Data Processing Agreement

Controller: the User and, where the Studio is run by an entity other than the User, that entity (§ 7(6) of the Terms). The Controller decides which data of its clients it enters into the Service and for what purpose.

Processor: the Provider, that is Hanna Półtorak, running a business under the name VISUAL SPACE Hanna Półtorak, address for service: ul. Świemirowska 15 lok. 1, 81-877 Sopot, NIP (tax number) 5851502129, REGON 526447544, contact address for data matters: contact@projado.com.

Capitalised terms have the meaning given to them in the Terms.

The Controller entrusts the Processor with processing personal data in connection with providing the Service, a tool for running interior design projects (questionnaire, site survey, concepts, inspirations, product list, consultations). The Processor processes personal data only to provide that service to the Controller, on the Controller's documented instructions given by using the functions of the Service.

This agreement is in force for as long as the Agreement for services lasts, from the creation of the Studio until it is deleted or until the last Account with the Owner role is deleted, and it ends when that Agreement ends, subject to point 12 (return and deletion of data).

The processing is continuous and automated. It covers the operations needed for the Service to work: storing, reading, updating, sharing within the Studio and through Client Links, generating exports at the Controller's request, and deleting when the retention period ends.

Categories of people: the Controller's clients (natural persons for whom or with whom the Controller runs a project) and contact people at a client's company.

Categories of data:

1) the client's first and last name and contact details;

2) the client's company details for invoicing (name, tax number);

3) the Controller's notes about the client;

4) the address of the property being designed;

5) answers to the questionnaire: needs, style, budget and household composition; voluntary answers about accessibility features of the interior; and answers about children's rooms (the children's age and number, their activities and interests, favourite and disliked colours and style, and what the room needs: bed, desk, storage, space to play);

6) uploaded photos, inspirations, files and survey documentation;

7) comments on and acceptances of materials, including the first and last name the client gives when accepting through a Client Link, with a note of whether it was typed in or confirmed from details given by the Controller, without an IP address or browser details;

8) product and shopping lists and consultation times;

9) images (most often screenshots) attached by a Studio Member to a support conversation, to the extent they show the data of the Controller's clients.

The questionnaire does not ask about anyone's health or diagnosis, or about who the accessibility requirements are for or why. Some optional answers about features of the space can indirectly reveal health needs; the Processor never uses them to infer anyone's health. The questions about accessibility of the space, that is about features the design should include (for example no thresholds, grab rails, a walk-in shower), are asked only when the Controller switches them on in a given project, and so on its instruction. The Processor does not switch them on itself, and records who in the Controller's team set the scope of the questions and when. The questions about children's rooms are on by default and the Controller can switch them off; while they are on, the client must answer the question about the children's age before sending the questionnaire (one of the answers is “I don't know”), and the other questions about children are optional. All the other questions mentioned in this point are optional for the client.

Answers about accessibility features, the content of text fields, photos and files may in some cases indirectly reveal information about the health of members of the household (Article 9 GDPR). The Processor does not check the content of text fields and cannot rule out that the Controller or its client enters special-category data there. The Controller decides whether to send the client the questionnaire and whether to ask these questions, and is responsible for the legal basis for processing the answers. The Processor applies to this data the security measures described in point 9.

The Processor undertakes to:

1) process personal data only for the purpose and within the scope stated in points 1 and 3, on the Controller's documented instructions;

2) make sure that the people authorised to process the data are bound by confidentiality;

3) apply the security measures described in point 9;

4) keep to the conditions for engaging sub-processors described in point 7;

5) help the Controller meet its obligations under Articles 32 to 36 GDPR and answer requests from data subjects (point 8);

6) return or delete the data after the services end, as point 12 describes;

7) give the Controller the information needed to show compliance with this agreement and allow audits as point 11 describes;

8) tell the Controller without delay if an instruction of the Controller infringes the GDPR or other data protection law.

The Controller undertakes to:

1) have a legal basis for processing the client data it enters into the Service;

2) enter into the Service only the data needed to carry out the project;

3) answer by itself the requests of data subjects addressed to it directly and those passed on by the Processor under point 8;

4) delete a client's data from the Service when the end of its work with that client brings an obligation to delete it.

The Controller gives general authorisation for the Processor to use the sub-processors listed below, provided that they are bound by the same data protection obligations as bind the Processor under this agreement.

The Processor notifies the Owners of the Studio by e-mail, at the addresses of their Accounts, at least 14 days before adding or replacing a sub-processor. During that time the Controller may object. If the parties do not remove the reason for the objection, the Controller may terminate the Agreement for services before the change takes effect and download a copy of the Studio's data (point 12).

