Data Processing Agreement

1. This Agreement is concluded between the customer using the KaiLedger service (the “Controller”) and [Operator: company name, registered address, NIP, KRS] (the “Processor”), together the “Parties”.

2. This Agreement is concluded when the account is created, together with acceptance of the Terms of Service (/legal/terms), and forms part of the agreement for the KaiLedger service (the “Main Agreement”). It meets the requirements of Article 28(3) of Regulation (EU) 2016/679 (“GDPR”).

3. The Controller entrusts the Processor with processing personal data to the extent and for the purpose set out in §2, and the Processor undertakes to process it in accordance with this Agreement, the GDPR and other laws.

1. Purpose: providing the KaiLedger service — importing, storing, categorising and analysing the financial and staff data of the Controller's stores and presenting results (cash forecast, P&L, alerts, reports, the “Ask” assistant).

2. Nature: storage, organisation, viewing, calculation of reports, export, deletion — automated operations performed on cloud infrastructure.

3. Categories of data subjects:

• the Controller's employees and contractors (including temporary-agency staff),
• the Controller's counterparties who are natural persons, or representatives and contact persons of counterparties (suppliers, landlords, franchisor),
• natural persons appearing in the bank account history (senders and recipients of transfers),
• account Users designated by the Controller.

4. Types of data:

• bank statement lines: name of the counterparty, account number, transfer title and amount, date,
• purchase invoices fetched from KSeF: seller and buyer details (name, NIP, address), line items, amounts,
• till sales data (generally without personal data of store customers; possibly the cashier's first name),
• staff data: name, assigned store, position, working hours, pay rate and pay cost,
• User data: email address, name, role.

5. The entrustment does not cover special categories of data (Article 9 GDPR) or criminal-conviction data (Article 10 GDPR). The Controller undertakes not to enter such data into the service.

6. Duration: for the term of the Main Agreement and until the data is deleted under §9.

1. The Processor processes data only on documented instructions from the Controller, including with regard to transfers to a third country, unless required to do so by Union or Polish law — in which case it informs the Controller before processing, unless the law prohibits this.

2. Instructions are: the Main Agreement, this Agreement and the actions of the Controller and Users in the service (e.g. uploading a file, connecting KSeF or a till system, asking the assistant, exporting, requesting deletion).

3. The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other law.

The Processor gives access to the data only to authorised persons who have committed themselves to confidentiality or are under a statutory obligation of confidentiality, and only as necessary to provide the service, technical support or fix faults.

The Processor applies technical and organisational measures ensuring a level of security appropriate to the risk, described in Annex 1. It may change them provided the level of protection is not reduced.

1. The Controller gives general authorisation for the Processor to engage the sub-processors listed in Annex 2.

2. The Processor notifies the Controller by email at least 14 days before adding or replacing a sub-processor. Within that period the Controller may object on reasonable grounds; if the Parties do not reach agreement, the Controller may terminate the Main Agreement with immediate effect at no extra cost.

3. The Processor imposes on sub-processors the same data protection obligations as in this Agreement and remains liable to the Controller for their performance.

4. The “Ask” assistant sends the language-model provider only the question and the data needed to answer it. The Controller may switch the assistant off — then no data is sent to that provider.

5. Systems from which the service fetches data on the Controller's instruction (KSeF, bank, Loyverse, time-clock systems) are not the Processor's sub-processors — their providers act in a relationship with the Controller.

Data in the service database is stored in the European Economic Area. Transfers outside the EEA (listed in Annex 2) take place only on the basis of an adequacy decision (including the EU-US Data Privacy Framework) or Standard Contractual Clauses (Article 46(2)(c) GDPR), with supplementary measures where needed.

1. Data subject rights: taking into account the nature of processing, the Processor assists the Controller in responding to data subject requests (Articles 15–22 GDPR), among other things by providing export, correction and deletion of data in the service. A request addressed to the Processor is forwarded to the Controller without undue delay and not answered by the Processor itself.

2. Breaches: the Processor notifies the Controller of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, providing the information listed in Article 33(3) GDPR as far as available and supplementing it as facts are established.

3. The Processor assists the Controller in complying with Articles 32–36 GDPR (security, breach notification, impact assessments, prior consultation), taking into account the nature of processing and the information available to it.

1. The Controller may export the data at any time in a reusable format, including when the account is read-only.

2. At the Controller's request, the Processor deletes the data after a 30-day grace period from the request (during which the request can be withdrawn); backups are overwritten within a further [30] days.

3. After the Main Agreement ends, the Processor deletes the data in accordance with the Terms of Service (§12), unless Union or Polish law requires further storage. At the Controller's request it confirms deletion in writing or by email.

4. Non-payment is not a ground for deleting data.

1. The Processor makes available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR, including the current list of sub-processors and a description of security measures.

2. The Controller may carry out an audit or inspection, itself or through an independent auditor bound by confidentiality, with at least 14 days' notice, during business hours and no more than once a year, unless there is a reasonable suspicion of a breach or a supervisory authority requires it. Audits are first carried out by written questions and documents. Audits do not cover sub-processors' infrastructure — for them the Processor provides those providers' reports and certificates (e.g. SOC 2, ISO 27001).

3. The Controller bears the cost of the audit unless it reveals a material breach of this Agreement by the Processor.

Liability of the Parties for damage suffered by data subjects is governed by Article 82 GDPR. Otherwise, the liability provisions of the Main Agreement apply, including its limits, to the extent permitted by law.

1. This Agreement remains in force for the term of the Main Agreement and ends with it, except that obligations regarding deletion and confidentiality continue until fulfilled.

2. Matters not covered are governed by the GDPR, the Polish Personal Data Protection Act of 10 May 2018 and the Civil Code. This Agreement is governed by Polish law, and disputes are resolved by the court competent for the Processor's registered office.

3. In case of conflict between this Agreement and the Main Agreement regarding personal data protection, this Agreement prevails. In case of discrepancy between language versions, the Polish version prevails.

• Company isolation: Row Level Security rules in the database — every User query returns only data of companies the User has access to; regular automated isolation tests.
• Encryption: connections over HTTPS/TLS only; data at rest and backups encrypted by the database provider (AES-256).
• Secrets: KSeF tokens, integration keys and API keys stored in a vault (Supabase Vault) or encrypted environment variables; never displayed after saving.
• Authentication: sign-in by one-time email link (no passwords), the session is kept in a cookie sent over HTTPS only, with a short-lived token refreshed automatically.
• Access control: roles (e.g. owner, accountant, store manager) with least privilege; the owner can revoke access at any time.
• Accountability: a change log (audit log) recording significant operations in the account.
• Read-only integrations: the service does not issue invoices or order payments.
• Backups: daily database backups at the provider, retained for [7–30 days].
• Operator staff access: named accounts only, with two-factor authentication to provider consoles, solely for support and fault fixing.
• Secure development: code review, automated tests before deployment, dependency updates.
• Breach procedure: detection, assessment, notification of the Controller within the time in §8(2).