Terms & Conditions

‍Introduction

HeroCoders (“We”, “Us”, the “Company”, or “ HeroCoders ”) is committed to protecting and respecting your privacy. We want to tell You how we use and protect your personal information or data (“Personal Data”). This includes informing You of your rights regarding your Personal Data that we hold.

We believe that the General Data Protection Regulation (GDPR) is an important step forward in the protection of your Personal Data, and we have published this Privacy Policy in order to be compliant with the GDPR. We are committed to GDPR compliance across our Company and provide GDPR related assurances in this Privacy Policy. In addition to this, we will also take into account other data protection legislation that may apply to us, most notably, the California Consumer Privacy Act of 2018. Please refer to the dedicated sections of this Privacy Policy to know more about your rights under the California privacy law.

This Privacy Policy (the “Policy”) covers the information we collect about you when you use our products or services, including all of our SaaS/Cloud software products and our downloadable software products (collectively, the “Apps”) and all public websites (“Website(s)”) provided and/or maintained by HeroCoders, or otherwise interact with us (for example, by contacting us through email, the support portal or applying for a job). We refer to all of these products, Apps, and Websites, together with our other services as “Services” in this Policy. Depending on the context, “You” means the end-user of our products or the legal entity who is the licensee of our products, or the visitor of our public websites. 

If you do not agree with this policy, do not access or use our Services or interact with any other aspect of our business.

Who is HeroCoders?

This is HeroCoders’ registered address and contact information:

HeroCoders sp. z o.o.

Zosi 16

Gdansk 80-119

Poland

E-Mail: support@herocoders.com

Notice to End Users

Many of our Services are intended for use by organizations. Where the Services are made available to You through an organization (e.g., your employer), that organization is the administrator of the Services and acts as a data controller of your Personal Data, while Herocoders process it on their behalf as a data processor. If this is the case, please direct your data privacy questions to your administrator, as your use of the Services is subject to that organization’s policies.

Administrators are able to:

• restrict your access to the Services and therefore restrict your ability to edit, modify or delete your Personal Data; and
• access, modify and remove the information about You.

Even if the Services are not currently administered or made available to You by an organization, if You use an email address provided by an organization (such as your work email address) to access the Services, then the owner of the domain associated with your email address (e.g. your employer) may assert administrative control over your account and your use of the Services at a later date.

If You do not want an administrator to be able to assert control over your account and your use of the Services, please use your personal email address to register for or access the Services.

Please contact your organization or refer to your administrator’s organizational policies for more information.

Information We May Collect From You

As a data controller, We may process your Personal Data only if we have identified a specific purpose and a legal basis to do so. In other cases, We may process your Personal Data acting as a data processor on behalf of our customers and solely for the purposes of providing our Services to them. 

Information You Give Us

You may give us information about You, for example:

1. By filling in a form or sending us an e-mail.
2. By contacting us via e-mail or some other medium to request service or support (e.g., the support portal or Intercom).
3. Applying for a job at HeroCoders.
4. Installing and using our Apps.

Email and support portal

When You contact us via e-mail or for service through the support portal, we will collect your name, your email address, and any other information You choose to provide. 

HeroCoders Job Portal

We may also receive and process Your personal data when You access the webpage https://herocoders.breezy.hr and decide to apply for a job opportunity that We´ve posted by clicking on a job posting on https://www.herocoders.com/careers. You may apply to us by sending your information to jobs@herocoders.com. In such a case, We may process Your name, email, address, phone number, as well as any details You decide to add to Your CV and the cover letter.

Social Media

We may receive certain information about You when you interact with our social media accounts.  

Information We Automatically Collect About You / Website

If You visit our Website, we may automatically collect information about You, for example:

1. Technical information;
2. IP addresses;
3. Information about what type of device You use to connect to our Website or Services; and
4. The manner in which You interact with our Services.

Any data or information that is entered into any form on our Services is only used for the indicated purposes or as described in the present Privacy Policy.

Information We Collect About You / Apps

When using our Apps, We may process certain information about You. This information is made accessible to Herocoders since our Apps need to work together with the host products such as Jira from Atlassian,Microsoft Teams from Microsoft and monday.com from monday.com Ltd.

The scope of the personal data processed and other details of the respective data processing activities can be different and depend on the specific App that You choose to use. To make things more comprehensive for You, We provide more details about this in a separate table available at https://herocoders.com/terms#Personal-Data-Access.

Please also note that We are not always directly responsible for the processing of Your information via Apps. You may need to contact the  company that has subscribed to our Services if you wish  to exercise the control over Your personal information.

