Acord privind prelucrarea datelor cu caracter personal

Versiunea în limba slovacă este cea obligatorie. Traducerea are caracter informativ.

Data Processing Agreement

This is an English translation provided for information purposes only; the Slovak language version is binding.

Effective from: 12 October 2026

This data processing agreement (the "Data Processing Agreement") is entered into between NUMIQ s.r.o., with its registered office at Kominárska 1552/3A, Bratislava - mestská časť Nové Mesto 831 04, Slovak Republic, IČO 55 880 592, registered in the Obchodný register Mestského súdu Bratislava III (Commercial Register of the Bratislava III Municipal Court), oddiel Sro, vložka č. 174081/B (Section: Sro, Insert No. 174081/B) (referred to in this Data Processing Agreement as the "Company", acting as processor), and the User (acting as controller of personal data) pursuant to Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR") and zákon č. 18/2018 Z. z. o ochrane osobných údajov a o zmene a doplnení niektorých zákonov v znení neskorších predpisov (Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts, as amended).

This Data Processing Agreement forms an integral part of the Company's General Terms and Conditions (the "GTC") pursuant to Article XVIII point 2 and Article XXI point 10 of the GTC and forms part of the Contract concluded between the Company and the User. It is concluded electronically upon acceptance of the GTC in accordance with the procedure set out in Article III of the GTC, without the need for signature by the Contracting Parties.

Article 1 - Introductory Provisions and Definitions

  1. Capitalised terms which are not specifically defined in this Data Processing Agreement have the meaning given to them in Article I of the GTC, in particular Company, User, Client, Application, Services, Account, Information, Calculation, Quote, Server, Website and Contract.

  2. The terms "personal data", "processing", "controller", "processor", "data subject", "personal data breach", "third country" and other terms used in this Data Processing Agreement without specific definition have the meaning given to them in Article 4 GDPR.

  3. "Sub-processor" means a subcontractor engaged by the Company to process personal data on behalf of the User in accordance with Article 8 of this Data Processing Agreement. "Data Subjects" means the persons specified in Annex 1. "User Personal Data" means the personal data of Data Subjects which the User has entered, imported, created or caused to be created in the Application or which arise in the Application in connection with the User's use of the Services.

  4. This Data Processing Agreement governs the processing of User Personal Data by the Company acting as processor. It does not apply to the personal data of the User, of persons acting on behalf of the User or of visitors to the Website which the Company processes as controller in its own name (in particular Account data, login data including login via a Google or Apple account, billing and payment data and analytical data on the use of the Application); such processing is governed by the privacy policy available on the Website.

  5. In the event of any conflict between this Data Processing Agreement and the GTC in matters of personal data protection, this Data Processing Agreement shall prevail. In all other matters, the GTC shall apply.

Article 2 - Subject Matter, Nature, Purpose and Duration of Processing

  1. The subject matter of this Data Processing Agreement is the processing of User Personal Data by the Company on behalf of the User to the extent necessary for the provision of the Services under the Contract, in particular for storing data on Clients and construction site addresses, creating Calculations and Quotes, sending them to Clients, tracking their opening and acceptance, importing the User's price lists and reviews, and for related technical support.

  2. The subject matter, nature and purpose of processing, the categories of Data Subjects, the categories of personal data and the duration of processing are set out in detail in Annex 1 to this Data Processing Agreement.

  3. The Company processes User Personal Data for the term of the Contract and thereafter for the period necessary for their erasure or anonymisation pursuant to Article 13 of this Data Processing Agreement.

  4. The Company processes User Personal Data solely for the purposes set out in this Data Processing Agreement and in the GTC. The Company does not use User Personal Data for its own purposes, with the exception of their use in anonymised and aggregated form pursuant to Article X point 8 of the GTC, in which neither the User nor the Client can be identified and which, following anonymisation, is not considered processing of personal data.

Article 3 - Instructions of the User

  1. The Company processes User Personal Data only on the basis of documented instructions from the User. The following are deemed to be documented instructions of the User:
  • this Data Processing Agreement and the GTC,
  • the Account and Application settings selected by the User and the User's actions in the Application (e.g. saving Client data, entering a construction site address, creating a Calculation using Kalkulant, importing a price list, importing reviews, sending a Quote to a Client, deleting data),
  • other written instructions of the User delivered to the Company by e-mail to support@numiq.com, provided that they relate to processing under this Data Processing Agreement and are consistent with the Contract.

  1. The User's instructions also include the transfer of User Personal Data to the Sub-processors listed in Annex 3, including the transfer of inputs to the services of the artificial intelligence model provider to the extent necessary to create a Calculation or other AI content, geocoding of construction site addresses, importing reviews and sending e-mails, as well as transfers to third countries under the conditions set out in Article 9 of this Data Processing Agreement.

  2. If the Company concludes that an instruction of the User infringes the GDPR or other European Union or Member State data protection provisions, it shall inform the User thereof without undue delay. The Company is entitled to suspend the execution of such instruction until it is confirmed or amended by the User.

