DATA PROCESSING AGREEMENT (DPA)

Data Processing Agreement concluded on [DATE] in [CITY] between:

Data Controller: [CLIENT COMPANY NAME], with its registered office at [ADDRESS], registered under number [REGISTRATION NUMBER, e.g. KRS/NIP], represented by [FULL NAME OF REPRESENTATIVE], hereinafter referred to as the “Data Controller”,

Data Processor: CONTRACTORS.ES SP. Z O.O. with its registered office in Zielonka, entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court in Bydgoszcz, XIII Commercial Division of the National Court Register, under number KRS 0001219274, NIP 5543043884, REGON 543878653, represented by the President of the Management Board, Paweł Bukowski, hereinafter referred to as the “Data Processor”.

This Data Processing Agreement forms an integral part of the Terms & conditions and binds the parties irrespective of its separate signature. It is effective as of 2026-10-31.

Section 1. Subject Matter and Purpose

1. The Data Controller entrusts the Data Processor with the processing of Personal Data in connection with the Data Controller’s use of the Contractors.es service, on the terms set out in this Agreement and in the Terms & conditions.
2. The Data Processor processes Personal Data solely to the extent and for the purposes necessary for the proper provision of the service.
3. This Agreement contains all the obligations arising under Article 28(1), (2), (3) and (4) GDPR.

Section 2. Nature and Purpose of Processing

1. The Data Processor processes Personal Data solely on the documented instructions of the Data Controller, including in respect of the transfer of data to sub-processors.
2. The Data Processor does not determine the purposes or means of processing on its own.
3. The Data Processor processes Personal Data for the purposes of providing the service, maintaining it, securing it, creating backups and providing technical support, and, in respect of the AI Features — for the purposes of implementing the features of the Service which use artificial intelligence models, in particular for text recognition in documents, materials matching, and pricing and inventory management, and, in respect of the Support Chat — for the purpose of providing technical support.
4. The Data Processor does not process Personal Data for the purpose of training models, nor for marketing or its own analytical purposes. Personal Data and processing results are not used by the Data Processor to create usage statistics.
5. The AI Features may be extended with further features of the Service. Neither the addition of an AI feature nor a change in the operation of an AI feature requires an amendment to this Agreement, provided that the data processed within the AI Features remains within the limits set out in clause 1, and provided that the purpose of processing, the AI sub-processor, the processing location and the basis for any transfer outside the European Economic Area remain unchanged. The Data Processor notifies the Controller of such a change in the manner customary for the Service. A change of the AI sub-processor is subject to clause 5.

Section 3. Scope of Processing

1. Subject of processing: Personal Data entered by the Data Controller or its Authorised Users into the Contractors.es service or passed in connection with the features of the Service, including in particular:
   1. data of employees, collaborators and sub-contractors: first and last names, addresses, e-mail addresses, telephone numbers, identification numbers, bank account numbers, remuneration information, licences and training, organisational affiliation, driving entitlements, working time records, location;
   2. data relating to periodic medical examinations: only information on fitness to work, without examination results — the data of these persons may not be transferred to the AI Features;
   3. data relating to the Data Controller’s clients, business partners and suppliers: identification, contact and commercial data;
   4. data relating to construction projects, including design documentation, contracts, invoices, acceptance protocols, site photographs and other documents and files entered by the Data Controller;
   5. data transferred for the purposes of the AI Features: the content of documents and files entered by the Data Controller, including documents submitted for text recognition, and the Data Controller’s commercial data, including price list and materials list items, solely to the extent necessary to carry out the processing instruction;
   6. data passed for the purposes of the Support Chat in the application: chat transcripts, data provided by the user in the chat form and technical data — IP address, device and browser data.
2. Categories of data subjects: employees, collaborators, sub-contractors, job applicants, clients, business partners, suppliers, third parties participating in the implementation of construction projects and persons visible in site photographs, and persons contacting technical support via the Support Chat in the application.
3. Special categories of data and data on criminal convictions and offences: The Data Processor processes exclusively the data referred to in clause 1 items 1–6. The Data Processor does not process special categories of data referred to in Article 9 GDPR, nor data on criminal convictions and offences referred to in Article 10 GDPR. The Data Controller should not transfer documents containing data of these categories to the AI Features. Support Chat is a free-text channel and is not subject to automatic content screening — the Data Controller should not disclose special category data or data on criminal convictions in a conversation.
4. Source of data: the Data Controller and the persons whose data is concerned. The Data Controller provides the Data Processor with instructions in written or electronic form, including through documented settings of the service.
5. Duration: for the period in which the Terms & conditions are in force, and in respect of backups — for the retention period specified in Section 9.
6. Frequency: continuous processing.