‍

Information Received From the Partner Platforms

As part of Our Services, We have access to the contact information (e.g., your name, phone number and email address) and license information (e.g., number of licenses, term of the license, etc.) You provide when You subscribe to a license for any of Our Services or when You renew maintenance for Our Services on the Partner Platform.

Why Does HeroCoders Collect Your Data?

HeroCoders may process your data for some or all of the following reasons:

• To allow us to enhance and personalize your experience and the usability of the Services;
• To provide support services (including technical support) to You after You have requested or purchased such services;
• To send You information and updates pertaining to our Services if You have consented to receive such communications;
• To send You occasional company news, updates, related products and Services, promotions, special offers or service information pertaining to our products and Services if You have consented or requested to receive such communications. You may choose to opt-out of certain e-mail communication at any time by utilizing the “unsubscribe” feature in the e-mail message;
• To provide information about Services You have shown interest in purchasing within a reasonable time afterwards, if You are already an existing HeroCoders customer;
• For any other specific purpose for which you have specifically provided consent;
• To employ You or consider You for employment; or
• To diagnose problems with our Services;
• To enhance and otherwise modify our Services;
• For Herocoders administrative, support and training purposes;
• To develop other products and services, provided we de-identify your data; and
• To provide Services to You under contract.

What Legal Basis Does HeroCoders Have For Processing Your Personal Data?

As a data controller, HeroCoders may process your information because:

• You have given us permission to do so (GDPR Art. 6.1.(a));
• We have a contract with You (GDPR Art. 6.1(b));
• It is necessary in order to comply with a legal obligation to which we are subject (GDPR Art. 6.1. (c));
• It is necessary for the purposes of the legitimate interests pursued by us or by other parties (Art. 6.1. (f)).

Where Herocoders acts as a data processor, We will process your Personal Data on behalf of our customers. 

Who Might HeroCoders Share Your Information With?

HeroCoders will share the information we have collected about You (including your Personal Data) only if we are required to do so by law, or if:

• Herocoders engages certain service providers (as detailed below) to process information to support our business and our Services; 
• a third party acquires HeroCoders or substantially all of its assets, Personal Data held by HeroCoders about its customers will be one of the transferred assets of the company;
• HeroCoders must comply with any legal obligation; or
• it is necessary in order to protect the rights, property, or safety of HeroCoders, our customers or others.

Additional information about the service providers we use to support delivery of our services and other activities is set forth at https://www.herocoders.com/terms#Data-Processing-Agreement. Regardless of whether you use our Services, whenever You interact with the content on our social media channels (e.g. Twitter, LinkedIn), be aware that Your personal data may be shared with social media management software. 

In case your Personal Data is provided to service providers outside the EEA (European Economic Area), We will implement appropriate safeguards to protect your Personal Data, including Standard Contractual Clauses as adopted by the European Commission. Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA. 

We reserve the right, consistent with data privacy and other user data protection requirements applicable to the jurisdiction where data is stored, and if mandated by applicable law, regulation, legal process, or governmental order, disclose user data or other information, but only to the extent required to satisfy those laws, regulations, or orders. Unless prohibited by law or other order, we will provide reasonable notice of any such required or requested disclosure to you and reasonably cooperate to limit such disclosure to the extent allowed by law.

Data Storage

How Long Do We Store Your Data

We store data for varying lengths of time depending on the circumstances:

• Information You share on the Services is stored until the end- user, who modified or created the text (or any other authorized user), deletes that text and all related information.
• If Your account is deactivated, terminated, or disabled, all data and content You have provided or that has been provided on or through your account will remain active and accessible for as long as necessary to allow Your team members or other users to make full use of the Services.
• After uninstalling the App, We store data for ninety (90) days to make sure it is there if you want to renew your subscription and start using the Service again. If you want us to remove the data earlier, please follow the procedure provided below.

Downloadable Apps

Our downloaded Apps store all information in the Atlassian Jira on-premise  product where they are installed. All data is located in your IT system (server or data center) that hosts the Atlassian Jira -  on-premise product.

No information stored on the installation IT system is made available to Us when You download, install, or use the Apps. The Apps do not transmit data from your IT system or from the end-user’s web browser to us or to any third-party.

Information Received From the Partner Platforms

The contact and license Information We collect about our customers (i.e. company information and contact information of the contact persons) is stored in our databases forever. 

SaaS/Cloud Apps

SaaS/Cloud Apps, (e.g. Issue Checklist, To-do Checklist for Team) are hosted by HeroCoders. In that case, we may store the information or data provided by you on our secured servers, but we currently utilize a third-party to provide this service. With SaaS/Cloud Apps, we have access to user information as provided in this Privacy Policy, which may include data regarding how and when the Apps are utilized.

