Data Processing Agreement (DPA)

Parties

Controller (Customer): the entity (Organisation) that uses the HUBAL platform under the Terms of Service (the "Main Agreement") and enters personal data into it.

Processor: ANTONI SUROWIAK EMA STUDIO, ul. Westerplatte 6, 38-200 Jasło, NIP 6852286869, REGON 383714040 (hereinafter: the "Processor" or "HUBAL").

This Agreement is concluded by reference — together with the acceptance of the Terms of Service by the Customer acting as data controller — and remains in force for as long as the service is used. Upon the Customer's request, we provide a copy for signature (contact: legal@hubal-project.com).

§1. Definitions

1. GDPR — Regulation (EU) 2016/679. The terms "personal data", "processing", "controller", "processor", "personal data breach", "sub-processor" are understood in accordance with the GDPR.
2. Entrusted Data — personal data processed by the Processor on behalf of the Controller in the course of providing the HUBAL service, described in Annex A.

§2. Subject matter, nature, purpose and duration of the entrustment

1. The Controller entrusts to the Processor the processing of the Entrusted Data solely for the purpose and to the extent necessary to provide the HUBAL service in accordance with the Main Agreement and the Controller's documented instructions.
2. The nature, purpose, type of data and categories of data subjects are set out in Annex A.
3. The entrustment of processing lasts for the term of the Main Agreement, subject to §11.

§3. Controller's instructions

1. The Processor processes the Entrusted Data only on documented instructions from the Controller, including with regard to transfers of data to a third country, unless such an obligation is imposed by law (in which case the Processor informs the Controller, unless the law prohibits this).
2. Documented instructions are deemed to include the Main Agreement, this Agreement, and the configuration and actions taken by the Controller within the Platform.
3. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other provisions of law.

§4. Obligations of the Processor

The Processor undertakes, in accordance with Art. 28(3) GDPR:

1. Confidentiality — to ensure that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
2. Security (Art. 32) — to implement appropriate technical and organisational measures; their description is set out in Annex C.
3. Sub-processors — to engage further processors under the terms of §7.
4. Assistance with data subjects' rights — insofar as this is possible, to assist the Controller (by appropriate technical and organisational measures) in fulfilling its obligation to respond to requests of data subjects (Art. 12–23 GDPR).
5. Assistance with obligations under Art. 32–36 — to assist the Controller in ensuring security, notifying breaches, communicating with data subjects and carrying out data protection impact assessments (DPIA) and prior consultations, taking into account the nature of processing and the information available.
6. Breaches — to notify the Controller of breaches of the protection of the Entrusted Data without undue delay, no later than within 48 hours of becoming aware of them, providing the information necessary for the Controller to fulfil its obligations (Art. 33–34 GDPR).
7. Return/deletion — after the end of the provision of services, at the choice of the Controller, to delete or return the Entrusted Data and delete existing copies, unless the law requires their storage (see §11).
8. Audit — to make available to the Controller the information necessary to demonstrate compliance with Art. 28 and to allow for and contribute to audits (including inspections) conducted by the Controller or an authorised auditor, under the terms of §8.

§5. Security measures

1. The Processor applies measures appropriate to the risk, including encryption in transit (TLS) and encryption of data at rest (AES-256) — at the infrastructure level (cloud provider keys) and additionally, for selected sensitive data, at the application layer with an organisation key managed by the Processor in Google Cloud KMS — as well as access control, multi-factor authentication for the Processor's administrative personnel, backups and monitoring. Details — Annex C.
2. Encryption model: the Parties agree that the Processor manages the encryption keys (a "provider-managed" model, not "end-to-end / zero-knowledge"), which enables the controlled access described in §6.

§6. Access of the Processor's personnel to content (support/diagnostics)

1. The Controller instructs the Processor — as a documented instruction — that authorised personnel of the Processor may access the Entrusted Data solely for the purposes of: providing support, ensuring security, diagnosing failures and carrying out the Controller's requests.
2. Such access takes place to the minimum extent necessary, is restricted by roles and is logged (who, when, which organisation, for what purpose). The Processor makes information about such access available to the Controller upon request.
3. The Controller may restrict or disable diagnostic access to the extent technically possible (e.g. organisation settings), which may affect the scope of support.

§6a. Creation and use of anonymised data (service improvement)

1. The Controller instructs and authorises the Processor to create anonymised data from the Entrusted Data — in particular: (a) aggregated statistics on completion times of task types and (b) synthetic task descriptions transformed by a language model ("paraphrases") — stripped of identifiers of the Controller, users and third parties as well as of the original content.
2. The anonymisation stage (processing of a real task, including with the involvement of an AI sub-processor) constitutes processing of the Entrusted Data for the purpose referred to in para. 1; its basis is the legitimate interest of the Processor (improving the estimation features and the quality of the service), with due regard for the principle of data minimisation.
3. Once effectively anonymised, such data does not constitute personal data (Recital 26 GDPR); the Processor further processes it as a controller for its own purpose (improving the estimator, benchmarks). The original content of the Entrusted Data is not made available to other Controllers.
4. The Processor applies safeguards limiting the risk of re-identification, including: removal of identifying data and of the original content; deterministic detection and rejection of records containing personal data; minimum-source-count thresholds before use; access to the anonymised data only through server functions (no open read access by users).
5. The Controller may disable (opt out of) its Organisation's participation in the creation of anonymised data in the Platform settings; this does not affect the other features of the service. Data that has already been anonymised, being non-personal, is not subject to erasure under Art. 17 GDPR.

