Data Processing Agreement

Parties and subject matter

This agreement is about entrusting the processing of personal data under Article 28(3) of the GDPR. It is an annex to the Terms and the Customer accepts it together with them. It takes effect when the contract for the Service is concluded.

The Customer is the controller of Customer Data and entrusts its processing. The service provider, Wisecorner Łukasz Szyszkowski, ul. Hubska 62/30, 50-502 Wrocław, Poland, tax ID (NIP) 6151754467, is the processor. Terms defined in the terms of service have the same meaning in this agreement.

The agreement lasts as long as the contract for the Service. Contact about it: contact@tunti.app.

Nature and purpose of the processing

The processing consists of storing data, making it available to people named by the Customer, building summaries, reports and exports from it, sending email notifications and making backups. The purpose is providing the tunti Service to the Customer.

Types of data and categories of people

The types of data entrusted are: first and last name, email address, logged time and its descriptions, rates, approvals and comments, roles, and the data for signing in to the account.

The data concerns the Customer's employees and collaborators and other people the Customer adds to the Service.

The Customer's instructions

We process data only on the documented instructions of the Customer. The instructions are the terms, this agreement and the settings the Customer chooses in the application. If the law requires something else of us, we will tell the Customer, unless the law forbids it.

If we think an instruction breaks data protection law, we will tell the Customer.

Confidentiality

Only people we have authorised, who need it to provide the Service, have access to the data. They are bound to confidentiality, also after they stop working for us.

Security

We apply technical and organisational measures suited to the risk (Article 32 GDPR): encryption of data in transit, access only for authorised people, roles in the application, two-step sign-in, backups of the database and protection of access keys.

Sub-processing

The Customer agrees that we may use further processors. At present they are:

We bind the entities that process data on our behalf to the same data protection obligations as in this agreement. We are responsible for them towards the Customer.

We tell the Customer by email of any plan to change the list, 30 days ahead. During that time the Customer may object. If the objection is justified, we look for a solution together, and if there is none, the Customer may terminate the contract for the Service.

Help with the rights of people and the Customer's duties

We help the Customer, as far as the nature of the processing allows, to answer requests from the people the data is about, and to meet its obligations under Articles 32 to 36 of the GDPR: security, reporting breaches, impact assessment and consulting the supervisory authority.

When a person in the Customer's team writes to us with a request, we pass it to the Customer without undue delay and do not answer it without the Customer's instruction.

Reporting breaches

We tell the Customer about a personal data breach by email without undue delay, and at the latest within 48 hours of finding it. We write what the breach was, what data it concerns, what its effects may be and what we have done.

Deletion or return of data

After the contract for the Service ends, the Customer can export the data. We delete it within 30 days of the company being deleted, including from backups as soon as their retention period at the provider ends. We do not delete data that the law requires us to keep.

Information and audit

On the Customer's request we provide the information needed to show that we keep to this agreement. The Customer may carry out an audit once a year, at its own cost, with reasonable notice, respecting confidentiality and without disrupting the Service. The audit does not cover the data of other customers.

Transfers outside the EEA

We transfer data outside the EEA only with the safeguards of Chapter V of the GDPR, that is, on the basis of an adequacy decision (Data Privacy Framework) or standard contractual clauses. This applies to the providers in the USA on the list in the section on sub-processing.

Final provisions

On matters of data processing this agreement takes precedence over the terms. On other matters the terms apply, and Polish law and the GDPR apply to the agreement. How we process data as a controller is described in the Privacy Policy.