Section 4. Obligations of the Data Processor

The Data Processor undertakes that:

1. it processes Personal Data solely on the documented instructions of the Data Controller, including in respect of the transfer of data to sub-processors, except where the obligation to process follows from Union law or the law of a Member State; in such a case the Data Processor informs the Data Controller of that obligation before processing, unless the law prohibits the disclosure of information;
2. it immediately informs the Data Controller if, in its opinion, the instruction infringes the GDPR; in such a case the Data Processor may refuse to carry out the instruction until the matter is resolved;
3. it ensures that persons authorised to process Personal Data have undertaken to maintain confidentiality;
4. it applies the security measures described in Annex 2 to this Agreement, taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing, so as to ensure a level of security appropriate to the risk;
5. it complies with the conditions for sub-processing set out in Section 5;
6. taking into account the nature of the processing and the information available to the Data Processor, it assists the Data Controller in complying with the obligations laid down in Articles 32–36 GDPR. The assistance is provided in so far as possible, where necessary and upon written request of the Data Controller, in so far as the Data Processor has the relevant information at its disposal, and consists in particular in:
   1. making available information on the processing carried out by the Data Processor, including its nature, purposes and scope, the categories of personal data and of data subjects, and the sub-processors;
   2. making available the documentation of the security measures referred to in Annex 2 and information on the results of their review;
   3. making available information on the circumstances of the personal data breach referred to in Section 7, to the extent necessary for the Data Controller to draw up its notification to the supervisory authority or to the data subjects;
   4. providing technical support to the Data Controller in identifying the data processed by the Data Processor in response to data subject requests. The assistance does not include legal advice, the drawing up of data protection impact assessments or any other legal analysis, the assessment of the compliance of the Data Controller’s processing with the GDPR, the drafting of notifications to the data subjects or to the supervisory authority, or the representation of the Data Controller before the supervisory authority. The Data Controller remains responsible for drawing up the data protection impact assessment and for complying with the obligations laid down in Articles 32–36 GDPR.
7. in so far as possible, upon a written request of the Data Controller, it assists the Data Controller in responding to requests from a data subject, in so far as they relate to processing by the Data Processor, by making available to the Data Controller the data processed by the Data Processor which is necessary to respond to the request. Where obtaining the data requires the cooperation of a sub-processor, the Data Processor informs the Data Controller without undue delay upon becoming aware of the request, together with the expected date of the data being made available;
8. after the termination of the service, it deletes or returns Personal Data in accordance with Section 9;
9. it makes available to the Data Controller all information necessary to demonstrate compliance with the obligations under Article 28(3) GDPR and enables and participates in audits in accordance with Section 8;
10. it documents the processing carried out to the extent required and documents the security measures applied.