In case of SaaS/Cloud Apps, Your personal data may be stored for varying lengths of time depending on the specific product or Services You use. Specifically, We undertake to remove Your personal information:

• Issue Checklist Apps - 90 days after the end user has uninstalled the App;
• Clockwork Apps - 30 days after the end user has uninstalled the App;
• Checklist for Jira Apps - until Checklist Definitions are deleted from the account by the user
• Backlog Pro for Jira -  No Personal Data is Stored
• Epics Map for Jira -  No Personal Data is stored
• To-do Checklist for MS Teams -  No Personal Data is stored

Email / Support portal / Job portal

When You contact us via email or through our support portal, we will only store Your personal information for as long as needed to fulfill the purpose of its initial collection. For example, the information contained in your customer request will only be processed until your request is fulfilled. 

When You apply for a job position at our https://herocoders.breezy.hr webpage, we will store your file for no longer than 24 months after it was collected in case another position fitting for You opens up. After this period, the information provided by You will be deleted.

Website

In case of your Personal Data that may be collected via our Website, we will store the data as long as it is necessary for the purposes it was collected.

Data About You We Store or Transfer

In the case of SaaS/Cloud Apps, We primarily store and process the data or information you provide in the United States of America, it being understood that we do not store any of your Personal Data. Furthermore, in the case of SaaS/Cloud Apps, your Personal Data will never be transferred, out of the host application (Jira) and browser, to us or to any other third-party. For these services, we store only the contact information of the administrator who has installed the app in our CRM system in order to send product-related emails and notifications to them.

However, in the case of downloadable Apps, the information will be stored on Your systems and servers, wherever Your systems and servers are located.

We will use our best efforts to ensure your Personal Data is only processed or utilized, as identified in this Privacy Policy, inside the United States of America. If your Personal Data cannot be processed within the United States of America, we will comply with applicable law and use our best efforts to protect your Personal Data.

What If You Choose Not To Give Us Your Personal Data?

If the Personal Data is necessary in order to supply products or services to You under a contract between You and HeroCoders, then we will not enter into that contract or provide the services or goods if You do not give us Your Personal Data.

Your Rights

HeroCoders will respect your legal rights to your data.

As a processor of Personal Data, we will assist our customers and end users with responding to individual rights requests that they receive under the GDPR. In many cases, customers may be able to address these types of requests by logging into the applicable product and using settings available within such product or your account. Where this is not possible, please contact us to request assistance with any such individual rights requests.

Below are the Legal rights that You have under law, and what HeroCoders does to protect those rights:

The right to be informed

HeroCoders is publishing this Privacy Policy to keep You informed as to what we do with your Personal Data. We strive to be transparent about how we use your data.

The right to access

You have the right to access your information. Our Services give you the ability to access and update or delete certain information about you from within the Service. For example, you can access Jira issue and checklist items stored for that issue and then update or remove checklist items that hold Your information. In certain cases, you may need to contact the administrator of your account or your company’s account. Please contact HeroCoders at support@herocoders.com if have any questions or You wish to access the Personal Data HeroCoders holds about you.

The right to rectification

If the information HeroCoders holds about You is inaccurate or not complete, You have the right to ask us to rectify it. If that data has been passed to a third party with your consent or for legal reasons, then we must also ask them to rectify the data. Please contact Us at support@herocoders.com if You need us to rectify your information.

The right to erasure

This is sometimes called ‘the right to be forgotten’. If You want HeroCoders to erase all your Personal Data and we do not have a legal reason to continue to process and hold it, please contact Us at support@herocoders.com.

The right to restrict processing

You have the right to ask HeroCoders to restrict how we process your data. This means We are permitted to store the data but not further process it. We keep just enough data to make sure we respect your request in the future. If You want Us to restrict processing of your data, please contact Us at support@herocoders.com.

The right to object

You have the right to object to HeroCoders processing your data even if it is based on Our legitimate interests, the exercise of official authority, direct marketing (including data aggregation), and processing for the purpose of statistics. If You wish to object please contact Us at support@herocoders.com.

The right to withdraw consent

If You have given Us your consent to process your data but change your mind later, You have the right to withdraw your consent at any time, and HeroCoders must stop processing your data. If You want to withdraw your consent, please contact Us at support@herocoders.com.

The right to complain to a Supervisory Authority

You have the right to lodge a complaint with a competent Data Protection Authority, in particular the one in the EEA country of your habitual residence or place of work if You feel that HeroCoders has not responded to your requests to solve a problem.

