365).
2. Nature: collection (data entered by the Controller and by people it gave a link to), storage, organisation, adaptation (generating images and animations), disclosure (making signatures and contact cards publicly available at links the Controller puts in its messages) and erasure, and, in AI-based features, analysis.
3. Categories of data subjects: employees, collaborators, contractors and other people whose signatures the Controller creates in the Dashboard, and the Controller’s contact persons.
4. Categories of data: name, job title, phone numbers, e-mail address, social media profiles (e.g. LinkedIn), photo, slogan and other signature texts, company data (name, address, website, logo), the number of contact card opens and, for a company-wide installation, the e-mail addresses of people in the Controller’s domain who send messages without an assigned signature (for 7 days).
5. The Controller does not entrust special categories of data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10 GDPR).
6. Duration: for the term of the Main Agreement and, after it ends, until the data is deleted under § 9.

§ 3. Processor’s obligations

1. The Processor processes the data only on documented instructions from the Controller, including with regard to transfers to a third country, unless required to do so by law – in which case it informs the Controller before processing, unless the law prohibits this. The instructions are this Agreement, the Terms of Service and the Controller’s actions in the Dashboard (e.g. adding a person, changing data, choosing a design). The Processor may refuse instructions that go beyond the Service’s features; the Controller may then terminate the Main Agreement.
2. The Processor informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law.
3. The Processor ensures that people authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.
4. The Processor takes the security measures required by Article 32 GDPR, described in Annex 2. It may change them if this does not lower the overall level of security.
5. Where possible and taking into account the nature of processing, the Processor helps the Controller respond to requests from data subjects (Chapter III GDPR) – primarily through the Dashboard’s features (editing, deleting people and downloading data). It forwards any request addressed directly to it to the Controller without undue delay.
6. The Processor helps the Controller comply with Articles 32–36 GDPR (security, breach notification, impact assessment, prior consultation), taking into account the nature of processing and the information available to it.
7. The Processor keeps a record of categories of processing activities where Article 30 GDPR requires it.

§ 4. Sub-processors

1. The Controller gives general authorisation to engage the sub-processors listed in Annex 1.
2. The Processor informs the Controller by e-mail or in the Dashboard at least 14 days in advance of any intended addition or replacement of a sub-processor. The Controller may raise a reasoned objection during that time; if the parties do not reach agreement, the Controller may terminate the Main Agreement with effect from the day of the change – this is its only remedy for the objection.
3. The Processor imposes on sub-processors by contract – including by accepting their standard terms – data protection obligations corresponding to this Agreement and remains liable to the Controller for the performance of those obligations (Article 28(4) GDPR).

§ 5. Transfers outside the EEA

Data may be transferred to countries outside the European Economic Area only with the safeguards of Chapter V GDPR set out in Annex 1.

§ 6. Personal data breaches

1. The Processor notifies the Controller of a breach affecting the entrusted data without undue delay after becoming aware of it (Article 33(2) GDPR), by e-mail to the Account’s address.
2. The notification contains the information listed in Article 33(3) GDPR, as far as available; the Processor provides missing information when it obtains it.
3. The Processor cooperates with the Controller in investigating the breach and limiting its consequences, as far as this is within its control.

§ 7. Information and audits

1. The Processor makes available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR – primarily this Agreement with its annexes and answers to written questions.
2. If that information is not sufficient, the Controller or an auditor it authorises, bound by confidentiality and not a competitor of the Processor, may carry out an audit or inspection after giving the Processor at least 30 days’ notice, no more than once every 12 months (unless there has been a breach or a supervisory authority requires it), on working days, at an agreed time and without access to other customers’ data or to the providers’ systems.
3. The Controller bears the costs of an audit, including the Processor’s reasonable costs of working time, unless the audit reveals a material breach of this Agreement by the Processor.

§ 8. Controller’s obligations

The Controller ensures that it has a legal basis for processing the entrusted data and for making it publicly available in signatures and contact cards, that it has informed the data subjects about this (Articles 13 and 14 GDPR), and that the data is accurate. The Controller is responsible for whom it gives access to the Dashboard and private links.

§ 9. Deletion of data

1. Before the Main Agreement ends, the Controller can download the entrusted data from the Dashboard (export) – this is the return of data within the meaning of Article 28(3)(g) GDPR.
2. After the Main Agreement ends, the Processor deletes the entrusted data within 30 days, unless the law requires further storage.
3. Data in backups, if backups are made, is deleted as part of their rotation.
4. Once the data is deleted, the signatures and contact cards no longer show people’s data at their previous links.

§ 10. Liability

Towards data subjects, the parties are liable in accordance with Article 82 GDPR. Between the parties, including for damage related to this Agreement, the liability provisions of the Terms of Service apply, including their limitations, to the extent permitted by law.

§ 11. Final provisions

1. This Agreement remains in force for the term of the Main Agreement and until the obligations in § 9 are fulfilled.
2. In matters of personal data protection, this Agreement takes precedence over the Terms of Service.
3. This Agreement may be changed by the procedure for changing the Terms of Service or in documentary form.
4. This Agreement is governed by Polish law. Disputes are resolved by the court set out in the Terms of Service. If the Polish and English versions differ, the Polish version prevails.

Annex 1. Sub-processors

Annex 2. Technical and organisational measures

• encrypted connections (HTTPS/TLS);
• passwords stored only as salted scrypt hashes; session identifiers stored as hashes; HttpOnly, SameSite and Secure session cookie;
• random, long links that cannot be guessed for dashboards, contact cards and proposals pages;
• access control to the Dashboard: an account with a password set after confirming the e-mail address, or a private key;
• request limits and abuse protection; verification of incoming mail senders (DKIM, DMARC);
• blocking access to private network addresses when fetching websites, with size and time limits;
• content of received e-mails treated as untrusted – never displayed as HTML on the Service’s pages;
• data minimisation: the AI model receives only the data needed for the task; the Service does not record who displayed the signature of a person in the Dashboard or when;
• access to production data only for the Processor and authorised people bound by confidentiality;
• infrastructure at a hosting provider with physical and network security of its data centres;
• software updates and a breach handling procedure (§ 6).