The Processor is fully liable to the Controller for its sub-processors meeting their data protection obligations (Article 28(4) GDPR).

Sub-processors:

1) Hetzner Online GmbH (Gunzenhausen, Germany): hosting of the server, database and files. Scope: all the data described in point 4, stored on servers in Germany (Nuremberg).

2) Lettermint B.V. (Zwolle, the Netherlands): transactional e-mail provider. Scope: the recipient's e-mail address and the content of messages sent in connection with a project. Processing in the European Union.

3) Cloudflare, Inc. (San Francisco, USA): network protection and delivery of the Service's pages. Scope: all traffic between the browser and the Service while it is in transit, and so all the data described in point 4 while it is being sent, and IP addresses. Processing in Cloudflare's global network, possibly outside the European Economic Area, including in the USA.

4) OVH SAS (Roubaix, France): the mailbox of the Processor's contact address. Scope: messages sent to that address, including requests from the Controller's clients passed on under point 8. Processing in the European Union.

5) GitLab Inc. (San Francisco, USA): the Processor's code repository and build pipelines. Scope: an encrypted copy of the database, which contains the data described in point 4 except photos and files, held for at most one day when the Processor checks that its backups can be restored or rebuilds the server after a failure; GitLab also holds the key that opens that copy. Processing possibly outside the European Economic Area, including in the USA.

Data is transferred outside the European Economic Area by Cloudflare and by GitLab, on the basis of the European Commission's standard contractual clauses in their data processing agreements and their participation in the EU–US Data Privacy Framework. Stored data (database, files, e-mail) is kept in the European Union; the only copy held outside it is the encrypted copy of the database described in sub-point 5, for at most one day. The Processor decrypts and restores that copy only on a build server it controls in Poland, in a database that exists only for as long as the check runs. The Processor gives the Controller a copy of the clauses on request.

Google Identity Services (signing in with Google) is not a sub-processor under this agreement: Google does not process the data of the Controller's clients as part of that function.

If a client writes directly to the Processor (for example at contact@projado.com) with a request about their data, the Processor does not search Controllers' data for that person by itself, but passes the request to the right Studio if the client names it or gives the designer's e-mail address. Data the Processor holds as a controller itself (the e-mail suppression list, call requests, support conversations) it does search, and it answers for that data itself.

The Processor passes the request on without undue delay, by e-mail to the Owners of that Studio, in the wording in which it was received, and tells the client whom it was passed to. It does not answer the request itself and changes or deletes nothing on the basis of it.

The Controller answers the request itself, as the controller of that data. The Processor helps with the functions of the Service that let a client's data be downloaded and deleted.

The Processor applies in particular the following measures:

1) connections to the Service are encrypted (HTTPS);

2) Account passwords are stored only as cryptographic hashes;

3) project data can be accessed by the Members of the Studio, according to their assigned roles and permissions, and by clients and other people the Studio shared a link with, as far as that link goes; the Processor's team reaches into this data only when running the Service, keeping it secure or giving the help the Controller asks for requires it;

4) Client Links contain a random identifier that does not derive from the project's data, and only a hash of that identifier is kept in the database;

5) passwords and session data never go into a data export.

The Processor reports to the Controller every personal data breach it establishes that concerns data entrusted under this agreement, without undue delay after establishing it (Article 33(2) GDPR).

The report is sent by e-mail to the Owners of the Studios whose data the breach concerns, at the addresses of their Accounts.

The report contains, as far as it is known at the time (Article 33(3) GDPR):

1) the nature of the breach, including where possible the categories and approximate number of people and records concerned;

2) the likely consequences of the breach;

3) the measures taken or proposed to address the breach and limit its effects;

4) the address where more information can be obtained (contact@projado.com).

If not all the information is available at once, the Processor provides it in further messages, without undue delay.

The Processor shows that the processing complies with this agreement in the following order (Article 28(3)(h) GDPR):

1) first, it gives the Controller documentation on request: a description of the security measures it applies, and the audit reports and certificates of its sub-processors;

2) if that is not enough, at the Controller's request it allows a remote review at an agreed time (answers to questions, showing configuration and records);

3) the Controller or an auditor it authorises may carry out an on-site audit no more than once a year, and also when it has a justified suspicion that the agreement or the law has been breached. The audit takes place at an agreed time, in a way that does not compromise the confidentiality of other Controllers' data, and its reasonable costs are borne by the Controller.