Your rights under the laws of California

In case You are a resident of California, You are entitled to certain rights over your personal data under the California Consumer Privacy Act of 2018. Specifically, as a resident of California, You have the right to:

• know about the categories and specific pieces of personal data that we have collected about You and access a copy of your personal data (“Right to Know”);
• have inaccurate personal data about You corrected (“Right to Correction”);
• request deletion of your personal data that we have collected (“Right to Deletion”);
• opt out of the sale of your personal data (“Right to Opt-Out”). Please note that we don’t sell personal data to any third parties. 

Please note that we may ask you and/or your agent to provide certain information to verify your and/or your agent’s identity and authorization before fulfilling the request. The information We request will depend on your prior interactions with us.

We undertake to treat You like everyone else and not discriminate against You if You choose to exercise your rights. To submit the request to exercise your rights, You can send an email to support@herocoders.com or contact the administrator of your account or your company’s account.

Data Security

Data provided through the support portal are securely stored on our Atlassian Jira Cloud instance herocoders.atlassian.net hosted and maintained by Atlassian.

All of the data related to our Products and Apps is stored on servers with restricted access and only HeroCoders’ authorized users have access to such data, to the extent required for the performance of their job duties. All staff with access to customer data are required to sign a non-disclosure agreement and complete security and privacy awareness training. In addition, We will take reasonable precautions to prevent the loss, misuse or alteration of your Personal Data. Data transmission over the Internet is inherently insecure and we cannot guarantee the security of data sent over the Internet.

You are responsible for keeping your passwords confidential. We will not ask You for your passwords.

We assume no responsibility for the deletion of data, loss of data, the corruption of data or the failure to store data. Neither do we have any obligation to monitor the use of the data transmitted or stored through Our Services.

All data you enter into Our Services shall be owned solely by you. Although personal information, usernames, passwords and prompts exchanged through the Our Services are protected by encryption techniques, these security measures still require your responsible behavior in protecting your data. You shall assume the entire responsibility at all times for the supervision, management, control and confidentiality of your data and assume the entire risk for the fraudulent or unauthorized use of your data. You represent and warrant that you have obtained all the necessary rights, releases, authorizations and permissions to provide your data to us, to the transfer and use of your data by Herocoders. You further warrant that the transfer of your data to us does not violate any laws, third party rights, including any Intellectual Property Rights, rights of privacy, or rights of publicity, and any use, collection and disclosure of your data as authorized under this Policy is not inconsistent with the terms of any applicable privacy policies. You acknowledge and agree that Herocoders are not responsible for any deletion, corruption, failure to store or loss of any your data if such deletion, corruption, failure to store or loss is due to an act or omission by you, your employee(s), contractor(s), agent(s), any authorized user or other third party.

Cookies

What Are Cookies?

Cookies are small files which are stored on a user’s computer. They are designed to hold a modest amount of data specific to a particular client and website. This allows the server to deliver a page tailored to a particular user, or the page itself can contain some script which is aware of the data in the cookie and so is able to carry information from one visit to the website (or related site) to the next.

Cookies in our Services

We use cookies in some of our Apps and our Website as detailed below.

Website

Our Website uses cookies to store some information about the way visitors use the website. We may store the information about cookies for up to 2 years after your last visit to our Website.

Epics Map

We use Google Analytics to understand how the users of our App use and engage with it.

Other cookies

We do not use cookies in our Services directly. However, the Atlassian Connect framework and JIRA use cookies in the authentication and authorization process, which are sent to Our servers. These cookies are then employed to secure communication and match the request to customer and end-user data that we store.

Enabling and Disabling Cookies

We can place cookies on your device by default if they are strictly necessary for the use of Services. For all other types of cookies, we need your consent.

Unless you choose otherwise, we can store and process only those cookies that are necessary for the operation of our Services. If you don’t want to be tracked by other types of cookies, you can refuse to give your initial consent or opt out later. 

You can check the specific types of cookies in the pop-up window shown during your first visit on the Website. 

You may refuse the use of cookies in our Apps by selecting the appropriate settings on your browser, however, please note that if You do this You may not be able to use the full functionality of the Website or Services.

View your browser’s help pages or information on how to manage cookies at https://allaboutcookies.org.

Links to Other Websites

From time to time, the Website or Services may contain links to and from other websites, advertisers, and affiliates. If You follow a link to any of these websites, please note that these websites may have their own privacy notices and that We do not accept any responsibility or liability for any such notices. Please check these notices, where available, before You submit any Personal Data to these websites.

