DATA PROCESSING AGREEMENT

Offerandum · Effective September 24, 2026 · Version 1.0

This Agreement sets out how Offerandum processes personal data on behalf of companies that use its quote forms. It covers enquiries (leads), PDF quotes and their handling.

Annexes: the list of subprocessors and the security measures. The service itself is described in the Offerandum Terms of Service.

Parties and conclusion

1. The controller is the company named in the order for the Offerandum service, with the name, address, tax identifier and representative recorded in the order, referred to as the "Customer".
2. The processor is Damian Krychowski, a sole proprietor registered in Poland, doing business as Offerandum, ul. Marii Skłodowskiej-Curie 8/22, 42-400 Zawiercie, Poland, Polish tax identification number (NIP) 6492262191, referred to as "Offerandum". Contact: contact@offerandum.com.
3. This Agreement is part of the agreement for the Offerandum service (the "Main Agreement"). It is concluded by documented acceptance of its version and annexes, including electronically, before any real data is entrusted. Publishing this text does not by itself conclude it.
4. In matters of processing on behalf of the Customer, this Agreement and its annexes take precedence over conflicting provisions of the Main Agreement. Nothing in it limits the rights that the law gives to individuals or to a supervisory authority.
5. Offerandum is established in the European Union and is bound by the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). This Agreement follows Article 28 GDPR. It applies whether or not the Customer is itself subject to the GDPR. It is not a consent of the individuals to processing and not a legal basis on its own for the Customer to collect their data.

Subject matter, scope and duration

1. The Customer entrusts data to Offerandum for the purpose of publishing and operating its forms, collecting and storing enquiries, calculating quotes, generating PDFs, delivering notifications and quotes, operating the panel, export, support and deletion.
2. Categories of individuals: the Customer's prospective and current customers, their representatives, contact persons and other people named in an enquiry, to the extent needed to handle the quote.
3. Categories of data, depending on the configuration: name, e-mail address, phone number, company name, address or place of delivery, order parameters, remarks, the record of successive changes to the form's fields that forms part of the enquiry and lets the Customer replay the quote in its panel, the conversation with the form's AI assistant together with the description of the field changes it made, the content and parameters of the quote, PDF documents, handling status, the Customer's notes, the exact wording of the controller notice and marketing consents shown with the answers given, identifiers and timestamps of events, and the technical data needed. Usage statistics of a form (opens, pages and fields visitors changed, options chosen, quotes shown) are counted only as sums per form and per day, without field values and without contact details; a random two-hour visitor session identifier serves to count a visit once. The source of a visit (the domain of the referring page, campaign parameters from the page address, the page on which the form sits) is counted the same way and recorded with an enquiry as its attribute.
4. The form's AI assistant is a feature switched on during setup at the Customer's instruction, and the Customer can switch it off in the panel at any time. During a conversation, the text of the individual's messages and a description of the form's fields with their values are sent to the language model provider named in Annex 1; the price list and the form's code are not sent. The conversation is stored only together with a sent enquiry, in the same way as the answers, available in the Customer's panel, not sent in any e-mail and deleted together with the enquiry. The assistant's replies are auxiliary and are not a statement of the Customer or of Offerandum.
5. Processing operations include receiving, recording, organizing, storing, reading, calculating, modifying as instructed, transmitting to named recipients, exporting, restricting and deleting. The service runs continuously for the term of the Main Agreement and afterwards only to the extent needed to return or delete the data and let backups expire.
6. The service is not designed to knowingly collect special categories of data (Art. 9 or 10 GDPR), passwords, payment card data or identity documents. The Customer does not configure fields for such purposes. If such information arrives by accident, the Customer reports it to Offerandum so that its restriction and deletion can be arranged.
7. Offerandum processes its own data about concluding the agreement, representation, billing, contacts and the defense of claims as a controller, under its privacy policy. This does not give Offerandum any freedom to keep the Customer's whole base of enquiries for its own purposes.

