⚠️ DRAFT – needs legal review before publication

Generated from a Nova template. This is not legal advice and must not be published until a lawyer has checked it and marked it reviewed.

Missing facts to fill in: 9.

GYOP – Data Processing Agreement

Version 0.1.0-draft · Effective from: ⟦TO FILL: data zatwierdzenia / approval date⟧

This Data Processing Agreement (the "DPA") applies when a business customer uses GYOP to process personal data of its own users, employees or customers. It forms part of the agreement for the use of GYOP (the "Main Agreement") and fulfils Article 28(3) of Regulation (EU) 2016/679 ("GDPR").

1. Parties

1. Controller ("Customer"): the business customer identified in the Main Agreement or in the signature block below.
2. Processor: NOVA AI VENTURES SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Jasna 26, 00-054 Warszawa, Poland, KRS 0001208266, NIP 5253069869, REGON 543362820, EU VAT PL5253069869, share capital PLN 156,000.00, e-mail: privacy@novaai.ventures ("NovaAI").

2. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the GDPR. "Sub-processor" means another processor engaged by NovaAI to carry out processing on behalf of the Customer. "Customer Data" means the personal data processed by NovaAI on behalf of the Customer under the Main Agreement.

3. Subject and details of processing

1. NovaAI processes Customer Data only to provide GYOP: keeping an estate agency's listings and client book and collecting its clients' reactions to the listings assigned to them.
2. The duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in section 14.
3. The Customer is responsible for the lawfulness of the processing, including having a legal basis and informing data subjects.

4. Obligations of the Processor

NovaAI shall:

1. process Customer Data only on documented instructions from the Customer – the Main Agreement, this DPA and the Customer's use and configuration of GYOP – including with regard to transfers to third countries, unless required to do so by EU or Member State law; in that case it informs the Customer before processing, unless the law prohibits this;
2. inform the Customer immediately if, in its opinion, an instruction infringes data protection law;
3. ensure that persons authorised to process Customer Data have committed themselves to confidentiality or are under a statutory obligation of confidentiality;
4. take all measures required by Article 32 GDPR, as described in section 15;
5. respect the conditions for engaging Sub-processors in section 5;
6. taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights;
7. assist the Customer in ensuring compliance with Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to it;
8. at the end of the services, delete or return Customer Data as set out in section 10;
9. make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR and allow for audits as set out in section 9.

5. Sub-processors

1. The Customer gives NovaAI a general written authorisation to engage the Sub-processors listed in section 16.
2. NovaAI informs the Customer of any intended addition or replacement of a Sub-processor at least 30 days in advance by e-mail or in the product. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected services before the change takes effect, with a refund of prepaid fees for the period after termination.
3. NovaAI imposes on each Sub-processor, by contract, the same data protection obligations as in this DPA, and remains fully liable to the Customer for the Sub-processor's performance.

6. International transfers

NovaAI transfers Customer Data outside the European Economic Area only where the conditions of Chapter V GDPR are met – on the basis of an adequacy decision (including the EU–US Data Privacy Framework) or standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, with supplementary measures where needed. The safeguard used for each Sub-processor is shown in section 16.

7. Personal data breaches

NovaAI notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notification contains, as far as available, the information listed in Article 33(3) GDPR; information not yet available is provided in phases without undue further delay. NovaAI takes reasonable steps to contain the breach and mitigate its effects.

8. Assistance and costs

NovaAI provides the assistance described in this DPA through the features of GYOP where possible. Assistance that goes beyond them and is not caused by a breach of this DPA by NovaAI may be charged at reasonable rates agreed in advance.

9. Audits

1. NovaAI makes available, on request, the documentation needed to demonstrate compliance with this DPA (for example security policies, certificates or audit reports).
2. If the documentation is not sufficient, the Customer, or an independent auditor bound by confidentiality, may carry out an audit, including an inspection, with at least 30 days' notice, during business hours, no more than once a year unless required by a supervisory authority or after a personal data breach. Each party bears its own costs.

10. Return and deletion

At the end of the services, NovaAI deletes Customer Data, or returns it at the Customer's choice made before the end, and deletes existing copies, unless EU or Member State law requires storage. Copies in backups are deleted in the normal backup cycle and are not used in the meantime.

11. Liability

Each party's liability under this DPA is governed by the Main Agreement and Article 82 GDPR. Nothing in this DPA limits liability towards data subjects.

12. Term

This DPA applies for as long as NovaAI processes Customer Data on behalf of the Customer. If this DPA and the Main Agreement conflict on data protection, this DPA prevails.

13. Governing law

This DPA is governed by Polish law. Disputes are resolved by the common court competent for NovaAI's registered office.

14. Annex I – Description of processing

15. Annex II – Technical and organisational measures

1. encrypted connections (HTTPS) for all data in transit
2. server-side access control: an agency sees only what the search group shared with it
3. access to personal data only for the people who need it for their work
4. deleting data within the periods described in this policy

Personal data breaches are handled as set out in section 7.

16. Annex III – Sub-processors

17. Signatures