Data Protection Officer (DPO)

HeroCoders’ Data Protection Officer contact information:

Paweł Maliszewski

HeroCoders sp. z o.o.

Zosi 16

Gdansk 80-119

Poland

E-Mail: dpo@herocoders.com

Changes to Our Privacy Policy

HeroCoders may change this Policy from time to time in the future. Any such changes will be posted here and, where appropriate, notified to You in writing. We advise You to check back frequently to see any updates or changes.

‍

Definitions

The following notations are used for showing the type of personal data used or accessed by our Apps:

U: (Users) → Access to User’s data

C: (Customers) → Access to Customer’s data

O: (Others) → Access to data of someone else or access under certain conditions

The difference between U and C: a company may have 1000 employees but introduce two specific persons as its contact persons. Access to the personal data of those 2 specific people is shown by C while access to the personal data of all 1000 employees is shown by U.

Letters in parentheses:

• N: No Access
• A: Access (but not used)
• A+: Access used
• P: Processed (i.e. sent to the server)
• S: Stored

These categories are inclusive, so only one category must be listed in the table below (S contains P, P contains A+, and A+ contains A).

For every product, when a user contacts our customer support portal, some of their personal data is stored in our support portal:

‍

And for each product:

Definitions

The following notations are used for showing the type of personal data used or accessed by our Apps:

U: (Users) → Access to User’s data

C: (Customers) → Access to Customer’s data

O: (Others) → Access to data of someone else or access under certain conditions

The difference between U and C: a company may have 1000 employees but introduce two specific persons as its contact persons. Access to the personal data of those 2 specific people is shown by C while access to the personal data of all 1000 employees is shown by U.

This Data Processing Agreement (the “Agreement”) is attached to the Herocoders’ Terms of Service available at https://www.herocoders.com/terms (the “Master Agreement”) between HeroCoders (the “Processor”) and the party that has accepted the Master Agreement (the “Controller”).

‍

BACKGROUND

1. (A) The Parties entered into the Master Agreement. 
2. (B) Due to the scope and subject-matter of the Master Agreement, it is necessary for the Processor to Process the Personal Data on behalf of the Controller.
3. (C) This Agreement sets out the additional terms, requirements and conditions on which the Processor shall Process the Personal Data on behalf of the Controller under the Master Agreement. This Agreement contains the mandatory clauses required by Article 28(3) GDPR for contracts between data controllers and data processors.

1. (D) The date of execution of the Master Agreement shall constitute the date of execution of this Agreement.

‍

AGREED Master Agreement

1. Definitions and interpretation

1.1 The Parties acknowledge that, as per definitions in the Data Protection Legislation, the Controller is a controller and the Processor is a processor, unless otherwise explicitly stated in the Agreement. 

1.2 Where the Agreement uses terms that are defined in the Master Agreement, the terms shall have the same meaning as in the Master Agreement.

1.3 The terms used in this Agreement have the following meaning:

1. “Data Protection Legislation” means all privacy and data protection laws applicable to the Processing, including the GDPR and any applicable national implementing laws, regulations and secondary legislation relating to the Processing of the Personal Data and the privacy of electronic communications, as updated, amended or replaced from time to time.
2. “Data Subject” means an individual who is a subject of the Personal Data.
3. “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and its national implementing laws, including, but not limited to, the UK GDPR as defined in section 3 of the UK Data Protection Act 2018.
4. “Personal Data” means any information relating to an identified or identifiable natural person that is Processed by the Processor as specified herein; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as name, identification number, location data, online identifier, or to one or more factors specific to the physical, the physiological, genetic, mental, economic, cultural or social identity of that natural person.
5. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, the Personal Data transmitted, stored or otherwise Processed. 
6. “Processing”, “Processes”, “Process” and “Processed” mean either any activity that involves the use of Personal Data or as the Data Protection Legislation may otherwise define “processing”, “processes”, “process” or “processed”. The Master Agreement includes any operation or set of operations performed on the Personal Data or on sets of the Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, as well as transferring the Personal Data to third parties.
7. “Regulation (EU) 2018/1725” means Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC.
8. “SCCs” means the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

1.4 Any reference to “writing” or “written” includes faxes, email and electronic messaging services.

2. The Personal Data types and the Processing purposes

2.1 The Controller retains control of the Personal Data and remains responsible for its compliance obligations under the applicable Data Protection Legislation, including providing any required notices and obtaining any required consent for the Processing instructions it gives to the Processor.

2.2 Subject-matter and nature of the Processing: 

The performance of the services to the Controller under the Master Agreement.

The nature of the Processing activities implies the set of operations, such as collection, recording, organisation, structuring, usage, storage, erasure or destruction of data. 