Instructions and the Customer's obligations

1. Documented instructions are: this Agreement, the configuration of the form and the panel, the designation of message recipients, and verified instructions from authorized persons sent through an agreed channel.
2. The Customer is responsible for the legal basis, for informing individuals, for a configuration consistent with data minimization, and for the accuracy of recipient details and of the permissions of its users.
3. The Customer names a contact for data and incident matters in the order and updates it promptly after a change. The Customer decides how long data is kept and instructs deletion of data that is no longer needed.
4. If the Customer itself acts as a processor for another party, it obtains the necessary authorization for further processing before entrusting the data and informs Offerandum of this role. Otherwise this template should not be used without adaptation.

Offerandum's obligations

1. Offerandum processes the data only on the Customer's documented instructions, including for transfers, unless required to do so by EU or Member State law. In that case it informs the Customer of the requirement before processing, unless the law prohibits this.
2. Offerandum does not sell the data and does not use it for its own marketing, for training models or for independent analysis of the content of enquiries.
3. Access is given only to people who need it to perform the service, who are authorized and bound by confidentiality or are under an appropriate statutory obligation. Confidentiality continues after access ends.
4. Offerandum informs the Customer promptly if, in its opinion, an instruction infringes data protection law. It suspends the questioned operation until the matter is clarified, informing the Customer of the consequences and keeping the data protected.
5. Offerandum maintains adequate security measures as described in Annex 2, taking into account the risk, the state of the art, the nature of the data and the costs. It informs the Customer of a change that materially affects the level of protection and does not lower the agreed level unilaterally.
6. For support, access to data is limited to the necessary company, purpose and time. Offerandum does not copy real enquiries to a development environment or to AI tools without a separately agreed basis, instruction and safeguards.

Subprocessors and international transfers

1. The Customer gives general written authorization for the use of the subprocessors listed in the accepted Annex 1, within the scope described there.
2. Offerandum notifies the Customer's named contact by e-mail of any intended addition or replacement of a subprocessor at least 14 days before the new subprocessor gets access to the data. The notice names the provider, its task, the place of processing and the transfer mechanism.
3. Within that time the Customer may object on grounds related to data protection. The parties look for a solution, for example another provider or switching the feature off. Until the matter is resolved, the Customer's data is not passed to the new subprocessor. If no solution is possible, the Customer may terminate the affected service before the data is passed on, without a fee for that termination and with a refund of the unused prepayment.
4. Urgency does not override the right to prior authorization; if 14 days cannot be kept, the Customer's separate consent is needed or the feature is suspended.
5. Offerandum imposes on each subprocessor data protection obligations equivalent to those in this Agreement and remains fully liable to the Customer for the subprocessor's performance.
6. Offerandum processes the data in the European Union and, through its subprocessors, in the United States. Any transfer of data from the European Economic Area to a third country meets the conditions of Chapter V GDPR: an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified recipients) or appropriate safeguards, in particular the EU Standard Contractual Clauses, with a transfer assessment and supplementary measures where needed. Where the Customer is established in the EEA, the same safeguards cover the transfer of its data from Offerandum to subprocessors outside the EEA. A storage location in the EU is not a statement that no transfers take place.
7. Offerandum provides the Customer with information about specific transfers, recipients and safeguards, including copies of the relevant documents with the information of other customers protected.

Rights of individuals and assistance to the Customer

1. Offerandum assists the Customer in fulfilling the rights of individuals, taking into account the nature of the processing, the information available and the tools. Assistance covers finding, providing, correcting, restricting, exporting and deleting the entrusted data.
2. A request received directly from an individual is forwarded to the Customer without undue delay, no later than 2 business days, and is not decided by Offerandum on its own without an instruction, unless the law requires otherwise.
3. Offerandum acts on a verified instruction without undue delay, normally within 5 business days, or earlier where the matter requires it. It reports the scope of what was done and any obstacles. These deadlines are organizational commitments and do not replace statutory deadlines.
4. Offerandum assists the Customer with the obligations under Articles 32 to 36 GDPR, in particular risk assessment, data protection impact assessment, prior consultation and establishing the circumstances of a breach, as far as the processing performed by Offerandum is concerned.
5. Any charge for work beyond ordinary service is agreed before the work is done. A dispute about a charge may not delay assistance needed to meet a statutory obligation.

