Data processing agreement

How this document applies

This template is part of the SaaS Health documentation. The party entrusting the data (the “Controller”) is the Client, meaning the company named in the SaaS Health services agreement or in the Order, and the processor (the “Processor”) is Grantbot.pl Sp. z o.o., the owner of the SaaS Health brand. The agreement binds the parties from the date the main agreement is concluded or an Order referring to it is accepted, or from the date it is signed. An individually signed data processing agreement takes precedence over this template.

The agreement covers personal data that the platform retrieves from the Client’s systems and of which the Client is the controller (e.g. data of its customers and subscribers in the payment system). Grantbot.pl Sp. z o.o. processes the data of dashboard User accounts and billing data as a controller; the Privacy policy describes how.

1. Parties and basis

This agreement is concluded between:

the Controller: the Client named in the main agreement or in the Order, which determines the purposes and means of processing the entrusted data,

and

the Processor: Grantbot.pl Sp. z o.o., registered office in Warsaw, Poland, ul. Złota 75A/7, 00-819 Warszawa, KRS (National Court Register) 0001244303, NIP (tax ID) 5273221240.

This agreement implements Article 28(3) and (4) of Regulation (EU) 2016/679 (the “GDPR”). The terms controller, processor, personal data, processing and personal data breach have the meaning given to them in the GDPR.

2. Subject matter and duration

The Controller entrusts the Processor with personal data to the extent necessary to connect the SaaS Health dashboard to the Client’s systems, retrieve data from them, calculate company metrics, prepare the audit and recovery plan, present the results to the Client’s Users and provide support.

Processing lasts for the term of the services and for the time needed to return or delete the data after the main agreement ends. Annex 1 and the Order set out the details of the operations, categories of data and data subjects.

3. The Controller’s instructions

1. The Processor processes the data only on documented instructions from the Controller, unless Union or Polish law requires the processing. In that case the Processor informs the Controller before processing, unless the law prohibits it.
2. Documented instructions are this agreement, the main agreement, the Order, the Controller handing over access keys to its systems together with the agreed scope of the connection, actions of an authorized User in the dashboard (e.g. refreshing data, requesting a recovery plan) and later instructions sent to [email protected].
3. If the Processor considers that an instruction infringes the GDPR or other data protection law, it informs the Controller without delay and may suspend the instruction until it is clarified.
4. The Processor does not use the entrusted data for its own marketing, sales, training AI models or benchmarks shared with other clients, unless the Controller gives separate, explicit consent in an additional arrangement. The AI model provider listed in Annex 3 processes data sent through the API only to answer the request and, under its commercial terms, does not use it to train models.

4. The Controller’s obligations

The Controller:

• ensures that its instructions and the processing are lawful, including an appropriate legal basis and informing the people whose data is in its systems;
• gives the Processor access keys with the narrowest permissions needed for the agreed calculations and revokes them when they are no longer needed;
• manages Users on its side and tells the Processor who should be given or lose access to the dashboard;
• does not connect systems containing special categories of data or data on criminal convictions without first agreeing the scope and additional safeguards in writing;
• informs the Processor of particular risks, retention limits and instructions that cannot be inferred from the Order.

5. The Processor’s obligations

The Processor undertakes to:

• give access to the data only to authorized persons bound by confidentiality;
• apply technical and organizational measures appropriate to the risk, described in Annex 2;
• keep the required processing records and make available the information needed to demonstrate compliance with Article 28 GDPR;
• assist the Controller with data subject rights, breach handling, data protection impact assessments and consultations with the supervisory authority, taking into account the nature of the processing and the information available;
• inform the Controller without delay of a legally binding request from an authority concerning the data, unless the law prohibits such notice;
• return or delete the data at the end of the services in accordance with section 13.

6. Confidentiality and access

The Processor grants access on a least-privilege basis. Administrative access is limited to people maintaining, supporting or securing the platform. Authorizations are withdrawn once access is no longer needed.

The duty of confidentiality continues after the cooperation or authorization ends. The Processor is responsible for making authorized persons familiar with secure processing rules.

7. Sub-processing

1. The Controller gives the Processor general authorization to engage the further processors (“Sub-processors”) listed in Annex 3.
2. The Processor ensures that its contract with each Sub-processor imposes data protection obligations no less strict than those in this agreement, as relevant to the activities entrusted.
3. The Processor remains liable to the Controller for the performance of a Sub-processor’s obligations as required by Article 28(4) GDPR.
4. The Processor gives at least 14 days’ notice of an intended addition or replacement of a Sub-processor, in particular by updating Annex 3 or by email. During that time the Controller may raise a reasoned data protection objection. The parties will try to agree a solution; if that is not possible, the Controller may terminate the main agreement with effect from the date the disputed Sub-processor is engaged.

8. Data subject rights

If the Processor receives a request concerning the entrusted data, it forwards it to the Controller without delay and does not respond on its own, unless instructed to or required by law.

