Personal Data Processing Entrustment Terms

§ 1. General provisions

  1. These personal data processing entrustment terms (the “Processing Terms”) set out the rules and conditions for entrusting the processing of personal data saved by the User in the Account and transferred to the Processor for the purpose of using the Services in performance of the Agreement.
  2. In matters not regulated by the Processing Terms, the provisions of the Terms of Use of the “ShopReturns” Service (the “Terms of Use of the Service”) shall apply.
  3. Any capitalised terms not otherwise defined in the Processing Terms shall have the meanings assigned to them in the Terms of Use of the Service.
  4. The Processing Terms constitute a standard form of the agreement referred to in Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the “GDPR”).

§ 2. Entrustment of personal data processing

  1. The User (also referred to as the “Controller”) entrusts the Service Provider (also referred to as the “Processor”) with the processing of personal data pursuant to Article 28 of the GDPR, to the extent specified in § 3 of the Processing Terms.
  2. The Controller represents that:
  3. it is the controller of the personal data entrusted to the Processor under the Processing Terms;
  4. it collects and processes the personal data entrusted to the Processor in accordance with the GDPR and other generally applicable laws.
  5. The Processor undertakes to process personal data to the extent and on the terms set out in the Processing Terms, the GDPR and other generally applicable laws.
  6. The Processor shall perform the services specified in the Processing Terms as part of the remuneration specified in the Terms of Use of the Service and in the Price List.

§ 3. Subject matter, nature, purpose and duration of processing

  1. The personal data entrusted by the Controller shall be processed by the Processor solely on documented instructions from the Controller and solely for the purpose of performing the Services specified in the Terms of Use of the Service. In particular, the conclusion by the Controller of an agreement for the provision of a Service (also referred to as the “Main Agreement”) shall be deemed a “documented instruction”.
  2. The Controller entrusts the Processor with the processing of the following categories of personal data (the “entrusted personal data”):
  3. personal data of the User’s employees and contractors: first name, surname, position, experience, qualifications, skills, department, gender, email address and telephone number;
  4. personal data of the User’s customers/contractors/business partners: business name (first name and surname), correspondence address, KRS number, NIP number, REGON number, email address and telephone number.
  5. Due to the nature of the Controller’s business, the entrusted data may include special categories of data referred to in Article 9 of the GDPR or personal data relating to criminal convictions and offences referred to in Article 10 of the GDPR.
  6. The entrusted personal data shall be processed using IT systems (by automated means).

§ 4. Obligations, rights and representations of the Processor

  1. The Processor undertakes to secure the entrusted personal data by implementing, before commencing processing, and maintaining technical and organisational measures appropriate to the nature, scope, context and purpose of the processing of the entrusted data, including measures required by applicable generally binding laws, so that the processing of the entrusted personal data meets the requirements of the GDPR.
  2. The Processor undertakes to ensure that persons authorised to process personal data entrusted under the Processing Terms have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
  3. To the extent justified by the subject matter of the Main Agreement, the Processor undertakes, insofar as possible, to assist the Controller in fulfilling its obligation to respond to requests from data subjects exercising their rights under generally applicable laws, including Chapter III of the GDPR.
  4. The Processor undertakes to notify the Controller without undue delay of:
  5. any breach of the security of the entrusted personal data, where a “breach of the security of the entrusted data” means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, the entrusted personal data. The notification referred to in this point 1 shall be made no later than within 24 hours of detecting the breach of the security of the entrusted data;
  6. any request received from a person whose data it processes, while refraining from responding to the request until it receives the Controller’s opinion. The notification referred to in this point 2 shall be made no later than within 24 hours of receiving the request;
  7. any legally valid request to disclose personal data to a competent state authority, unless notification is prohibited by law, in particular by criminal procedure laws, where such prohibition is intended to preserve the confidentiality of an investigation;
  8. an inspection of the compliance of personal data processing conducted by the President of the Personal Data Protection Office or another supervisory authority, the results of such inspection, and other actions by public authorities concerning the data.
  9. To the extent justified by the subject matter of the Main Agreement and the information available to it, the Processor undertakes to assist the Controller in fulfilling its obligations under generally applicable laws, including Articles 32–36 of the General Data Protection Regulation, concerning the security of personal data processing, notification of a personal data breach to the supervisory authority and to the data subject, data protection impact assessments and related consultations with the supervisory authority.
  10. The Processor undertakes to:
  11. provide the Controller, within 14 days of receiving a request, with all information and documents necessary to demonstrate the Controller’s compliance with its obligations under generally applicable laws;
  12. allow for and contribute to audits, including inspections, conducted by the Controller or an auditor authorised by the Controller, on terms agreed by the parties in each case and subject to the provisions of this section.
  13. The audit referred to in paragraph 6 point 2 above may be conducted:
  14. no earlier than 14 days after the Processor receives notice of the audit, on a date agreed by the Parties; and
  15. after a confidentiality agreement has been concluded between the Processor and the Controller or the auditor authorised by the Controller.
  16. Following completion of the audit, the Parties shall prepare an audit report in two counterparts, to be signed by the authorised representatives of both Parties. The Processor may submit comments on the audit report within five business days of the date on which it is signed by the representatives of the Parties.
  17. If the audit reveals deficiencies affecting the security of the processing of the entrusted personal data, the Processor undertakes to comply with the recommendations made by the Controller or the auditor authorised by the Controller.

