Data Processing Agreement

Version of 4 October 2026

This Data Processing Agreement (“DPA”) is part of the Terms of Service between KITSIS CRM (“Processor”, “we”) and the Customer (“Controller”, “you”). It applies whenever we process personal data in Customer Data on your behalf. It meets the requirements of Article 28 of the GDPR (Regulation (EU) 2016/679). The Customer accepts it by creating a workspace or by pressing “Accept” in the Service.

Words defined in the Terms have the same meaning here. “Personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meaning given in the GDPR.

1. Subject, duration, nature and purpose

1. We process personal data only to provide the Service to you: to store, display, search, send and receive, back up and delete Customer Data, and to support you.
2. The processing lasts as long as the Terms, plus the time needed for deletion under section 10.
3. Details are in Annex 1.

2. Your instructions

1. We process personal data only on your documented instructions. Your instructions are these Terms and this DPA, and what you and your Users do in the Service, for example creating, editing, sending, exporting or deleting data.
2. We process data otherwise only if EU or Polish law requires it. In that case we tell you before, unless that law forbids it.
3. If we think an instruction breaks the GDPR or other data protection law, we tell you at once.

3. Your responsibilities

You are responsible for the lawfulness of the processing: for having a legal basis, informing data subjects and meeting your other duties as a controller. If you store special categories of data (for example health data), you are responsible for having a legal basis for it. The security measures in Annex 2 apply to all Customer Data in the same way.

4. Confidentiality

Everyone we authorise to process Customer Data is bound by confidentiality. Access is given only to the extent needed for the work.

5. Security

We apply the technical and organisational measures in Annex 2 (Article 32 GDPR). We may improve them, but we will not lower the overall level of protection.

6. Subprocessors

1. You give us general authorisation to engage subprocessors. The current list is in Annex 3 and on the subprocessors page.
2. We email the Owners at least 30 days before we add or replace a subprocessor. You may object in writing within that time. If we cannot solve the objection, you may end the agreement without penalty before the change takes effect.
3. Each subprocessor is bound by a written agreement with data protection obligations that are at least as strict as in this DPA (Article 28(4) GDPR). We remain fully liable to you for our subprocessors.

7. Transfers outside the EEA

We transfer personal data outside the EEA only to the subprocessors listed in Annex 3 and only with a safeguard under Chapter V of the GDPR: the EU-US Data Privacy Framework for certified companies, and the Standard Contractual Clauses (Commission Decision 2021/914) in their agreements.

8. Helping you with data subject requests

The Service lets you find, correct, export and delete personal data yourself. If that is not enough, we help you answer requests of data subjects under Articles 15 to 22 GDPR. If a data subject writes to us directly about Customer Data, we pass the request on to you and do not answer it ourselves, unless you ask us to.

9. Personal data breaches and other help

1. We notify you without undue delay after we become aware of a personal data breach affecting Customer Data (Article 33(2) GDPR). We send the notice to the Owners by email.
2. The notice describes, as far as we know at the time, what happened, the categories and approximate number of data subjects and records, the likely consequences, what we have done and propose to do, and a contact person. We send further information as soon as we have it.
3. We help you with your duties under Articles 32 to 36 GDPR: security, breach notifications, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information we have.

10. Deletion and return of data

1. You can download all Customer Data at any time: Settings → Data → “Download all data”.
2. When the agreement ends or the subscription is unpaid, the workspace stays read-only for 30 days so you can download the data. After that we delete all Customer Data. An Owner can also delete the workspace earlier in the Service; deletion happens 7 days after the request.
3. Copies in encrypted backups expire no later than 35 days after deletion. Until then they are protected by the measures in Annex 2 and are not used for anything else.
4. We keep personal data longer only where EU or Polish law requires it.

11. Information and audits

1. We make available the information needed to show that we meet Article 28 GDPR. On request we answer a reasonable security questionnaire once a year.
2. You or an independent auditor bound by confidentiality may audit us, at your cost, with at least 30 days’ written notice, during business hours, without disturbing the Service for other customers and without access to data of other customers. Audits take place at most once a year, unless a personal data breach or a supervisory authority gives reason for another one.