2.3 Duration of the Processing: the term of the Master Agreement unless otherwise agreed by the Parties.

2.4 The categories of Data Subjects (as determined and controlled by the Data Controller) may include: employees, consultants and contractors of the Controller.

2.5 The categories of Personal Data subject to the Processing may include: name, cookie identifiers, IP address, email address, username, social media profile ID/links and any other information provided by the Controller and the Data Subjects. 

2.6 Security measures: as indicated in the Processor´s Security Statement.

2.7 Subprocessors involved: the list of Subprocessors are available at https://herocoders.com/terms#Subprocessors.

‍

3. The Processor’s obligations

3.1 The Processor shall only Process the Personal Data in accordance with the Controller’s written instructions specified herein. The Processor shall not Process the Personal Data for any other purpose or in a way that does not comply with this Agreement or the Data Protection Legislation. The Processor shall promptly notify the Controller if, in the Processor’s opinion, the Controller’s instructions would not comply with the Data Protection Legislation.

3.2 The Processor shall promptly comply with any of the Controller’s requests or instructions requiring the Processor to amend, transfer, delete or otherwise Process the Personal Data, or to stop, mitigate or remedy any unauthorised Processing.

3.3 The Processor shall maintain the confidentiality of all the Personal Data and shall not disclose the Personal Data to third parties, unless the Controller or this Agreement specifically authorises the disclosure, or as required by law. If a law, court, regulator or supervisory authority requires the Processor to Process or disclose the Personal Data, the Processor shall first inform the Controller of the legal or regulatory requirement and give the Controller an opportunity to object or challenge the requirement, unless the law prohibits such notice.

3.4 The Processor shall reasonably assist the Controller with meeting the Controller’s compliance obligations under the Data Protection Legislation, taking into account the nature of the Processor’s Processing and the information available to the Processor, including in relation to the Data Subject’s rights, data protection impact assessments and reporting to and consulting with the supervisory authorities under the Data Protection Legislation.

3.5 The Processor shall promptly notify the Controller of any changes to the Data Protection Legislation that may adversely affect the Processor’s performance of the Master Agreement. 

3.6 The Processor shall ensure that all its employees with access to the Personal Data:

• are informed of the confidential nature of the Personal Data and are bound by confidentiality obligations and use restrictions in respect of the Personal Data;
• have undertaken training on the Data Protection Legislation relating to handling the Personal Data and how it applies to their particular duties; and
• are aware of both the Processor’s obligations and their personal obligations under the Data Protection Legislation and this Agreement.

3.7 The Processor shall take reasonable steps to ensure the reliability, integrity and trustworthiness of the employees with access to the Personal Data and conduct their background checks consistent with applicable law.

4. Security

4.1 The Processor shall at all times implement appropriate technical and organisational measures against the unauthorised or unlawful Processing, access, disclosure, copying, modification, storage, reproduction, display or distribution of the Personal Data, and against accidental or unlawful loss, destruction, alteration, disclosure or damage of the Personal Data.

4.2 The Processor shall implement such measures in accordance with Article 32 GDPR to ensure a level of security appropriate to the risk involved.

4.3 The Controller hereby confirms that technical and organisational measures specified herein are sufficient and appropriate under the Data Protection Legislation and this Agreement.

5. The Personal Data Breach

5.1 The Processor shall promptly and without undue delay notify the Controller if any Personal Data is lost or destroyed, or becomes damaged, corrupted, or unusable. The Processor shall restore such Personal Data at its own expense.

5.2 The Processor shall immediately and without undue delay notify the Controller if the Processor becomes aware of:

• any accidental, unauthorised or unlawful Processing of the Personal Data; or
• any Personal Data Breach.

5.3 Where the Processor becomes aware of (a) and/or (b) of Clause 5.2 hereof, the Processor shall, without undue delay, also provide the Controller with the following information:

• description of the causes and nature of (a) and/or (b) of Clause 5.2 hereof, including the categories and approximate number of both the Data Subjects and the Personal Data records concerned;
• the likely consequences; and
• description of the measures taken or proposed to be taken to address (a) and/or (b) of Clause 5.2 hereof, including measures to mitigate the possible adverse effects.

5.4 Immediately, following any unauthorised or unlawful Processing of the Personal Data or the Personal Data Breach, the Parties shall coordinate with each other to investigate the matter. The Processor shall reasonably cooperate with the Controller in the Controller’s handling of the matter, including:

• assisting with any investigation; 
• providing the Controller with physical access to any facilities and operations affected;
• facilitating interviews with the Processor’s employees, former employees and others involved in the matter; 
• making available all relevant records, logs, files, data reporting and other materials required to comply with all the Data Protection Legislation or as otherwise reasonably required by the Controller; and 
• taking reasonable and prompt steps to mitigate the effects and to minimise any damage resulting from the Personal Data Breach or the unlawful Processing of the Personal Data. 

