Data processing agreement

Annex 1 to the accounting agreement. Parties: the Client (controller) and VAERD sp. z o.o. (processor).

§1 Subject and duration

The Client entrusts the Office with the processing of personal data solely in order to perform the Main Agreement, for its duration, and after it ends – until the data is returned or deleted (§7).

§2 Scope

1. Categories of persons: the Client's owner and partners, its employees and contractors, counterparties who are natural persons.
2. Types of data: first name and surname, address, PESEL, NIP, contact details, data from invoices and agreements, payroll and insurance data, bank account numbers.
3. Operations: storage, entering into accounting systems, recording, transmission to authorities (tax office, ZUS), archiving.

§3 Obligations of the Office

1. It processes data only on the Client's documented instruction (the Main Agreement and instructions issued in documented form are deemed an instruction).
2. It ensures confidentiality: authorised persons are bound to secrecy.
3. It applies the security measures under Art. 32 GDPR (including access control, encrypted connections, backups, two-factor authentication).
4. It helps the Client to fulfil the rights of data subjects (access, rectification, erasure, restriction) within a reasonable time.
5. It notifies the Client of a personal data breach without undue delay, and no later than 48 hours after discovering it.
6. It helps the Client with the obligations under Art. 32–36 GDPR (security, notifications, impact assessment).
7. It provides the Client with the information needed to demonstrate compliance with Art. 28 GDPR and allows an audit, no more than once a year, on 14 days' notice, at the Client's expense.

§4 Sub-processing

1. The Client gives general consent to the Office using the entities listed in Annex 1A.
2. The Office informs of an intention to change or add an entity by e-mail 14 days in advance; the Client may object within that period. In case of objection the Parties seek a solution, and if there is none, the Client may terminate the Main Agreement within 30 days without additional fees.
3. The Office imposes the same data protection obligations on these entities and is liable for their actions towards the Client.

§5 Transfers outside the EEA

The Office does not transfer data outside the European Economic Area except in the cases indicated in Annex 1A. The Client consents to the transfer of data to the USA by Google on the basis of standard contractual clauses or the Data Privacy Framework, in accordance with Art. 44–49 GDPR.

§6 Liability

The Parties are liable in accordance with Art. 82 GDPR; in relations between the Parties, the Office's liability is limited by the provisions of §9 of the Main Agreement.

§7 Return or deletion

After the Main Agreement ends, the Office, at the Client's choice, returns the data (in a file on the online drive) or deletes it after 30 days, unless the law requires further storage (e.g. AML documentation – 5 years).

§8 Final provisions

Polish law; in matters not regulated – the GDPR and the Main Agreement. Changes in documented form.

Annex 1A – entities used by the Office