  3. The Company is obliged to carry out instructions of the User going beyond the functionalities of the Application and this Data Processing Agreement only if they are technically feasible and the User pays the reasonable costs associated therewith, which the Company shall notify in advance.

  4. The Company is entitled to process User Personal Data without the User's instruction where required to do so by European Union law or the law of the Slovak Republic; in such a case, the Company shall inform the User of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

Article 4 - Obligations of the Company

  1. The Company undertakes to:
  • process User Personal Data only on the basis of documented instructions of the User pursuant to Article 3 of this Data Processing Agreement,
  • ensure that persons authorised to process User Personal Data are bound by confidentiality pursuant to Article 6 of this Data Processing Agreement,
  • adopt and maintain technical and organisational measures pursuant to Article 32 GDPR and Article 7 of this Data Processing Agreement,
  • comply with the conditions for engaging Sub-processors pursuant to Article 8 of this Data Processing Agreement,
  • assist the User in fulfilling its obligations towards Data Subjects pursuant to Article 10 of this Data Processing Agreement,
  • assist the User in fulfilling its obligations pursuant to Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to the Company,
  • upon termination of the provision of the Services, erase or anonymise User Personal Data pursuant to Article 13 of this Data Processing Agreement,
  • make available to the User the information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allow for audits pursuant to Article 12 of this Data Processing Agreement.

  1. The Company maintains records of processing activities carried out on behalf of the User to the extent required by Article 30(2) GDPR.

  2. The Company has designated a contact point for data protection matters: support@numiq.com. If the Company designates a data protection officer, it shall publish his or her contact details on the Website.

  3. The Company does not sell or rent User Personal Data or disclose them to third parties for their own purposes. The Company does not use User Personal Data to train artificial intelligence models in its own name other than in anonymised and aggregated form pursuant to Article X point 8 of the GTC.

Article 5 - Obligations and Representations of the User

  1. The User is the controller of User Personal Data and is responsible for the lawfulness of their processing, in particular for the existence of a legal basis pursuant to Article 6 GDPR, for compliance with the information obligation towards Data Subjects pursuant to Articles 13 and 14 GDPR, for the accuracy and currency of the personal data and for the lawfulness of the instructions given to the Company.

  2. The User shall enter into the Application only personal data that are necessary for the provision of the Services and shall not enter into the Application or into inputs for artificial intelligence (including imported price lists) special categories of personal data pursuant to Article 9 GDPR, personal data relating to criminal convictions and offences, birth numbers, identity document numbers or any other personal data not necessary for the given purpose, in accordance with Article XI point 2 and Article XVIII point 3 of the GTC.

  3. The User is responsible for ensuring that Clients and other Data Subjects have been informed of the processing of their personal data by means of the Application, including the electronic sending of Quotes, tracking of the opening of a Quote, geocoding of the construction site address, importing reviews and the use of artificial intelligence tools in creating Calculations.

  4. The User shall protect the Account access credentials, manage the permissions of persons to whom it grants access to the Account, where the Application allows this, and notify the Company without delay of any suspected unauthorised access to the Account.

  5. The User acknowledges that the Application enables the User to independently delete, rectify and export Client data, Calculations and Quotes, and that these tools are the primary means of fulfilling the User's obligations towards Data Subjects.

  6. The User shall inform the Company without delay if it finds that processing under this Data Processing Agreement is in breach of legal regulations or if it becomes aware of facts that may affect the fulfilment of the Company's obligations under this Data Processing Agreement.

Article 6 - Confidentiality

  1. The Company shall ensure that employees and other persons authorised to process User Personal Data are bound by a duty of confidentiality on the basis of a contract or legal regulation and have been instructed on their obligations in the protection of personal data.

  2. The Company restricts access to User Personal Data only to persons who require it for the provision of the Services, the Support Services, maintenance of the Application or compliance with legal obligations.

  3. The duty of confidentiality continues after the termination of the employment or other relationship of the relevant person with the Company and after the termination of this Data Processing Agreement.

Article 7 - Security of Processing

  1. The Company shall adopt and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk pursuant to Article 32 GDPR, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks to the rights and freedoms of Data Subjects.

  2. The measures adopted by the Company are described in Annex 2 to this Data Processing Agreement. The Company is entitled to update and improve the measures on an ongoing basis, provided that the overall level of security of processing is not reduced.

  3. The User has assessed the measures set out in Annex 2 and considers them appropriate to the risks associated with the processing of User Personal Data under this Data Processing Agreement. If, in view of the nature of its data, the User requires a higher level of security, it shall discuss this with the Company before entering such data into the Application.

Article 8 - Sub-processors

  1. The User grants the Company general written authorisation pursuant to Article 28(2) GDPR to engage Sub-processors in the processing of User Personal Data. The list of Sub-processors engaged as at the effective date of this Data Processing Agreement is set out in Annex 3; the current list is available on the Website.