5.5 The Processor shall not inform any third party of any Personal Data Breach without first obtaining the Controller’s prior written consent, except when required to do so by law. 

5.6 The Processor agrees that the Controller has the sole right to determine:

• whether to provide a notice of the Personal Data Breach to any Data Subjects, supervisory authorities, regulators, law enforcement agencies or others, as required by law or regulation or in the Controller’s discretion, including the contents and delivery method of the notice; and
• whether to offer any type of a remedy to the affected Data Subjects, including the nature and extent of such remedy.

5.7 The Processor shall cover all reasonable expenses associated with the performance of the obligations under Clauses 5.2 and 5.4 hereof, unless the matter arose from the Controller’s specific instructions, negligence, wilful default or breach of this Agreement, in which case the Controller shall cover all reasonable expenses. 

6. Cross-border transfers of the Personal Data

6.1 The Controller hereby authorises the Processor to transfer or otherwise Process the Personal Data outside the European Economic Area (the “EEA”) subject to conditions laid down in this Agreement. 

6.2 The Processor may only Process, or permit the Processing of, the Personal Data outside the EEA under one of the following conditions:

• the Processor Processes the Personal Data in a territory which is subject to a current finding by the European Commission under the Data Protection Legislation that the territory provides adequate protection for the privacy rights of individuals.
• the Processor takes, where appropriate, one of the safeguards specified by the Data Protection Legislation, notably by Article 46 GDPR.

6.3 If any Personal Data transfer between the Controller and the Processor requires the execution of the SCCs in order to comply with the Data Protection Legislation, the Parties shall complete all relevant details and take all other actions required to legitimise the transfer.

7. Subprocessors

7.1 The Processor may not authorise a third party (subprocessor) to Process the Personal Data, unless all of the following conditions are met:

• the Controller has given a specific or general written authorisation to the engagement of the subprocessor(s);
• the Processor shall enter into a written agreement with each of the authorised subprocessors, which shall contain terms substantially the same as those set out in this Agreement, in particular, in relation to requiring appropriate technical and organisational data security measures;
• at the Controller’s request, the Processor shall provide to the Controller a copy of such an agreement with the subprocessor and any subsequent amendments. To the extent necessary to protect a business secret or other confidential information, including Personal Data, the Processor may redact the text of the agreement prior to sharing the copy;
• the Processor shall maintain control over all the Personal Data it entrusts to the subprocessor(s).

7.2 The Controller hereby gives a general authorisation to involve subprocessors to Process the Personal Data under this Agreement. In case the Processor intends to update the list of subprocessors engaged, the Processor shall inform the Controller in advance and provide the Controller with the information necessary to enable the Controller to exercise the right to object.

7.3 Where the subprocessor fails to fulfil its obligations under a such written agreement, the Processor remains fully liable to the Controller for the subprocessor’s performance of its obligations. 

7.4 Where the Processor fails to fulfil its guarantees under Clause 7.1 hereof, the Processor shall indemnify all of the Controller’s arising direct and indirect damages.

8. Complaints, the Data Subjects requests and third-party rights

8.1 The Processor shall, at no additional cost, take such technical and organisational measures as may be appropriate and promptly provide such information to the Controller, as the Controller may reasonably require, to enable the Controller to comply with:

• the rights of the Data Subjects under the Data Protection Legislation, including the Data Subjects’ access rights, the rights to rectify and erase the Personal Data, object to the Processing and automated Processing of the Personal Data, and restrict the Processing of the Personal Data; and 
• information or assessment notices served on the Controller by any supervisory authority under the Data Protection Legislation. 

8.2 The Processor shall notify the Controller immediately and without undue delay if the Processor receives any complaint, notice or communication that relates directly or indirectly to the Processing of the Personal Data or to either Party’s compliance with the Data Protection Legislation.

8.3 The Processor shall notify the Controller immediately and without undue delay when the Processor receives a request from a Data Subject for access to their Personal Data or to exercise any of their related rights under the Data Protection Legislation.

8.4 The Processor shall provide the Controller with the Processor’s full cooperation and assistance in responding to any complaint, notice, communication or the Data Subject’s request in connection with the Personal Data Processed. 

8.5 The Processor shall not disclose the Personal Data to any Data Subject or to a third party other than at the Controller’s request or instructions, as provided for in this Agreement or as required by law.