Section 5. Sub-processing

1. The Data Processor entrusts the processing of Personal Data to sub-processors solely to the extent necessary to deliver the service.
2. The Data Controller grants the Data Processor general written authorisation for sub-processing by the sub-processors listed in Annex 3 to this Agreement.
3. The list of sub-processors together with the location of processing and the basis for transferring data outside the European Economic Area constitutes the content of Annex 3.
4. The Data Processor informs the Data Controller of its intention to entrust processing to a new sub-processor at least 30 days before the entrustment, specifying the data to be processed, the scope of processing, the location and the basis for any transfer outside the European Economic Area.
5. The Data Controller may, within 30 days of receiving the information, raise a written objection. In such case the parties enter into negotiations in order to find a solution.
6. If accommodating the objection is not possible or the parties do not reach agreement through negotiations, the Data Processor makes the change of sub-processor described in the notice referred to in clause 4. Separation of Data Controllers between different sub-processors for the same function is not possible. The Data Controller may terminate this Agreement and the Terms & conditions with effect at the end of the current billing period; in the case of termination for this reason, Fees paid in advance are not subject to refund.
7. The Data Processor concludes with each sub-processor a contract imposing data protection obligations at a level no lower than that resulting from this Agreement, in particular an obligation of confidentiality, ensuring an appropriate level of security and deletion of the data after the processing ends.
8. The Data Processor remains liable to the Data Controller for the sub-processor’s compliance with data protection obligations.
9. In contracts with sub-processors the Data Processor includes the obligation not to use Personal Data for training models and the obligation not to use it for its own analytical and marketing purposes. The Data Processor disables the use of data for model training in the settings of its account with the AI sub-processor, maintains that disablement, and informs the Controller of any change in the sub-processor’s settings which could result in such use.

Section 6. Transfer of Personal Data Outside the European Economic Area

1. The European variant of the service envisages the storage and processing of Personal Data in the European Union. Transfer of Personal Data outside the European Economic Area in this variant occurs solely to the extent of: (i) access by the sub-processor storing the files — Akamai Technologies (Linode) — to the stored files from the territory of the United States and onward transfer of those files to the sub-processor’s sub-processors; (ii) processing of Support Chat data, referred to in clause 5; (iii) processing by sub-processors outside the European Economic Area through their own sub-processors. The bases for transfer, the identification of the sub-processors and their location are set out in Annex 3.
2. In the American variant, the transfer of Personal Data outside the European Economic Area is carried out on the basis of the European Commission’s standard contractual clauses adopted by Implementing Decision (EU) 2021/914, supplemented with a data protection impact assessment, or — in respect of a sub-processor certified under the EU-US Data Privacy Framework — on the basis of that framework, together with its UK and Swiss extensions. This basis, together with the identification of the sub-processor, is set out in Annex 3.
3. The AI Features of the application are provided in the European Union irrespective of the variant selected. No transfer of Personal Data to the model provider outside the European Economic Area takes place. The Data Controller does not transfer to the AI Features the data referred to in Section 3, clause 1, item 2, nor special categories of data, nor criminal-offence data.
4. The Data Processor assesses whether the laws of the country of import allow the obligations resulting from this Agreement to be performed and applies additional measures, if needed.
5. Irrespective of the processing variant, Support Chat data is passed to the sub-processor tawk.to, Inc. and processed in the United States, including using the sub-processor’s AI features (automatic translation, automatic first line of support). That transfer is carried out on the basis of the European Commission’s standard contractual clauses adopted by Implementing Decision (EU) 2021/914, supplemented with a data protection impact assessment. That sub-processor is a certified participant of the EU-US Data Privacy Framework, together with its UK and Swiss extensions, and is identified in Annex 3.

Section 7. Personal Data Breaches

1. The Data Processor informs the Data Controller of a personal data breach without undue delay, no later than 24 hours from detecting the breach.
2. The information contains:
   1. the nature of the breach, including the categories and approximate number of persons whose data is concerned, and the number of records;
   2. the contact details of the person or team responsible for the breach;
   3. a description of the likely consequences of the breach;
   4. a description of the measures taken or proposed in order to mitigate the effects and prevent further breaches.
3. If not all the information is available at the time of the notification, the Data Processor provides it in stages, as and when it obtains it.
4. The Data Processor takes all technical and organisational measures to mitigate the effects of the breach and prevent further breaches, and assists the Data Controller in complying with the obligation to notify the persons whose data is concerned and the supervisory authority, by making available the information referred to in clause 2 and by providing technical support. The Data Controller draws up and submits the notifications itself.
5. The Data Processor documents every breach, including those which do not require notification, together with an assessment of the risk to the rights and freedoms of the persons.
6. Notification of a breach by the Data Processor does not constitute an admission of fault or of liability.

