This Data Processing Agreement may form an annex to an individual Varilo Service Agreement or may be accepted electronically together with the Terms of Service. For the purposes of entrusted data, “Controller” means the Varilo Customer and “Processor” means the Varilo Service Provider.
- Vesta Usługi i Szkolenia Marcin Makowskiul. Wrzosowa 33, 84-300 Lębork, PolandNIP (Polish tax ID): 841-161-18-09e-mail: kontakt@varilo.euWebsite: varilo.pl
§ 1. Subject matter and roles of the Parties
The Controller entrusts Vesta Usługi i Szkolenia Marcin Makowski with the processing of personal data to the extent necessary to provide the Varilo platform.
The processing is entrusted pursuant to Article 28 GDPR. The Processor processes personal data only on behalf of the Controller and on its documented instructions, unless processing is required by European Union law or the law of a Member State to which the Processor is subject.
Configuration of the Account, creation of Checklists, granting of permissions and other actions of the Controller within the Service constitute documented processing instructions within the scope resulting from Varilo functionality.
§ 2. Duration, nature and purpose of processing
Processing continues for the period during which the Service is provided and for the time necessary to perform obligations relating to its termination, deletion or return of data.
Processing is automated and may include collection, recording, organisation, storage, retrieval, modification, disclosure to authorised users, generation of reports, creation of backups, restriction, export and deletion of data.
The purpose of processing is to enable the Controller to use Varilo, in particular to create and complete Checklists and Inspections, create reports and statistics, manage access, document non-conformities and store data related to those processes.
§ 3. Categories of data subjects and types of data
The data may concern in particular:
- employees, associates and persons acting on behalf of the Controller;
- employees of contractors, subcontractors, suppliers and business partners;
- drivers, operators and users of machinery, equipment, vehicles or facilities;
- persons performing Inspections;
- customers, visitors and other persons whose data the Controller decides to lawfully process in Varilo.
The scope of data may include in particular:
- name and surname, e-mail address, user identifier, position, department or organisational unit;
- answers provided in Checklists, date and time of an Inspection, comments, information on actions and non-conformities;
- photographs, attachments and other files entered by the Controller or persons acting on its behalf;
- identifiers of equipment, machinery, vehicles, facilities and locations linked to a natural person where the Controller configures the process in that manner;
- other data entered by the Controller into form fields.
Varilo does not require processing of special categories of personal data for its standard operation. If the Controller decides to process such data, the Controller is responsible for having an appropriate legal basis, assessing necessity and implementing suitable safeguards.
§ 4. Obligations of the Controller
The Controller is responsible for the lawfulness of collection and processing, determination of purposes and legal bases, scope of data, content of Checklists and fulfilment of information obligations towards data subjects.
The Controller undertakes not to issue the Processor with instructions contrary to the GDPR or other data protection legislation.
The Controller is responsible for granting and revoking permissions to its Users and for selecting the access configuration for Checklists shared via QR, NFC or link.
§ 5. Obligations of the Processor
- process personal data only on documented instructions of the Controller and to the extent necessary to provide the Service;
- ensure that persons authorised to process personal data are bound by confidentiality;
- implement appropriate technical and organisational measures in accordance with Article 32 GDPR;
- taking into account the nature of processing, assist the Controller where possible in fulfilling data subject rights;
- assist the Controller, taking into account the nature of processing and information available, in complying with obligations under Articles 32-36 GDPR;
- after the end of the Service, at the Controller’s choice, delete or return personal data unless law requires continued storage;
- make available to the Controller information necessary to demonstrate compliance with Article 28 GDPR.
§ 6. Security of processing
The Processor maintains security measures appropriate to the risk, nature of the data and operation of the Service. They include at least, to the extent applicable to the relevant part of the system:
- protection of data transmission using current connection-encryption mechanisms;
- access control for Accounts and administrative functions and the principle of least privilege;
- protection of authentication data and restriction of administrative access to persons who need it;
- updates of software and infrastructure components under Varilo’s control;
- mechanisms supporting availability and data recovery and use of safeguards offered by the infrastructure provider;
- incident and personal-data-breach response procedures;
- periodic assessment of the adequacy of safeguards used.
The Controller acknowledges that security of the Service also depends on proper protection of accounts, devices and processes on the Controller’s side.
§ 7. Sub-processing
The Controller grants the Processor general authorisation to use sub-processors necessary to provide Varilo.
