Data Processing Agreement

§ 1. Parties to the Agreement

This Data Processing Agreement (hereinafter: the “Agreement” or “DPA”) is concluded between:

1. The Data Controller: the User of the BetterCX Platform who has registered an account and accepted the Platform’s Terms of Service (hereinafter: the “Controller” or the “User”),
2. The Data Processor: AppWave Sp. z o.o. with its registered office in Łódź, ul. Kolumny 147E/1, 93-611 Łódź, KRS: 0001193213, NIP: 9820394623, REGON: 542683999 (hereinafter: the “Processor” or “AppWave”).

This Agreement constitutes an integral part of the BetterCX Platform Terms of Service and enters into force upon the creation of an account on the Platform by the Controller.

§ 2. Definitions

The terms used in this Agreement shall have the meanings assigned to them in Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the BetterCX Platform Terms of Service and the Platform Privacy Policy. In addition:

• Personal Data – personal data of End Users (the Controller’s customers) processed through the Platform;
• End User – a natural person whose data is processed as part of the communication conducted by the Controller through the Platform;
• Platform – the BetterCX application available at https://app.bettercx.ai/;
• Sub-processor (further data processor) – a third party to whom the Processor entrusts the processing of Personal Data for the purpose of providing the Platform’s services;
• Data Breach – a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

§ 3. Subject Matter and Scope of the Agreement

1. The Controller entrusts the Processor with the processing of End Users’ Personal Data in connection with the use of the BetterCX Platform, under the conditions set out in this Agreement.
2. The Processor shall process Personal Data solely on behalf of the Controller and in accordance with the Controller’s documented instructions, unless processing is required under European Union law or the law of the Member State to which the Processor is subject.
3. A detailed description of the processing is set out in Appendix 1 to this Agreement.

§ 4. Duration of the Agreement

1. The Agreement shall remain in force for the entire period during which the Controller uses the BetterCX Platform.
2. The Agreement shall expire upon the deletion of the Controller’s account on the Platform, subject to the obligations regarding the deletion or return of data set out in § 12.

§ 5. Obligations of the Processor

The Processor undertakes to:

1. process Personal Data solely within the scope and for the purpose specified by the Controller, in accordance with this Agreement, the Platform Terms of Service and the Controller’s documented instructions;
2. ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
3. implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR;
4. comply with the conditions for engaging a further data processor (sub-processor) set out in § 7;
5. taking into account the nature of the processing, assist the Controller, insofar as possible, in fulfilling the obligation to respond to requests by data subjects for the exercise of their rights as set out in Chapter III of the GDPR;
6. taking into account the nature of the processing and the information available, assist the Controller in fulfilling the obligations set out in Articles 32–36 of the GDPR;
7. upon termination of the provision of services, at the Controller’s choice, delete or return all Personal Data and delete existing copies, unless European Union law or the law of a Member State requires the retention of the data;
8. make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits and inspections in accordance with § 9.

§ 6. Technical and Organisational Measures

1. The Processor applies the following technical and organisational measures to protect Personal Data:
   • encryption of data in transit (TLS 1.2+) and at rest;
   • storage of data on Amazon Web Services (AWS) servers located within the European Economic Area (EEA);
   • access control based on the principle of least privilege;
   • hashing of user passwords;
   • regular security reviews and log monitoring;
   • security incident response procedures;
   • regular data backups performed at least every 7 days;
   • multi-factor authentication (MFA) for administrative access to data processing systems.
2. The Processor regularly tests, assesses and evaluates the effectiveness of technical and organisational measures for ensuring the security of processing.
3. A detailed list of technical and organisational measures is set out in Appendix 2 to this Agreement.

§ 7. Further Entrustment of Processing (Sub-processors)

1. The Controller grants general authorisation for the Processor to engage the further data processors (sub-processors) listed in Appendix 3 to this Agreement.
2. The Processor shall inform the Controller of any intended changes regarding the addition or replacement of sub-processors with at least 14 days’ notice, by publishing an updated list of sub-processors on the Platform’s website and sending a notification to the Controller’s email address.
3. The Controller has the right to raise a reasoned objection to a new sub-processor within 14 days of receiving the notification. In the event of an objection, the Parties shall negotiate to find a solution. If no solution is reached within 30 days, the Controller has the right to terminate the Platform usage agreement.
4. The Processor shall ensure that each sub-processor is bound by data protection obligations at least equivalent to those set out in this Agreement, in accordance with Article 28(4) of the GDPR.
5. The Processor shall bear full liability toward the Controller for the acts and omissions of sub-processors.