Personal data breaches

1. Offerandum notifies the Customer without undue delay after becoming aware of a breach concerning the Customer's data; the parties adopt a maximum of 24 hours for the first notification. Offerandum does not wait for the end of the investigation or a full assessment of the consequences.
2. The notification contains the available information about the nature of the event, the categories and approximate number of individuals and records, the likely consequences, the measures taken to limit them and the contact person handling the matter. Missing information is provided in phases without undue delay.
3. Offerandum preserves evidence, limits the consequences and keeps protected documentation. It sends the notification to the Customer's incident contact; without confirmation of receipt, it uses the agreed emergency contact.
4. The Customer assesses whether a supervisory authority or the individuals must be notified. Offerandum does not make these notifications on the Customer's behalf without authorization or a legal obligation. Where the event also concerns Offerandum's own data as a controller, Offerandum assesses its own obligations as well.

Information and audits

1. Offerandum makes available all information necessary to demonstrate compliance with Article 28 GDPR and contributes to audits by the Customer or an auditor mandated by it.
2. Audits are carried out through written questions and the provision of documentation and evidence. Offerandum answers a written audit request within 14 days. Where a written audit is not sufficient, in particular after an incident, on reasonable suspicion of a breach or at the request of a supervisory authority, the parties agree an inspection with at least 14 days' notice; an urgent inspection after an incident may be shorter.
3. The scope and manner of an audit protect trade secrets, the data of other customers and the availability of the service. This is not a ground for refusing information needed to assess compliance.
4. The parties record the findings, remedial actions, the people responsible and the deadlines. No fees or restrictions are imposed that would prevent the audit right from being exercised effectively.

Retention, return and deletion

1. Offerandum keeps an enquiry and its related documents for as long as the Customer keeps them. The Customer deletes enquiries in the panel or instructs their deletion at any time; the Customer decides on the retention period that its own law and purposes require. Deletion of an enquiry covers the record of field changes, the assistant conversation, the documents and the notes.
2. On a verified deletion instruction, data is removed from the active environment within 7 calendar days, or sooner where the law requires a shorter reaction or the preservation of a strictly defined scope.
3. When the service ends, the Customer chooses return and deletion or deletion alone. Return means an orderly export of the entrusted data, the documents and the information needed to read them. A single limited CSV export of the list does not exhaust this obligation.
4. Unless instructed otherwise earlier, for 30 days after the end of the service the data remains available for export only, with no new enquiries and no operational handling. At the end of those 30 days the data is deleted from the active environment.
5. Isolated backups expire within 30 days of active deletion. Backups are not used for ordinary handling, and after any restore all outstanding deletion instructions are applied again before the data is made available.
6. Offerandum confirms the scope and date of active deletion and the final date of backup expiry. If EU or Member State law requires certain data to be kept, Offerandum states the basis, scope and period, and limits access and purpose.
7. Deletion at Offerandum does not delete messages and exports in the Customer's own systems or those of authorized recipients. The Customer is responsible for those copies; Offerandum helps to identify the scope of what was disclosed.
8. Offerandum does not withhold entrusted data because of an unpaid invoice. Its own billing documents and the minimum evidence of having performed its obligations are kept on their own basis and retention.

Final provisions

1. This Agreement remains in force for as long as Offerandum processes the entrusted data, including during return and deletion. Confidentiality and the accountability that the law requires continue accordingly.
2. Material changes to this Agreement require documented agreement; changes of subprocessors follow the procedure in section 5. A new publication on the website does not retroactively change an accepted version.
3. If another entity takes over running Offerandum, in particular a company to which the Offerandum business is contributed or sold, it steps into the rights and obligations of the processor under this Agreement together with the Main Agreement, on the same terms and with the annexes unchanged. Offerandum informs the Customer's named contact on a durable medium at least 30 days before the takeover, naming the new entity. Until that day the data is processed by the current entity. This is not a change of subprocessor unless the current entity is to keep processing data on the successor's behalf; in that case the procedure in section 5 applies.
4. Annex 1: List of subprocessors, version 1.0. Annex 2: Security measures, version 1.0. The chosen retention profile and any deviations are recorded in the order.
5. This Agreement is governed by the laws of Poland and by the GDPR. Its provisions do not exclude statutory liability or the rights of the individuals whose data is processed. This English text governs; the Polish data processing agreement is a separate document for customers in Poland.