Data Processing Agreement (DPA)

Draft to be concluded with the Struvo Agreement. Before entrusting data, the parties, service scope and production parameters below must be confirmed. Publishing this page does not conclude the DPA, which requires written form, including electronic form.

1. Parties, subject and duration

The Client identified in the order is controller of project data; the Operator identified in the Terms is processor. If the Client is itself a processor, these provisions apply to subprocessing subject to the relevant controller’s authorisation.

Processing serves delivery of Struvo: storing documentation and making it available to authorised people, organising projects and work records, exports, support and requested AI analysis. It lasts during the Agreement and the necessary return/deletion period. For entrusted data this DPA prevails over conflicting Terms, without restricting mandatory rights.

2. Operations, people and data

Operations include receiving, recording, organising, storing, retrieving, permission-based disclosure, copying, exporting, deletion and analysis solely to perform instructions. AI processes content submitted to the relevant function; it does not acquire an independent right to the entire archive.

Data subjects include Client users and representatives, workers, subcontractors, counterparties and people incidentally recorded in documentation. Data includes names, contact details, functions and permissions, work/activity information, likeness, project location, descriptions, photos, files and metadata.

The service is not intended for routine Article 9 or 10 GDPR data. If genuinely necessary, scope, legal basis, risk and additional safeguards must be documented before entrusting such data. The Client is responsible for lawful collection, minimisation and information duties, without relieving the Operator of its own duties.

3. Instructions and confidentiality

Instructions comprise the Agreement and DPA, settings and authorised actions within the service, and documented directions from the Client’s authorised representative. Instructions beyond the agreed scope require arrangements for execution. Contact: privacy@struvo.pl.

The Operator processes only on documented instructions, including third-country transfers. Where Union or Member State law requires processing, the Operator informs the Client beforehand unless that law prohibits this on important public-interest grounds. If an instruction infringes GDPR or other Union or Member State data protection law, the Operator immediately informs the Client and suspends the disputed operation pending clarification insofar as legally permitted.

Only authorised people bound by contractual or statutory confidentiality obtain task-necessary access. Confidentiality survives access termination. The Operator does not use entrusted content for its own marketing or general model training without a separate lawful basis and appropriate agreement; AI providers must be bound by terms consistent with this instruction.

4. Security and technical annex

The Operator implements and maintains Article 32 measures appropriate to the state of the art, costs, nature, scope, context, purposes and risks. The technical annex covers:

• Organisation and project permissions, logical separation of client data, authentication and need-based administrative access.
• HTTPS/TLS transmission protection and private file storage with authorisation and short-lived signed access links. This is not end-to-end encryption against the processor.
• Access, secret, update and incident-management procedures, relevant operation records and minimisation in logs.
• Ongoing confidentiality, integrity, availability and resilience, recovery of availability after an incident and regular evaluation of safeguards. Source code alone does not demonstrate a completed recovery test.

To agree before entrusting data: processing regions/countries, at-rest encryption per resource, backup frequency and retention, maximum backup deletion time, recovery testing method/frequency, log retention, incident responsibility and any RPO/RTO. Record these in the order’s technical annex; do not substitute unverified SLA statements.

5. Subprocessors and transfers

The Client gives general written authorisation to subprocessors in the agreed list annexed to the DPA and available on the Providers and subprocessors page. Identify the full contracting entity, scope, processing countries and transfer mechanism. An independent-controller entry is not automatically subprocessing authorisation.

The Operator emails notice of an intended addition or replacement at least 14 days before entrusting data. During that period, the Client may object on reasonable data protection grounds. The parties seek a solution, such as another provider or disabling the affected function; pending resolution, Client data is not sent to the new subprocessor. If no solution is possible, the Client may end the affected service before the change without penalty, with a proportional refund of unused prepayment and data export rights.

The Operator imposes at least the same data protection duties on subprocessors, including sufficient security guarantees, and remains responsible to the Client for their performance. Transfers require a Chapter V GDPR basis; a European region or TLS alone does not provide it.

6. Assistance and breaches

Taking account of processing nature, the Operator assists through appropriate technical and organisational measures with Chapter III requests. Requests received directly are forwarded without undue delay; the Operator does not independently decide them unless instructions or law authorise this.

Taking account of processing nature and available information, it assists with Articles 32–36, including impact assessments, prior consultation, authority and data-subject notifications. It notifies the Client of entrusted-data breaches without undue delay after becoming aware, without waiting for an investigation to finish. The controller’s 72-hour deadline is not permission for the processor to delay notification.

Notification includes available incident details, categories and approximate numbers of people and records, contact point, likely consequences, measures taken/proposed and mitigation. Missing information follows in phases without undue delay. The Operator documents the event, preserves evidence and cooperates. The Client maintains an up-to-date incident contact.

7. Information and audits

The Operator provides information needed to demonstrate Article 28 compliance and allows and contributes to audits, including inspections, by the Client or an authorised auditor. The parties arrange logistics, confidentiality and protection of other clients’ data. Documentation, independent reports and remote checks may narrow inspections but cannot exclude necessary audit rights. Urgent risk, incidents or authority requests justify an expedited process. Logistics or cost arrangements must not prevent exercise of Article 28(3)(h) rights.

8. Return, deletion and termination

After services end, at the Client’s choice the Operator returns or deletes all entrusted personal data and deletes existing copies, unless Union or Member State law requires retention. Return and switching follow the export rules without shortening statutory retrieval periods. For legally required retention the Operator identifies the basis and scope, restricts use to that obligation and maintains protection.

Residual backup expiry must be agreed in the technical annex. Such data is excluded from ordinary use; disaster restoration requires reapplying prior deletion instructions. The Operator documents execution and confirms return or deletion on request. Retaining its own billing records does not entitle it to retain the entire project archive.