Data Processing Agreement (DPA)

Working translation. If this translation differs from the Polish version, the Polish version prevails.

The DPA is accepted electronically together with the Terms at the moment the Account is created and constitutes its integral annex. With respect to obligations concerning entrusted processing, the DPA takes precedence over the Terms.

§ 1. Parties and roles

• Controller - the Host, who decides on the purposes and means of processing the data of participants in their Events.
• Processor - MD ELEVATE LTD, the operator of the be here. service, to the extent that it stores and makes available participants' data in the Host's panel.
• The Operator remains an independent controller with respect to the Account, security, billing, moderation, and its own legal obligations.

§ 2. Subject matter and scope of entrustment

• The entrustment covers data provided by participants in registrations as well as data collected in the panel: lists of registered persons, contacts, CRM-type functions and similar.
• Categories of data: first and last name or signature, email address, optionally telephone number, selected Event and date, registration status, message content, and organizational data.
• Categories of data subjects: participants and persons interested in participating in the Host's Events.
• Purpose: to enable the Host to handle registrations, contact participants, and organize Events.
• Duration: for the term of the Agreement and for the technical periods indicated below.

§ 3. Instructions of the Controller

• The Operator processes entrusted data solely on documented instructions of the Controller. The Terms, the DPA, and use of the Service's functions in accordance with their purpose are deemed such instructions.
• The Operator informs the Controller if, in its opinion, an instruction infringes applicable data protection law.
• The Operator may process data to a different extent only where required by applicable law; in such case it informs the Controller accordingly, unless the law prohibits doing so.

§ 4. Confidentiality and security

• Only authorized persons, bound by confidentiality, are granted access to the data.
• The Operator applies appropriate technical and organizational measures, including encryption of transmission, access control based on permissions, separation of environments, backups, and logging of security events.
• Security measures may be developed further, provided the level of protection is not reduced.

§ 5. Sub-processors

• The Controller grants general authorization for the use of sub-processors necessary to provide the service, in particular providers of hosting and database infrastructure, email delivery services, the payment provider, and security and maintenance tools.
• The Operator concludes agreements with sub-processors ensuring at least an equivalent level of protection and is responsible for their actions as for its own.
• The Operator informs the Controller in advance of a material change of sub-processors; the Controller may raise a reasoned objection, and, absent a resolution, terminate the Agreement.

§ 6. Assistance to the Controller

• The Operator, to the extent possible, assists the Controller in fulfilling requests from data subjects, in particular by providing functions for viewing, exporting, and deleting data in the panel.
• The Operator assists the Controller with respect to the security of processing, breach notification, and any data protection impact assessment.
• If a data subject's request reaches the Operator directly, the Operator forwards it to the Controller, unless the Operator itself is obliged to respond.

§ 7. Personal data breaches

• The Operator notifies the Controller of a breach of the protection of entrusted data without undue delay after becoming aware of it.
• The notification contains available information on the nature of the breach, its likely consequences, and measures taken or proposed.
• Notifications to the supervisory authority and to data subjects are made by the Controller, unless a separate obligation rests with the Operator.

§ 8. Deletion or return of data

• After the provision of services ends, the Operator deletes the entrusted data or enables its export, in accordance with the Controller's choice made within the available deadline.
• Further storage of data is permissible where required by applicable law, as well as temporary storage in backup copies until they are overwritten.

§ 9. Audit and demonstration of compliance

• The Operator makes available to the Controller information necessary to demonstrate compliance with the obligations arising from the DPA.
• An audit takes place after the date and scope have been agreed in advance, in a manner that does not compromise the security and confidentiality of other clients' data.

§ 10. Data transfers

• Data are processed primarily on servers within the European Economic Area.
• Due to the Operator's registered office in the United Kingdom and the use of technology providers, a transfer of data outside the EEA may occur. It takes place on the basis of an adequacy decision or standard contractual clauses together with additional safeguards.

§ 11. Obligations of the Host as Controller

• The Host ensures a legal basis for the processing of participants' data and fulfils information obligations towards them.
• The Host limits the data collected to the necessary minimum and does not collect special categories of data without an appropriate basis.
• The Host secures access to its own Account and is responsible for any further use of data obtained from the Service.
• The Host handles requests from data subjects concerning its own processing.

§ 12. Final provisions

• The DPA is effective from the moment the Terms are accepted and for the duration of the Agreement with the Operator.
• In matters not regulated herein, the Terms and applicable personal data protection law shall apply.
• Contact for DPA matters: contact@behere.pl.