Section 8. Audit

1. Documentary and remote verification. On a written request from the Data Controller, the Data Processor makes available, within 30 days of receiving the request, the information and documents necessary to demonstrate compliance with the obligations under Article 28(3) GDPR, including the documentation of the security measures referred to in Annex 2 and summaries of security test results. The Data Controller makes such a request no more frequently than once a year, in so far as this is reasonable and proportionate to the purpose of the verification, taking into account confidentiality, the Data Processor’s intellectual property rights and the rights and obligations of other Data Controllers and subprocessors. Where a personal data breach has been notified under Section 7 or there is a justified suspicion of a breach of the Data Processor’s obligations, the frequency and scope of the information made available are determined with the Data Processor on a case-by-case basis.
2. The Data Controller carries out the verification itself or mandates a third party indicated by it. The verification is carried out in the first instance in documentary and remote form, including by means of a video conference with the persons responsible for security and the protection of Personal Data. The Data Processor is entitled to propose a candidate to carry out the verification; the Data Controller may indicate another third party, provided that such third party is independent, has the appropriate technical expertise and is not affiliated with the Data Processor or its subprocessors. The Data Controller may contest the scope, methodology and results of the verification, and the Data Processor is entitled to raise justified objections as to the scope and methodology of the verification; the Data Controller shall consider the objections without undue delay.
3. On-site inspection. An on-site inspection at the Data Processor’s registered office may be carried out only where all of the following conditions are met:
   1. the documentary and remote verification did not allow the Data Controller to satisfactorily demonstrate compliance;
   2. the Data Controller has a justified suspicion of a material breach of the Data Processor’s obligations, notified in writing together with the reasons. The inspection shall take place at least 14 days’ notice, during the Data Processor’s business hours, without disrupting the operation of the service, in a room designated by the Data Processor, without access to the production infrastructure and to the systems in which the Personal Data of other Data Controllers is processed. The persons carrying out the inspection are bound by the confidentiality obligation, undertake to comply with the Data Processor’s security policy and not to record, photograph or copy any data beyond what is necessary for the purpose of the inspection. Given that the service is provided in the environments of the subprocessors listed in Annex 3, an on-site inspection does not cover production environments or devices used for the processing of Personal Data.
4. Costs of the verification. The costs of the verification, including the remuneration of the third party carrying it out, are borne by the Data Controller. Where the verification establishes a material breach of the Data Processor’s obligations, the Data Controller may require it to be remedied; the costs of the remedial actions are borne by the Data Processor, in so far as this does not affect the provisions of clause 10(6) of this Agreement. The Data Processor does not bear the costs of the verification. The results of the verification do not constitute an independent basis for determining the Data Processor’s liability; liability is determined by the provisions of law and clause 10 of this Agreement.
5. The Data Processor provides the Data Controller with summaries of the results of penetration testing and security reviews referred to in Annex 2, as well as the documented incident response procedure. Where the Data Processor obtains a certification under an approved certification mechanism within the meaning of Article 42 GDPR, it shall notify the Data Controller of this, and the Data Controller may demonstrate compliance with the obligations under Article 28(3) GDPR in the manner provided for in Article 28(5) GDPR.

Section 9. Term, Deletion and Return of Data

1. This Agreement is in force for the period in which the Terms & conditions are in force.
2. After the termination of the service, the Data Processor deletes or returns Personal Data within 30 days, except:
   1. backups, which are deleted in a retention cycle not exceeding 12 months;
   2. data whose storage is required by law, in particular tax and accounting legislation, to the extent and for the period resulting from that legislation;
   3. data processed as part of the AI Features at the model provider, which is deleted without delay after the processing ends, taking into account the retention period specified by that provider;
   4. data processed as part of the Support Chat at the sub-processor tawk.to, which is deleted on our instruction, taking into account the retention period specified by that sub-processor; that sub-processor’s backups are deleted within a retention cycle of no longer than 90 days.
3. The Data Processor informs the Data Controller of the completion of the deletion within 15 days of the deletion, on request.
4. Personal Data referred to in clause 2 item 1 is not made available during that period for purposes other than disaster recovery, nor processed beyond the extent necessary for recovery.