§ 8. Data Processing Using Artificial Intelligence

1. In the course of providing the Platform’s services, the Processor uses artificial intelligence models provided by OpenAI, L.L.C. (hereinafter: “OpenAI”) via the API interface, for the purpose of text analysis and response generation.
2. Personal Data may be transmitted to OpenAI solely to the extent necessary for the Platform functionalities configured by the Controller.
3. According to OpenAI’s declarations regarding the API platform:
   • OpenAI does not use data submitted via the API to train its models (by default);
   • input and output data is retained in OpenAI’s logs for a period of up to 30 days for the purpose of abuse monitoring;
   • data is encrypted at rest (AES-256) and in transit (TLS 1.2+);
   • OpenAI is a certified participant in the EU-US Data Privacy Framework.
4. The Processor shall make best efforts to ensure that the processing of data by OpenAI complies with the requirements of the GDPR, including by concluding an appropriate agreement (Data Processing Addendum) with OpenAI.
5. The Controller acknowledges that the use of the Platform involves the transfer of Personal Data to OpenAI as a sub-processor, which includes the transfer of data to the United States on the basis of the mechanisms described in § 10.

§ 9. Audits and Inspections

1. The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations arising from Article 28 of the GDPR.
2. The Controller or a Controller-appointed auditor shall have the right to carry out an audit of compliance with this Agreement no more than once per calendar year, subject to 30 days’ prior notice.
3. The audit shall be carried out at the Controller’s expense, in a manner that does not cause undue disruption to the Processor’s operations.
4. The Processor may, instead of allowing an on-site audit, provide the Controller with current security certificates, reports from audits carried out by independent third parties (e.g. SOC 2) or other documents confirming compliance.

§ 10. Transfer of Data to Third Countries

1. Personal Data is stored on AWS servers located within the EEA.
2. In connection with the use of OpenAI and Stripe services, Personal Data may be transferred to the United States. Such transfers are carried out on the basis of:
   • the European Commission’s implementing decision (EU) 2023/1795 (EU-US Data Privacy Framework) – with respect to certified entities;
   • Standard Contractual Clauses (SCC) approved by the European Commission.
3. The Processor shall ensure that transfers of data to third countries are carried out solely in accordance with the safeguards provided for in Chapter V of the GDPR.

§ 11. Personal Data Breach

1. The Processor shall notify the Controller of a Personal Data Breach without undue delay, and no later than within 48 hours of becoming aware of the breach.
2. The notification shall contain at a minimum:
   • a description of the nature of the breach, including the categories and approximate number of data subjects affected;
   • the name and contact details of the person from whom more information can be obtained;
   • a description of the likely consequences of the breach;
   • a description of the measures taken or proposed to remedy the breach.
3. The Processor shall assist the Controller in fulfilling the obligations under Articles 33 and 34 of the GDPR (notification of the breach to the supervisory authority and communication to the data subjects).
4. The Processor shall document all Data Breaches, including the circumstances, effects and remedial actions taken.

§ 12. Deletion and Return of Personal Data

1. Upon termination of the provision of services (deletion of the account on the Platform), the Processor shall – at the Controller’s choice – delete or return all Personal Data to the Controller and delete existing copies, unless European Union law or the law of a Member State requires the retention of such data.
2. In the absence of the Controller’s instructions, the Processor shall delete the Personal Data within 30 days of the account deletion.
3. The Controller may submit a request for export of Personal Data prior to account deletion. The Processor shall make the data available in a commonly used format (e.g. CSV, JSON) within 14 days of receiving the request.
4. Deletion of data from OpenAI’s logs shall take place in accordance with OpenAI’s retention policy (up to 30 days from the time of processing).

§ 13. Liability

1. The Processor shall be liable for damage caused by processing that is not in compliance with this Agreement or the GDPR, on the terms set out in Article 82 of the GDPR.
2. The Processor’s liability shall be limited to damage arising directly from the failure to perform the obligations imposed on it by the GDPR or this Agreement, and in any event shall not exceed PLN 20,000.

§ 14. Obligations of the Controller

The Controller undertakes to:

1. have a valid legal basis for the processing of End Users’ Personal Data;
2. fulfil the information obligation towards End Users in accordance with Article 13 or 14 of the GDPR, including informing them of the use of an AI system in communication;
3. configure the AI system in a manner consistent with the principle of data minimisation (Article 5(1)(c) of the GDPR);
4. refrain from processing special categories of personal data (Article 9 of the GDPR) through the Platform, unless in possession of a valid legal basis and having obtained the explicit consent of the data subjects;
5. provide the Processor solely with documented, lawful instructions regarding processing;
6. promptly inform the Processor of any requests from End Users relating to their rights under the GDPR.

§ 15. Final Provisions

1. In matters not regulated by this Agreement, the provisions of the GDPR and Polish law shall apply.
2. Any disputes arising from this Agreement shall be settled by the court having jurisdiction over the Processor’s registered office.
3. Amendments to this Agreement shall require documentary form to be valid. The Processor may amend the Agreement with 14 days’ notice, informing the Controller by electronic means.
4. This Agreement has been drawn up in the Polish language. In the event of any discrepancy with a version in another language, the Polish version shall prevail.