Data Processing Agreement

This agreement is part of the Underpaint terms for every Team and Agency customer. It is the article 28 GDPR contract between you (the controller) and Rockon sp. z o.o., ul. gen. Józefa Zajączka 30/1, 01-510 Warszawa, KRS 0000467123 (the processor). 1. What we process for you Subject matter: hosting your workspace and running model calls on the content you put in it. Duration: for as long as the subscription lasts, plus the 30 days after it closes. Nature: storage, retrieval, display, and transmission to a model after the anonymisation step. People concerned: your members, and the individuals named in the briefs, files and notes you upload. Data: names, contact details, and whatever else those files contain. You decide what you upload. 2. Our instructions We process that content only to provide Underpaint, and only on your documented instructions. The terms, the product settings you choose, and a written instruction to privacy@underpaint.io are those instructions. We tell you if an instruction appears to break the law. We do not train models on the content. We do not sell it. We do not use it for our own marketing. 3. The anonymisation step Before a model call, names on your hide list and contact details the filter recognises are replaced with placeholders. The model receives that text. The answer stored in your workspace has the original words restored. This step is part of the service, not a separate product. 4. Our people People who can reach the content are limited to those who need it to run the service, and they are bound to confidentiality. 5. Security Access to a workspace is isolated from every other workspace in the database. Traffic is encrypted in transit. Files and the database are hosted in the European Union. Model calls leave the EEA when the provider is outside it, on the basis described in the privacy policy. 6. Subprocessors The subprocessors page is the list. We tell you at least 14 days before we add or replace one, by email to the workspace owner. You may object on reasonable grounds related to data protection. If we cannot offer a reasonable alternative, you may end the subscription. 7. Helping you We help you answer requests from people whose data is in your content, run a data-protection impact assessment where the content requires one, and show the information a supervisory authority asks you for. You can export the workspace from the product. 8. Deletion Within 30 days after the workspace closes we delete the content, including the files in storage, unless the law requires us to keep a record. Invoices are that kind of record. 9. A breach If we become aware of a personal-data breach affecting your content, we notify you without undue delay, with what happened, what is affected, and what we are doing about it. 10. Audits Once a year you may ask for a summary of the measures in section 5. A further audit is on reasonable notice, during business hours, and at your cost unless it finds a material breach. 11. Liability and law Liability follows the terms. Polish law applies. The courts follow the terms.