Data Processing Agreement (DPA)

The controller is the Organization using the Taskiter service (the Controller). The processor is ScrumSoft Sp. z o.o., ul. Wiejska 9, 43-300 Bielsko-Biała, NIP 9372741849, KRS 0000957030, e-mail [email protected] (the Processor).

The Controller entrusts the Processor with processing personal data contained in Organization Content to the extent and for the purpose necessary to provide the services described in the Terms (Article 28(3) GDPR). This agreement is part of the service agreement and remains in force while the service is used and until data has been returned and deleted under section 9.

In case of conflict between this agreement and the Terms on matters of personal data protection, this agreement prevails.

Nature: storing, organizing, displaying, transmitting, backing up, exporting and deleting data within the service features. Purpose: managing projects, tasks, working time, settlements, the knowledge base, team communication and the client portal of the Controller, and additional features enabled by the Controller (for example Guardian AI, integrations).

Categories of data subjects: organization members, invited people, Controller clients using the client portal or forms, people mentioned in content.

• identification and contact data (name, email, phone, profile picture),
• work data (tasks, comments, time entries, rates and costs, settlement periods, time approvals),
• absences, including types marked as sensitive (for example sickness, Article 9 GDPR), if the Controller uses them,
• content and files added by users and form responses,
• technical data necessary for security (IP addresses and browser in the audit log, session information).

The Controller decides which data it places in the service and is responsible for the legal basis of processing and for informing data subjects.

The Processor processes data only on documented instructions from the Controller, including with regard to transfers to a third country. The instructions are the Terms, this agreement, the organization settings and actions taken in the service by authorized users of the Controller. Other instructions are sent to the Processor email address.

Where Union or Member State law requires the Processor to process data, the Processor informs the Controller before processing unless that law prohibits such information. The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

The Processor gives access to data only to persons who need it to provide, maintain or support the services and who have committed themselves to confidentiality or are under a statutory obligation of confidentiality. The obligation continues after the cooperation ends.

The Processor applies the technical and organizational measures described in Annex 1, appropriate to the risk. The Processor may change them provided the level of protection does not decrease.

The Controller gives general written authorization to engage the sub-processors listed in Annex 2. Sub-processors marked as conditional process data only when the Controller or its user enables the related feature.

• The Processor informs the Controller of an intended addition or replacement by email to the organization owner at least 14 days in advance.
• The Controller may raise a reasoned objection within that period. If the parties do not reach agreement, the Controller may terminate the service agreement with effect before the change, and the Processor refunds the fee for the unused period.
• The Processor imposes on the sub-processor, by contract, the same data protection obligations as in this agreement, in particular guarantees of appropriate security measures.
• The Processor remains liable to the Controller for the performance of the sub-processor obligations.

Insofar as possible, the Processor assists the Controller by appropriate technical and organizational measures in responding to data subject requests (Articles 12 to 22 GDPR). For this purpose the service provides: editing and deletion of data by authorized users, organization data export (JSON, CSV and files), member deactivation and account anonymization.

The Processor forwards a request received directly to the Controller without undue delay and does not answer it on its own unless the Controller so instructs.

Taking into account the nature of processing and the information available, the Processor assists the Controller in ensuring security (Article 32), notifying breaches to the authority and communicating them to data subjects (Articles 33 and 34), data protection impact assessments (Article 35) and prior consultations (Article 36), in particular by providing a description of the processing and the security measures.

The Processor notifies the Controller of a personal data breach without undue delay and no later than 48 hours after becoming aware of it. The notification contains the information required by Article 33(3) GDPR available at the time; the rest is provided without undue delay once obtained. The Processor takes measures to mitigate the effects of the breach and documents them.

The Controller can download a full export of organization data at any time in the panel (Organization › Compliance and data): data in JSON, CSV sheets, the file list and optionally the files. The archive is available for 7 days through a signed link valid for 15 minutes. This is the form of data return.

When the services end, at the choice of the Controller, the Processor returns the data (export) and deletes it, including existing copies, according to the organization deletion rules in the Terms. Deleted items first go to the trash for a restore period (30 days on Free and Trial plans, 60 days on paid plans). Backups are deleted in their rotation cycle at the provider. The Processor keeps only data that Union or Member State law requires it to store (for example billing data) and informs the Controller of it.

The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, in particular the description of measures in Annex 1, the list in Annex 2 and the organization audit log entries.

The Processor allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. An on-site audit takes place no more than once a year (unless required by a supervisory authority or following a breach), scheduled at least 30 days in advance, during business hours, without access to other customers data, at the Controller cost and subject to confidentiality.

Data is transferred outside the European Economic Area only to the entities in Annex 2, on the basis of an adequacy decision (including the EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission.

• The Processor maintains a record of categories of processing activities carried out on behalf of the Controller (Article 30(2) GDPR).
• The Processor cooperates with the supervisory authority on request (Article 31 GDPR).
• Data protection contact: the Processor email address in section 1.

Liability of the parties is governed by the Terms, subject to GDPR provisions that cannot be excluded. Matters not covered here are governed by the GDPR and Polish law. Acceptance in the panel records the document version, the accepting person, the date and a digest of the content. A change of content means a new version, which the Controller accepts again.

Paddle.com Market Ltd handles payments as the seller (Merchant of Record) and is a separate controller of payment data, not a sub-processor.