Data Processing Agreement

1.1This Data Processing Agreement (the “DPA”) is concluded between the client using the Products (the “Controller”) and AESTHETECH Sp. z o.o., ul. Hubska 52/14, 50-502 Wrocław, Poland, KRS 0001191504, NIP 8993034214 (the “Processor”).

1.2The DPA forms an annex to the agreement under which the Processor provides the Products to the Controller (the “Main Agreement”). It is concluded together with the Main Agreement and applies for as long as the Processor processes personal data on behalf of the Controller.

1.3The DPA implements Article 28(3) of Regulation (EU) 2016/679 (“GDPR”). In the event of a conflict concerning the protection of personal data, the DPA prevails over the Main Agreement.

2.1Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given in the GDPR. In addition:

1. (a)“Products” means Loop CRM and the AI agent, including their configuration and integrations, provided under the Main Agreement;
2. (b)“Controller Data” means personal data processed by the Processor on behalf of the Controller in connection with the Products;
3. (c)“Sub-processor” means another processor engaged by the Processor to carry out specific processing activities on behalf of the Controller.

3.1The Controller entrusts the Processor with the processing of Controller Data solely for the purpose of providing, maintaining, securing and supporting the Products in accordance with the Main Agreement.

4.1The Processor shall:

1. (a)process Controller Data only on documented instructions of the Controller, including with regard to transfers to third countries; the Main Agreement, this DPA and the Controller’s configuration of the Products constitute such instructions;
2. (b)inform the Controller immediately if, in its opinion, an instruction infringes the GDPR or other data protection law;
3. (c)ensure that persons authorised to process Controller Data are bound by confidentiality;
4. (d)implement the security measures required by Article 32 GDPR, as described in Section 5;
5. (e)comply with the conditions for engaging Sub-processors in Section 6;
6. (f)assist the Controller, taking into account the nature of the processing, in responding to requests from data subjects (Section 7);
7. (g)assist the Controller in ensuring compliance with Articles 32 to 36 GDPR, including breach notification and data protection impact assessments;
8. (h)at the end of the provision of the Products, delete or return Controller Data in accordance with Section 12;
9. (i)make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and allow for audits in accordance with Section 9.

5.1Taking into account the state of the art, costs, and the nature, scope, context and purposes of processing, the Processor applies in particular the following measures:

1. (a)encryption of data in transit (TLS) and at rest as provided by the hosting and database providers;
2. (b)access control based on roles and the principle of least privilege, with separation of each Controller’s data;
3. (c)multi-factor authentication for administrative access;
4. (d)audit logs of changes made in the Products;
5. (e)regular backups and the ability to restore availability of data in a timely manner;
6. (f)secure development practices, including code review and automated tests before deployment;
7. (g)confidentiality obligations and training for personnel with access to Controller Data.

6.1The Controller grants the Processor a general authorisation to engage Sub-processors. The Sub-processors engaged on the effective date of this DPA are listed below.

6.2Integrations that the Controller connects to its own accounts with third parties (for example, an online payment provider, an invoicing service or a calendar) are used on the Controller’s instructions and are governed by the Controller’s own agreements with those parties.

6.3The Processor shall inform the Controller of any intended addition or replacement of a Sub-processor at least 30 days in advance by email. The Controller may object on reasonable grounds within that period. If the parties do not resolve the objection, the Controller may terminate the Main Agreement with respect to the affected Product.

6.4The Processor shall impose on each Sub-processor data protection obligations no less protective than those in this DPA and remains fully liable to the Controller for the performance of the Sub-processor’s obligations.

7.1If the Processor receives a request from a data subject concerning Controller Data, it shall forward it to the Controller without undue delay and shall not respond to it itself unless instructed to do so. The Products allow the Controller to access, correct, export and delete Controller Data.

8.1The Processor shall notify the Controller of a personal data breach affecting Controller Data without undue delay and no later than 48 hours after becoming aware of it.

8.2The notification shall include, to the extent available, the information listed in Article 33(3) GDPR. Where information is not yet available, it shall be provided in phases without undue further delay. The Processor shall take measures to address the breach and mitigate its effects.

9.1The Processor shall provide the Controller, on request, with information necessary to demonstrate compliance with this DPA, including descriptions of security measures and Sub-processor documentation.

9.2The Controller may carry out an audit, by itself or through an auditor bound by confidentiality, no more than once in any 12-month period, with at least 30 days’ written notice, during business hours and without disrupting the Processor’s operations. Additional audits are permitted after a personal data breach or at the request of a supervisory authority. Each party bears its own costs of the audit.

10.1Controller Data may be transferred outside the European Economic Area only to the Sub-processors listed in Section 6, or otherwise on the Controller’s instructions, and only on the basis of an adequacy decision or appropriate safeguards under Chapter V GDPR, in particular the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914).

11.1Content of conversations with the AI agent and the answers it generates constitute Controller Data.

11.2Controller Data is not used to train artificial intelligence models, either by the Processor or by its Sub-processors. The Processor uses language model providers only under terms that exclude such use.

11.3The Processor configures the AI agent to inform the people it talks to, at the latest at the first interaction, that they are interacting with an AI system (Article 50(1) of Regulation (EU) 2024/1689). The Controller, as the deployer, shall not remove or obscure that information and shall describe the use of the AI agent in its own privacy information for visitors.

12.1Within 30 days after the end of the Main Agreement, the Processor shall, at the Controller’s choice, return Controller Data in a common machine-readable format or delete it, and delete existing copies, unless Union or Member State law requires storage.

12.2Copies in backups are deleted in the ordinary rotation of backups and remain protected under this DPA until then.

13.1Each party is liable for damage caused by processing in breach of the GDPR in accordance with Article 82 GDPR. Other matters of liability are governed by the Main Agreement.

13.2This DPA is governed by Polish law. Amendments require written or documentary form, except for updates of the Sub-processor list made in accordance with Section 6.