Most of the entrusted data stays in the Controller’s systems, and the platform stores only the calculated metrics and summaries (Annex 1). As far as technically possible, the Processor helps the Controller find, correct, export, restrict and delete data stored in the platform. Standard assistance is included in the service fee; work beyond the usual scope may be charged at an agreed rate, of which the Controller will be told in advance.

9. Personal data breaches

The Processor notifies the Controller of a confirmed breach involving the entrusted data without undue delay, where possible within 48 hours of confirming it. The notice is supplemented as information becomes available and includes, where available:

• the nature of the breach and the categories and approximate number of data subjects and records;
• the likely consequences of the breach;
• the measures taken or proposed to mitigate it, including which access keys the Controller should revoke;
• a contact point for further information.

A notice is not an admission of liability. The Controller decides on notifying the supervisory authority and the data subjects, and the Processor gives it reasonable assistance.

10. Impact assessments and consultation

Taking into account the nature of the processing and the information available, the Processor assists the Controller with its obligations under Articles 32–36 GDPR. The Controller is responsible for deciding whether a data protection impact assessment or prior consultation is required.

11. Information and audits

The Processor makes available the information needed to demonstrate compliance, primarily as documentation, reports, questionnaire answers or results of independent reviews. The Controller may carry out an audit no more than once a year, unless there has been a breach, a request from an authority or a reasonable suspicion of material non-compliance.

An audit requires at least 14 days’ notice, takes place during business hours, must not compromise the security or confidentiality of other clients and should be carried out by a person bound by confidentiality. The Controller bears the cost of the audit, unless it reveals a material breach of the Processor’s obligations.

12. International transfers

Application hosting and the database run in a European Union region. Some Sub-processors are US-based companies, including those storing data in the EU, and the AI model and email delivery run in the USA (Annex 3). Data is transferred outside the EEA, including remote access by those companies, only under a mechanism compliant with Chapter V GDPR: an adequacy decision (including the EU-U.S. Data Privacy Framework, where the recipient is certified under it) or standard contractual clauses with the necessary supplementary measures, or on the Controller’s documented instructions.

This agreement does not by itself replace the standard contractual clauses required for a transfer to an importer in a third country. Where they are needed, the appropriate modules will be included in the relationship with the data recipient.

13. Return and deletion of data

When the services end, the Processor, at the Controller’s choice made before the agreement ends, either provides an export of the stored metrics and reports in an agreed format or deletes them, unless the law requires further storage. Without instructions, within 30 days the Processor deletes the access keys from the vault, disconnects the integrations and deletes the Controller’s organization data from the platform database. Regardless of this, the Controller should revoke the access keys in its own systems.

Data may remain for a limited time in backups kept by the database provider, which are deleted on the 7-day backup retention cycle and are not restored to normal use unless needed to recover the environment after a failure. Report copies the dashboard keeps in the User’s browser storage are removed on sign-out; if the User does not sign out, they stay on that device until the browser data is cleared. Confidentiality and security obligations remain in force.

14. Final provisions

This agreement applies for as long as the Processor processes data on behalf of the Controller. In case of conflict on data protection matters, this agreement prevails, followed by the main agreement and the Order, unless an individually signed data processing agreement provides otherwise.

This agreement is governed by Polish law. A change materially affecting the protection of the entrusted data must be recorded in documentary form.

Annex 1: description of the processing

Annex 2: security measures

• encryption in transit using current TLS protocols;
• access keys to the Client’s systems kept in the database’s encrypted vault (Supabase Vault), read only by the platform server and never sent to the browser;
• use of keys with the narrowest permissions the system provider allows (e.g. a read-only key in the payment system, read access to performance data in advertising tools);
• logical separation of organizations, access control at the application and database level, Row Level Security policies and automated organization isolation tests;
• dashboard accounts created by invitation only, each assigned to one organization and role, with sign-in by password or Google account;
• data minimization: data identifying the Client’s customers is processed in server memory and not stored in the platform database;
• only the audit results and metrics needed for the recovery plan are passed to the AI model, through the API under the provider’s commercial terms, without the data being used to train models; the feature is enabled for the Client by agreement;
• daily database backups made by the database provider and kept for 7 days;
• management of updates, dependencies and vulnerabilities in proportion to the risk;
• a procedure for responding to incidents, revoking access and handling data subject requests;
• confidentiality obligations for staff and access to the Client’s data limited to justified cases;
• regular review of whether the safeguards remain adequate as the scope and risk of the service change.

Annex 3: Sub-processors

On the Controller’s request, the Processor provides the current list of providers used for its account, with the available information on location and transfer mechanism.

Signatures

If this agreement is concluded by signature, it is signed by persons authorized to represent the parties. If it is concluded by reference in the main agreement or in an accepted Order, the party details and the date from those documents replace the fields below. A signed copy can be requested at [email protected].