The Processor shall ensure that a sub-processor is subject to data-protection obligations appropriate to the entrusted activities, in accordance with Article 28(4) GDPR.
The Processor remains responsible to the Controller for performance of obligations by the sub-processor to the extent required by the GDPR.
In the event of a planned material change involving addition or replacement of a sub-processor, Varilo will inform the Controller, as a rule at least 14 days in advance, by e-mail or through the Service, allowing the Controller to raise a reasoned objection relating to data protection.
§ 8. Current sub-processor
Current information about sub-processors may be obtained at kontakt@varilo.eu.
| Entity | Scope | Data | Location / transfer |
|---|---|---|---|
| Name.com | hosting and infrastructure used to operate Varilo and store data | account data, technical data and Customer Content stored as part of the Service | data may be processed outside the EEA, including in the USA, in accordance with Name.com service terms and DPA |
§ 9. Transfers outside the EEA
The Controller acknowledges that, in connection with the use of Name.com infrastructure, entrusted data may be transferred outside the European Economic Area, including to the United States.
The Processor ensures that any transfer outside the EEA will be carried out only in a manner permitted under Chapter V GDPR, using an appropriate transfer mechanism and, where required, appropriate safeguards.
At the Controller’s request, the Processor will provide available information concerning the transfer mechanism used and relevant safeguards, taking into account the rights and trade secrets of providers.
§ 10. Rights of data subjects
If the Processor directly receives a request from a person relating to data for which the Customer is controller, the Processor will not independently decide on that request unless authorised to do so or required by law.
The Processor will forward the request to the Controller without undue delay and, taking into account the nature of processing, provide reasonable assistance in fulfilling the request through functions available in the Service or other technically available measures.
§ 11. Personal data breaches
After becoming aware of a personal data breach affecting entrusted data, the Processor will notify the Controller without undue delay.
To the extent available, the Processor will provide information allowing the Controller to assess the breach and meet its obligations under Articles 33 and 34 GDPR, in particular a description of the nature of the breach, possible consequences and measures taken or proposed to mitigate its effects.
Where full information cannot be provided at the same time, it may be supplemented in stages without undue delay.
§ 12. Audits and demonstration of compliance
The Processor will make available to the Controller information necessary to demonstrate compliance with Article 28 GDPR.
The Controller may carry out an audit to a reasonable extent, subject to prior written notice, in a manner that does not unduly disrupt Varilo operations or disclose data or confidential information of other Customers.
The Parties will first use a documentary or remote audit. An on-site audit may be carried out where there is a justified need that cannot reasonably be met in another manner.
Audit costs are borne by the Controller unless the audit establishes a material breach of the Processor’s obligations.
§ 13. Deletion or return of data
After termination of the Service, the Controller may request return of data to the extent supported by technically available export functions, or request deletion.
After the instruction has been performed, the data are deleted from active systems unless applicable law requires further retention.
Data may remain in backup copies until overwritten in the normal backup rotation. Until then they remain subject to confidentiality and security obligations and are not used for other purposes.
§ 14. Liability
Each Party is responsible for compliance with obligations imposed directly on that Party by the GDPR.
The Controller is responsible in particular for the lawfulness of processing purposes and legal bases, the scope of entrusted data, the content of instructions and fulfilment of information obligations.
Liability limitations contained in the main Agreement apply to the extent permitted by the GDPR and other mandatory law.
§ 15. Term and final provisions
This DPA remains in force for as long as the Processor processes personal data on behalf of the Controller.
Confidentiality and data-security obligations continue after the end of cooperation in respect of data not yet deleted in accordance with this DPA.
This DPA may be concluded electronically, including by acceptance together with the Varilo Terms of Service.
Matters not regulated herein are governed by the GDPR and applicable Polish and European Union law.
In the event of conflict between this DPA and another contractual document, this DPA prevails with respect to protection of entrusted personal data.
This English version is a translation of the Polish DPA. Unless expressly agreed otherwise, in the event of an interpretative discrepancy the Polish version prevails to the extent permitted by applicable law.
Annex A. Contact details and hosting information
Varilo data protection contact: kontakt@varilo.eu.
Hosting provider: Name.com. Public legal terms and documentation concerning data processing are available on the Name.com website, including the “Policies, Procedures and Agreements” section and the “Web Hosting Data Processing Addendum”.
| CONTROLLER / CUSTOMER | PROCESSOR |
|---|---|
| ________________________________________________________date and signature | Vesta Usługi i Szkolenia Marcin Makowski____________________________date and signature |