Section 10. Liability

1. The Data Controller is responsible for the compliance of the data transferred with the law, for holding a legal basis for its processing and for informing the persons whose data is concerned, including persons contacting technical support via the Support Chat in the application.
2. The Data Controller is liable for damage caused to the Data Processor as a result of transferring data that infringes the law.
3. The Data Processor is liable for damage resulting from a breach of personal data protection legislation to the extent resulting from Article 82(2) GDPR, that is, where it has failed to comply with the obligations under Article 28(1) and (3) GDPR or has acted outside the documented instruction or contrary to it.
4. The Data Processor is released from liability only in the cases provided for in Article 82(3) GDPR, that is, where it demonstrates that it is in no way responsible for the event which led to the damage.
5. Liability under Article 82 GDPR is not subject to contractual limitation. This Agreement contains no provisions limiting that liability.
6. The Data Processor is liable to the Data Controller for breach of the obligations arising from this Agreement, subject to the liability limits set out in the Terms & conditions, in so far as those limits do not apply to liability under Article 82 GDPR.

Section 11. Final Provisions

1. This Agreement is independent of the Terms & conditions in so far as it concerns the processing of Personal Data. In the event of any inconsistency, this Agreement shall prevail.
2. The Data Controller declares that where it processes Personal Data of which it is not itself the controller, it holds written consent or other authority under Article 28(2) GDPR authorising the Data Processor to sub-process on the basis of this Agreement.
3. The Data Processor does not assume information obligations towards third parties whose controller is the Data Controller.
4. Matters not regulated by this Agreement shall be governed by the GDPR and the provisions of Polish law. Disputes shall be resolved by the court having jurisdiction by reason of the registered office of the Data Processor.
5. The Agreement is concluded in electronic form. Clicking the acceptance button constitutes a declaration of conclusion of the agreement in electronic form within the meaning of Article 60(1) of the Civil Code and satisfies the requirements of Article 28(3) GDPR. The Data Controller retains confirmation of acceptance for the period in which the Agreement is in force and for 5 years after its expiry.

Annex 1 — Description of Processing

Annex 2 — Security Measures

The Data Processor applies the following technical and organisational measures, taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing:

1. Encryption in transit — all traffic between the Data Controller, its Authorised Users and the sub-processors is carried out using the TLS protocol, including for access via API.
2. Data storage — we store Personal Data in the environments provided by the sub-processors listed in Annex 3, in spaces separated for each Data Controller.
3. Access control — access based on the principle of least privilege, with role-based control, periodic review of permissions and an access register for personnel with elevated privileges.
4. Authentication — mandatory multi-factor authentication for personnel having access to systems.
5. Event logging — logging of data access, data changes and administrative events, with a limited retention period for entries.
6. Backups — regular creation of backups of the Data together with periodic testing of their restorability.
7. Recruitment and training — verification of the reliability of personnel, training on data protection and an undertaking to maintain confidentiality.
8. Incident management — a documented incident response procedure, with classification, escalation, communication and post-event analysis.
9. Security testing — periodic vulnerability testing and security reviews.
10. Sub-processor management — risk assessment before granting a sub-processor access, documented processing agreements and periodic review of permissions.
11. Security awareness — cyclical personnel training, including on responsibility for Personal Data.
12. Support Chat channel — access to the account of the sub-processor operating the chat limited to authorised persons, transmission to the sub-processor encrypted with the TLS protocol, the sub-processor’s contractual obligation not to use conversation data to train its own models, and periodic review of account permissions.
13. AI sub-processor account — disablement of the use of data for model training in the settings of the account with the AI sub-processor, maintenance of that disablement, and periodic review of the sub-processor’s settings for changes affecting model training.

Annex 3 — List of Sub-processors

The current list of sub-processors, together with their contact details, scope of processing, location and the basis for transferring data outside the European Economic Area, is published on the Website at https://contractors.es/en/subprocessors/ and constitutes Annex 3 to this Agreement. The list is updated in accordance with Section 5.