12. Liability

The liability rules and limits of the Terms apply to this DPA. They do not limit the rights of data subjects under Article 82 GDPR.

13. Order of precedence and law

If this DPA and the Terms say different things about personal data, this DPA applies. This DPA is governed by Polish law, and the courts named in the Terms decide disputes.

Annex 1: details of the processing

Categories of data subjects: contacts, clients, leads and their representatives; the Customer’s employees and other Users; people who correspond with the Customer through connected mailboxes, chats, forms, telephony or booking.

Categories of personal data: whatever the Customer puts into the Service or connects to it, typically: names, phone numbers, email addresses, postal addresses, company and job details, deal and payment information, notes, messages and emails, call records and recordings received from connected telephony, files and their contents, booking details, and data about Users (name, email, role, activity in the Service, access log).

Special categories: only if the Customer puts them into the Service. The Service does not ask for them.

Nature of the processing: storage, organisation, retrieval, display, search, transmission (sending email and notifications, webhooks and integrations the Customer sets up), backup, export and deletion.

Duration: for the term of the agreement and until deletion under section 10.

Annex 2: security measures

Separation of customers

• Every row of Customer Data carries its workspace. The database enforces the separation itself with row-level security (PostgreSQL RLS), so a query of one workspace cannot read another.
• Files are stored under the workspace’s own prefix and are given out only through short-lived signed links after a rights check.

Access by Users

• Rights are set per person by the Customer: what a person sees and can change.
• Passwords are stored as Argon2id hashes. New passwords are checked against known leaked passwords (Have I Been Pwned, k-anonymity: only 5 characters of the hash leave our server).
• Sign-in with a code sent by email; Owners always need it, and the Customer can require it for everyone. Passkeys (Face ID, fingerprint) can replace the code.
• Lockout after repeated wrong passwords, rate limits on sign-in and public forms.
• Sessions end after 7 days without activity and 14 days after sign-in. Users see their devices and can sign them out; managers can sign out an employee everywhere.
• Exports, API keys and webhooks need the password again if it was not entered in the last hour.
• An access log records sign-ins, views of records, exports, deletions and changes of rights, and is kept for 24 months.

Transmission and application security

• All connections use HTTPS (TLS). The API sends HSTS.
• Content Security Policy in the web app; emails are shown sanitised in an isolated frame.
• Uploaded files are scanned for malware before they are given out.
• Outgoing webhooks are signed.
• Dependencies and images are scanned for known vulnerabilities (pip-audit, npm audit, Trivy) and the app is scanned with OWASP ZAP every week.

Servers and operations

• Servers in the EU (Frankfurt). Access to servers only by SSH keys; firewall; automatic security updates and kernel live patching.
• Monitoring of availability, errors and capacity, with alerts to the team. Error reports are sent with personal data masked.
• Changes are tested before release and installed without stopping the Service.

Backups and recovery

• The database is backed up continuously so it can be restored to any minute of the last 14 days, in two separate EU locations (OVH, France and Backblaze, Netherlands). Backups are encrypted with AES-256 before they leave the server.
• A nightly encrypted dump is kept for 30 days in storage with write-once protection (Object Lock), so it cannot be changed or deleted early.
• Restores are tested automatically every night and with a full restore every month.

People and incidents

• Only KITSIS CRM has access to production systems. Anyone given access is bound by confidentiality and gets only the access the work needs.
• A written breach procedure covers detection, containment, assessment, notification of customers and records of every breach (Article 33(5) GDPR).

Annex 3: subprocessors

Not subprocessors: services the Customer connects itself (mailboxes such as Gmail or Microsoft 365, telephony such as CallGear, advertising platforms such as Meta) act on the Customer’s own agreement with them. Push services of browser makers (Apple, Google, Mozilla) only carry notifications encrypted for the device (RFC 8291).