§ 5. Obligations of the Controller

  1. The Controller shall ensure that, throughout the term of the Main Agreement, it has a legal basis for processing the entrusted personal data and holds the appropriate rights authorising it to entrust such data to the Processor. If the Controller loses the above-mentioned legal basis or rights in relation to particular entrusted personal data, it shall immediately take the steps necessary to cease entrusting such data, in particular by notifying the Processor.
  2. The Controller undertakes not to issue instructions to the Processor concerning the processing of the entrusted personal data that would be contrary to generally applicable laws, the Processing Terms or other contractual obligations.

§ 6. Sub-processing of personal data

  1. The Controller grants its general authorisation for the Processor to engage subcontractors selected by the Processor to further process personal data (the “sub-processing”).
  2. The list of subcontractors to which the Processor has entrusted further processing of personal data is held by the Processor and may be provided to the Controller upon request.
  3. The Processor undertakes to ensure that:
  4. an entity to which it entrusts further processing applies appropriate technical and organisational measures to ensure that the entrusted personal data is processed in accordance with the GDPR;
  5. the scope of the further processor’s data protection obligations corresponds to the Processor’s obligations provided for in the Processing Agreement.
  6. If the Processor intends to entrust the processing of personal data to a particular subcontractor, it shall notify the Controller by email no later than seven (7) days before the sub-processing takes place. The Controller may object to the sub-processing referred to in the preceding sentence by submitting an objection by email within seven (7) days of receiving the sub-processing notice.
  7. If the period for submitting an objection referred to in paragraph 4 above expires without an objection being submitted, the Processor may entrust the processing of personal data to the selected subcontractor.
  8. If the objection referred to in paragraph 4 above is submitted, the Processor may withdraw from the Main Agreement with immediate effect.
  9. The sub-processing referred to in paragraph 4 above shall not constitute an amendment to the Processing Terms.

§ 7. Term of the Processing Terms

The provisions of the Processing Terms shall apply for the term of the Main Agreement.

§ 8. Consequences of termination of the Main Agreement

Upon termination of the Main Agreement, the Processor undertakes, without undue delay and no later than within 14 business days of the date of termination of the Main Agreement, to return to the Controller and delete from its own storage media all personal data entrusted to it for processing, including by effectively deleting such data from electronic storage media under its control. The preceding sentence shall not apply to personal data that the Processor is required to retain for a period longer than the term of the Main Agreement under generally applicable laws.

§ 9. Liability

If either party to the Main Agreement breaches the provisions of the Processing Terms, the GDPR or other generally applicable laws and the other party suffers damage as a result, the party responsible for the breach shall be obliged to compensate only for actual loss and shall not be liable for any loss of profit suffered by the other party as a result of the breach.

§ 10. Amendments to the Processing Terms

The provisions of the Terms of Use of the Service shall apply accordingly to amendments to the Processing Terms.

§ 11. Final provisions

The current version of the Processing Terms applies from 1 July 2025.