9. Term

This Agreement shall remain in full force and effect so long as:

• the Master Agreement remains in effect, or 
• the Processor retains any Personal Data related to the Master Agreement in the Processor’s possession or control (the “Term”).

10. Non-compliance with the Agreement and termination

10.1 Without prejudice to any provisions of the GDPR and/or the Regulation (EU) 2018/1725, in the event that the Processor is in breach of its obligations under this Agreement, the Controller may instruct the Processor to suspend the Processing of the Personal Data until the Processor complies with its obligations under this Agreement or the Agreement is terminated.

10.2 The Controller shall be entitled to terminate the Agreement if:

• the Processing of the Personal Data by the Processor has been suspended by the Controller pursuant to Clause 10.1 hereof and if compliance with the obligations under this Agreement is not restored within a reasonable time and in no event later than within 1 (one) month following suspension;
• the Processor is in substantial or persistent breach of its obligations under this Agreement or its obligations under the GDPR and/or the Regulation (EU) 2018/1725;
• the Processor fails to comply with a binding decision of a competent court or a competent supervisory authority regarding its obligations pursuant to this Agreement or the GDPR and/or the Regulation (EU) 2018/1725.

10.3 The Processor shall be entitled to terminate the Agreement where, after having informed the Controller that the Controller’s instructions infringe applicable legal requirements in accordance with Clause 3.1 hereof, the Controller insists on compliance with the instructions.

10.4 Any provision of this Agreement, which expressly or by implication should come into or continue in force on or after termination of the Master Agreement in order to protect the Personal Data, shall remain in full force and effect.

10.5 If a change in any Data Protection Legislation prevents either Party from fulfilling all or part of its Master Agreement obligations, the Parties shall suspend the Processing of the Personal Data until that Processing complies with the new requirements. If the Parties are unable to bring the Processing of the Personal Data into compliance with the Data Protection Legislation within 2 (two) months, a Party may terminate the Master Agreement on written notice to the other Party.

11. Data return and destruction

11.1 At the Controller’s request, the Processor shall give the Controller a copy of or access to all or part of the Controller’s Personal Data in the Processor’s possession or control in the format and on the media reasonably specified by the Controller.

11.2 Upon termination of the Master Agreement for any reason or expiry of its term, the Processor shall securely delete or destroy or, if directed in writing by the Controller, return and not retain all or any Personal Data related to this Agreement in the Processor’s possession or control. 

11.3 If any law, regulation or governmental or regulatory body requires the Processor to retain any documents or materials that the Processor would otherwise be required to return or destroy, the Processor shall notify the Controller in writing of that retention requirement, giving details of the documents or materials that the Processor shall retain, the legal basis for retention, and establishing a specific timeline for destruction once the retention requirement ends.

11.4 Upon the request from the Controller, the Processor shall certify in writing that the Processor has destroyed the Personal Data.

12. Audit

12. 1 If the Controller is required to show its compliance with the Data Protection Legislation, or the Controller reasonably believes that a Personal Data Breach occurred or is occurring, or the Processor is in breach of any of its obligations under this Agreement or any Data Protection Legislation, the Processor shall permit an assigned and eligible third-party representative of the Controller to audit the Processor’s compliance with its obligations under this Agreement on at least 15 (fifteen) days’ notice during the Term. The Processor shall give the third-party representative of the Controller all necessary assistance reasonably required to conduct such audits. The assistance may include, but is not limited to: 

• physical access to, remote electronic access to any information held at the Processor’s premises or on systems storing the Personal Data;
• access to and meetings with any of the Processor’s personnel reasonably necessary to provide all explanations and perform the audit effectively; and
• necessary inspection of all infrastructure, electronic data or systems, facilities, equipment or application software used to store, Process or transfer the Personal Data. 

12.2 If a Personal Data Breach occurred or is occurring, or the Processor becomes aware of a breach of any of its obligations under this Agreement or any Data Protection Legislation, the Processor shall:

• promptly conduct its own audit to determine the cause; 
• produce a written report that includes a detailed plan to remedy any deficiencies identified by the audit; 
• provide the Controller with a copy of the written audit report; and 
• promptly remedy any deficiencies identified by the audit.

12.3 The Processor shall promptly address any exceptions noted in the audit reports with the development and implementation of a corrective action plan by the Processor’s management.

12.4 The Controller shall cover all reasonable expenses incurred by the Processor in connection with performing its obligations under Clause 12.1 hereof.

13. Governing law

This Agreement shall be governed by, construed and interpreted in accordance with the laws of Poland.

‍

‍