Nothing above excludes the Controller's right to an on-site inspection.

1) While the service lasts, the Controller can at any time download a copy of its Studio's data in the Service.

2) When its Owner deletes a Studio, the data is not erased at once: the Studio is locked immediately (nobody can open its projects, and the links sent to clients stop working) and is kept for a further 30 days. During that time the Owner can download a copy of the data, restore the Studio or erase the data immediately.

3) After 30 days, or earlier at the Controller's request, the data of that Studio's clients, including the questionnaire, concepts, site survey, files and acceptance certificates, is deleted from the Service in full and can no longer be restored through the Service. A deleted file stays recoverable by the Processor for up to 31 days after its deletion. Data may remain in backups for at most 37 days: a backup is kept for 30 days, and a deleted backup can be recovered for 7 more days.

4) Deleting the Account of the only person in a Studio locks that Studio together with the Account and starts the same 30-day period: during it, signing in restores the Account together with the Studio, and after it the data is erased.

5) The Processor does not return data in any form other than the export described above, because the Controller has access to it for the whole duration of the agreement.

1) Each party is liable to the other for damage caused by failing to perform this agreement, or performing it improperly, on the terms and within the limits set out in § 14 and § 15 of the Terms.

2) Those provisions do not limit the parties' liability to data subjects under Article 82 GDPR, or the powers of the supervisory authority.

1) Scope. This point applies when, and to the extent that, a privacy law or a consumer health-data law of any US state (“US state law”) applies to the processing of data entrusted under this agreement. These include in particular the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.), the Washington My Health My Data Act (RCW 19.373), Nevada's consumer health data provisions (NRS 603A.400–603A.550), the Connecticut Data Privacy Act (Conn. Gen. Stat. § 42-515 et seq.) and similar laws of other states. This point does not extend those laws to cases they do not themselves cover and does not reduce any duty under the GDPR; where both the GDPR and US state law apply to the same data, the parties apply the provision that gives the higher protection.

2) Roles. For the purposes of US state law the Controller is the party that determines the purposes and means of processing (“business”, “controller”, “regulated entity”), and the Processor acts only on its behalf (“service provider”, “processor”).

3) Limits. The Processor:

a) processes the data only to provide the service described in points 1 and 3 (the “business purpose”), on the Controller's instructions given as point 1 describes;

b) does not sell the data and does not share it for advertising based on a person's activity across other services;

c) does not retain, use or disclose the data for any other purpose, including a commercial purpose of its own, or outside its direct relationship with the Controller;

d) does not combine the data with personal data it receives from other sources or collects in its own dealings with the person, except where US state law allows it;

e) gives the data the level of protection US state law requires, and tells the Controller without undue delay if it finds it can no longer meet the duties in this point.

4) Consumer health data.

a) The Service does not ask about any person's health or diagnosis (point 4). Some optional answers about features of the space can indirectly reveal health needs; the Processor never uses them to infer anyone's health. The questionnaire asks the accessibility questions only on the Controller's instruction, given by switching them on in a project.

b) The Processor does not use a client's answers, the content of text fields, photos or files to establish, infer or label any person's health, and does not create tags, segments or analytics events from them.

c) Where entrusted data is consumer health data under US state law, the Processor processes it only under this agreement, within the Controller's instructions and the operations described in point 3, and helps the Controller meet its duties by the means described in points 8, 9 and 12.

d) The Controller is responsible for the duties US state law places on the party that decides the purposes of processing: in particular the required notice about health data, the person's consent where it is required, and the answer to that person's requests.

5) Requests from individuals. Point 8 applies to requests made under US state law (access, correction, deletion, withdrawal of consent, and the list of parties the data was shared with).

6) Sub-processors. Point 7 applies. The Processor has a written contract with each sub-processor that imposes duties no lighter than those in this point.

7) Showing compliance. Point 11 applies. The Controller may take reasonable and appropriate steps to make sure the Processor uses the data in line with the Controller's duties under US state law and, after giving notice, to stop any unauthorised use of the data and remedy it.

8) Deletion. Point 12 applies.

9) Statement. The Processor states that it understands the limits in sub-point 3 and will keep to them.

10) Governing law. This point does not change the governing law or the court named in the Terms.

1) This agreement is Annex 1 to the Terms and is concluded when the Terms are accepted on opening an Account.

2) This agreement is changed in the same way as the Terms (§ 20 of the Terms).

3) If this agreement and the Terms conflict on the protection of personal data, this agreement prevails.

4) Matters not covered here are governed by the Terms, the GDPR and Polish law.