§7. Sub-processors

1. The Controller grants the Processor a general authorisation to engage the sub-processors listed in Annex B.
2. The Processor ensures that sub-processors are bound by data protection obligations no less stringent than those in this Agreement (in particular Art. 28(4) GDPR), and is liable for their actions as for its own.
3. The Processor informs the Controller of any intended change of sub-processors (addition/replacement) with 14 days' advance notice (by e-mail or by a message in the Platform), allowing the Controller to raise a reasoned objection. In the event of an objection, the Parties shall seek a solution in good faith; if none is possible, the Controller may terminate the Main Agreement in the part affected by the change.

§8. Audits

1. The Processor demonstrates compliance by making available documentation, descriptions of measures (Annex C) and — where necessary — reports/certificates (if available).
2. The Controller may conduct an audit no more than once a year (and after a breach), upon prior notice given reasonably in advance, in a manner that does not unduly disrupt the Processor's operations and with due regard for the confidentiality of other customers.

§9. Transfers outside the EEA

1. The Entrusted Data is stored in the European Union (region europe-central2 — Warsaw). Certain operations (in particular AI features — the voice assistant, features using Anthropic Claude models, including conversations with AI assistants, the "Multi-AI" verification — as well as payment handling) involve transfers to the USA. Transfers in Add-ons are described in their Add-on Terms (Annex B).
2. Transfers are based on the adequacy decision (EU-US Data Privacy Framework) for certified recipients and on Standard Contractual Clauses (SCC) together with additional safeguards. The Processor provides copies of the safeguards upon request.

§10. Obligations of the Controller

1. The Controller declares that it has a legal basis for the processing of the Entrusted Data and for transferring it to the Processor (including data of employees and third parties), and that its instructions are lawful.
2. The Controller is responsible for fulfilling the information obligations towards data subjects and for the lawfulness of the purposes of processing.

§11. Term and termination

1. This Agreement remains in force for the term of the Main Agreement.
2. After its termination, the Processor — in accordance with the choice made by the Controller within a reasonable time — shall return or delete the Entrusted Data and its copies, subject to: (a) the export window made available to the Controller, (b) deletion from backups in a cycle of up to 90 days, (c) data whose storage is required by law.

§12. Liability and final provisions

1. The liability of the Parties is governed by the rules of the GDPR and by the Main Agreement (together with the B2B Annex, if applicable). This Agreement does not limit liability to the extent that such limitation is not permitted.
2. In the event of a conflict, in matters of data protection this Agreement prevails over the Main Agreement.
3. The governing law is Polish law; disputes are resolved by the court having jurisdiction in accordance with the Main Agreement.
4. Amendments require the form applicable to the Main Agreement (including acceptance of an updated version made available by the Processor).

Annex A — Details of processing

• Subject matter: processing of data in the course of providing the HUBAL service (project management, documents, finance, HR/working time, e-mail, chat, AI assistants) and, in Organisations that have switched an Add-on on, also within the Add-on (Annex B).
• Duration: the term of the Main Agreement.
• Nature and purpose: storage, organisation, sharing within the Organisation, processing by Platform and AI features — solely for the purpose of providing the service.
• Type of personal data: identification and contact data; account data; project content; financial data; employee and working-time data (profiles, records, workload, leave requests, performance alerts); content and metadata of e-mail correspondence as well as login data/tokens for mailboxes; chat messages; data resulting from integrations (calendar); the content of conversations with AI assistants, conversation topics and their instructions, the profiles of the Organisation's AI assistants; in Add-ons — the data specified in the Add-on Terms. The Controller may specify or restrict the scope by informing the Processor (legal@hubal-project.com).
• Categories of data subjects: the Organisation's users (employees, contractors), business partners, customers and other persons whose data the Organisation enters into the Platform.
• Special categories of data (Art. 9): as a rule, not envisaged; the Controller should not enter special categories of data without separate arrangements with the Processor.

Annex B — List of sub-processors

We verify the DPF certification status of each provider at dataprivacyframework.gov/list. We give notice of changes to the list in accordance with §7 para. 3.

Add-on sub-processors. In Organisations that have switched an Add-on on (e.g. Media Kreator), the list is supplemented by the sub-processors specified in the Add-on Terms (Media Kreator Add-on Terms). By switching the Add-on on and accepting its Terms, the Controller gives its consent (§7 para. 1) to the use of those sub-processors solely within the scope of the Add-on. Those sub-processors do not concern Organisations that have not switched the Add-on on. We give notice of changes to an Add-on's sub-processors to the Controllers that have switched it on, in accordance with §7 para. 3.

Annex C — Technical and organisational measures (TOM)

• Encryption: TLS 1.3 in transit; at rest AES-256 in two layers — the infrastructure layer (Firestore and file storage, Google Cloud keys) and the application layer for sensitive data (AES-256-GCM with an organisation key, protected by the Processor's master key in Google Cloud KMS): e-mail content and its AI summaries, project names, notes, financial profile, invoice data, document fragments used by AI, KSeF credentials; mailbox credentials encrypted with a separate key on the mail service side.
• Access control: role-based permissions; multi-factor authentication for the Processor's administrative personnel; the principle of least privilege; logging of personnel access to content (§6).
• Business continuity: backups with periodic restore tests; hosting in certified infrastructure (EU).
• Application security: access rules (Firestore/Storage), server-side permission checks at endpoints, monitoring, incident response (breach notification to the Controller within 48 h).
• AI features: AI assistants act within the permissions of the person using them (in a group chat — only content available to all participants, no writes); AI assistants' work and recurring-task instructions encrypted at the application layer. Measures specific to Add-ons are described in the Add-on Terms.
• Organisational: confidentiality undertakings; breach procedure; assessment of sub-processors.

This Annex is updated as the safeguards evolve.