assign2meAssign to mePLSign up

Documents

Data processing agreement (DPA)

The same agreement an organization administrator accepts in the app before inviting the first guest. It is an annex to the Terms of service.

Version 1.0 · effective from 1 October 2026

This is an English translation provided for convenience. The Polish version is legally binding.

§ 1. Parties and subject matter

  1. This data processing agreement (the “DPA”) is concluded between the Customer that has concluded an agreement with the Provider for the assign2me service (the Customer's details are in the PDF version downloaded in the app) (the “Controller”) and Michał Madera, conducting business under the name MADERA Michał Madera, Niechobrz 609, 36-047 Niechobrz, Poland, entered in the Central Registration and Information on Business (CEIDG), NIP (tax ID) 813-316-43-54, REGON 691747301 (the “Processor”).
  2. The DPA implements Article 28(3) of Regulation (EU) 2016/679 (GDPR). It is an annex to the assign2me Terms of service (the “Terms”) and binds the parties from the conclusion of the agreement for the assign2me service (the “Service”). Capitalized terms have the meaning given to them in the Terms and in the GDPR.
  3. Before the first Guest is invited, the Organization Administrator confirms acceptance of the DPA in the Service. The Service records the DPA version, the date and the person who accepted it, and makes the DPA with the Organization's details available as a PDF.

§ 2. Scope, nature and purpose of processing

  1. The Processor processes personal data solely to provide the Service: it stores and organizes the data, makes it available to Users according to the permissions set by the Controller, sends notifications, passes data to integrations enabled by the Controller or Users, and makes backups.
  2. Categories of data subjects: Members, Guests and people whose data Users put into the Organization, in particular employees and contractors of the Controller's clients.
  3. Types of data: Users' first and last name, email address, language and time zone; the content of tasks, comments and files; change history and event log; technical data such as IP address and time of sign-in.
  4. The Controller should not put special categories of data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR) into the Service. If it does, it is responsible for having a legal basis.
  5. Processing lasts for the term of the agreement for the Service and for the time needed to return and delete the data under § 8.

§ 3. Obligations of the Processor

  1. The Processor processes data only on documented instructions from the Controller. The instructions are the Terms, the DPA, and the settings and actions performed in the Service by the Controller and Users. The Processor informs the Controller without delay if, in its opinion, an instruction infringes data protection law.
  2. The Processor does not use the data for its own purposes, including training artificial intelligence models, and does not sell it.
  3. Only persons authorized by the Processor who need access to provide the Service have access to the data, and they are bound by confidentiality.
  4. The Processor applies the technical and organizational measures referred to in Article 32 GDPR, described in Annex 2.
  5. The Processor helps the Controller respond to requests from data subjects, primarily through features of the Service: data export, correcting and deleting content, removing Guests from projects and deleting the Organization. A request sent directly to the Processor is forwarded to the Controller without undue delay.
  6. The Processor helps the Controller comply with Articles 32–36 GDPR, taking into account the nature of processing and the information available to it.

§ 4. Subprocessors

  1. The Controller gives general authorization for the Processor to engage subprocessors. The current list is in Annex 1 and at assign2me.com/dpa.
  2. The Processor informs the Organization Administrators by email at least 14 days before adding or replacing a subprocessor. During that time the Controller may raise a reasoned objection. If the parties do not find a solution, the Controller may terminate the agreement with immediate effect and receives a refund of the fee for the unused part of the Billing Period.
  3. The Processor imposes on each subprocessor data protection obligations no less protective than those in the DPA and remains liable to the Controller for their performance.

§ 5. Transfers outside the EEA

  1. The Service's data is stored in the European Economic Area.
  2. Data is transferred to a third country, including access by a subprocessor based outside the EEA, only with the safeguards of Chapter V GDPR, in particular on the basis of an adequacy decision or standard contractual clauses.

§ 6. Personal data breaches

  1. After becoming aware of a personal data breach, the Processor notifies the Controller without undue delay and no later than within 48 hours, by email to the Organization Administrators.
  2. The notification contains the information referred to in Article 33(3) GDPR to the extent available. The Processor provides the remaining information without delay once it has it.

§ 7. Audits

  1. The Processor makes available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR, first in the form of written answers and documentation.
  2. If that information is not sufficient, the Controller or an auditor it appoints who is bound by confidentiality may carry out an audit announced at least 30 days in advance, no more than once every 12 months unless a personal data breach has occurred. An audit may not disrupt the Service or breach the confidentiality of other customers' data. The Controller bears the costs of the audit.

§ 8. Return and deletion of data

  1. After the agreement for the Service ends, the Organization stays available in read-only mode for 60 days, and the Organization Administrator can download its data (CSV and JSON files and attachments).
  2. After that period the Processor deletes the Organization's data, and deletes it from backups in their normal rotation cycle, unless the law requires further retention.
  3. The Organization Administrator may download the data and delete the Organization in the Service earlier.

§ 9. Liability

  1. The parties' liability under the DPA is subject to the limitations in the Terms, to the extent permitted by mandatory provisions of law.

§ 10. Final provisions

  1. In matters of personal data protection the DPA takes precedence over the Terms.
  2. The DPA may be amended in the way provided for amending the Terms. Each version has a number and an effective date. A new version must be accepted by the Organization Administrator before the next Guest is invited.
  3. Matters not covered are governed by Polish law, in particular the GDPR. The Polish version of the DPA is binding.

Annex 1. Subprocessors

  1. Render Services, Inc. – hosting of the application, database and sign-in; EU (Frankfurt, Germany).
  2. Cloudflare, Inc. (R2) – storage of attachments; EU (EU jurisdiction).
  3. Resend (Plus Five Five, Inc.) – delivery of email notifications; EU (Ireland).
  4. Functional Software, Inc. (Sentry) – application error monitoring; EU (Germany).

Annex 2. Technical and organizational measures

  1. Encrypted connections (TLS) between the browser, the application and external services.
  2. Encryption at rest by the hosting and file storage providers; integration credentials additionally encrypted in the application.
  3. Separation of each Organization's data: every query in the application is limited to the Organization the User belongs to.
  4. Access control by role and project visibility; a Guest has access only to the tasks assigned or shared with them.
  5. Sign-in through an identity server (Keycloak) with passwords stored as hashes; Guests sign in with a one-time link valid for 30 minutes.
  6. Change history of every task and the Organization's event log, with entries that cannot be edited.
  7. Database backups with a recovery point objective of at most 1 hour (RPO) and a recovery time objective of 4 hours (RTO).
  8. Processor staff access production data only to the extent necessary, with two-factor authentication for providers' consoles.
  9. Storage of the Service's data in the European Economic Area.