  2. The Company shall conclude with each Sub-processor a contract or other legal act imposing on the Sub-processor data protection obligations substantially the same as the obligations of the Company under this Data Processing Agreement, in particular the obligation to provide sufficient guarantees to implement appropriate technical and organisational measures. Providers with whom a contract is concluded by accepting their standard data processing terms (data processing addendum) are also considered Sub-processors.

  3. The Company shall notify the User of any intended change to the list of Sub-processors (addition or replacement) at least 15 days before it takes effect, by e-mail to the address specified in the Account or by notice in the Application, and shall at the same time update the list on the Website. Exceptionally, where the change is necessary to ensure the security or operation of the Application, the Company may engage a Sub-processor with immediate effect and inform the User without undue delay.

  4. The User is entitled to object to the engagement of a new Sub-processor on reasonable grounds relating to data protection by e-mail to support@numiq.com within 15 days of notification of the change. If the Contracting Parties fail to reach agreement on resolving the objection (e.g. by disabling the relevant functionality of the Application), the User is entitled to terminate the Contract with immediate effect before the change takes effect in accordance with the procedure set out in Article XV of the GTC. In such a case, the unused portion of the Subscription shall be refunded on a pro rata basis. If the User does not object within that period and continues to use the Services, the User shall be deemed to consent to the engagement of the Sub-processor.

  5. The Company is liable to the User for the performance of obligations by Sub-processors to the same extent as it is liable for its own performance under this Data Processing Agreement and the GTC.

  6. The payment gateway (Stripe), login via a Google or Apple account and analytical tools (Google Analytics 4) process exclusively data of the User (in particular billing, payment, login and analytical data), in respect of which the Company acts as controller; such processing is governed by the privacy policy available on the Website. These services are not used for the processing of User Personal Data (in particular Client data) and their providers are not Sub-processors under this Data Processing Agreement.

Article 9 - Transfers to Third Countries

  1. The Company stores User Personal Data on servers located in the European Union (Frankfurt region, eu-central-1). Some of the Sub-processors listed in Annex 3 are established or process data outside the European Economic Area, in particular in the United States of America and the United Kingdom, and for some Sub-processors the place of processing is not fixed.

  2. A transfer of User Personal Data to a third country or an international organisation shall take place only under the conditions of Chapter V GDPR, in particular:

  • on the basis of an adequacy decision of the European Commission, including Commission Implementing Decision (EU) 2023/1795 on the EU-US Data Privacy Framework, where the recipient is certified under that framework, and the adequacy decision for the United Kingdom, or
  • on the basis of standard contractual clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), supplemented by additional measures where necessary, or
  • on the basis of another transfer mechanism pursuant to Articles 46 to 49 GDPR.

  1. The User hereby authorises the Company to conclude, on the User's behalf, standard contractual clauses or other transfer mechanisms with Sub-processors as necessary to ensure the compliance of transfers under this Article. At the User's request, the Company shall provide information on the transfer mechanism used for a specific Sub-processor.

  2. If the transfer mechanism used for a Sub-processor ceases to be a valid basis for the transfer, the Company shall without undue delay put in place a replacement transfer mechanism or terminate the engagement of that Sub-processor.

Article 10 - Rights of Data Subjects and Assistance

  1. Taking into account the nature of processing, the Company shall assist the User by appropriate technical and organisational measures in fulfilling the User's obligation to respond to requests from Data Subjects exercising their rights under Chapter III GDPR (in particular the rights of access, rectification, erasure, restriction of processing, data portability and objection).

  2. The Company provides assistance under point 1 primarily through the functionalities of the Application, which enable the User to independently view, rectify, export and delete Client data. If a request of a Data Subject cannot be handled through the functionalities of the Application, the Company shall provide the User with the necessary assistance on the basis of the User's written request without undue delay, as a rule within 10 working days.

  3. If a Data Subject addresses a request to exercise rights directly to the Company and the request concerns User Personal Data, the Company shall not respond to the Data Subject on the merits, shall forward the request to the User without undue delay, where the User can be identified, and shall inform the Data Subject that the request has been forwarded to the controller. This does not apply where the Company is obliged by legal regulations to respond directly.

  4. Taking into account the nature of processing and the information available to it, the Company shall assist the User in carrying out a data protection impact assessment pursuant to Article 35 GDPR and in prior consultation with the supervisory authority pursuant to Article 36 GDPR, where these relate to processing under this Data Processing Agreement.

  5. If the assistance under this Article exceeds the usual scope in view of the nature and price of the Services or is caused by the User's conduct in breach of this Data Processing Agreement, the Company is entitled to request reimbursement of reasonable costs, which it shall notify to the User in advance.

Article 11 - Personal Data Breach

  1. The Company shall notify the User of a personal data breach affecting User Personal Data without undue delay after becoming aware of it, and no later than 48 hours after its discovery, by e-mail to the address specified in the Account.

  2. The notification shall contain, to the extent of the information available to the Company at the time of notification, in particular:

  • a description of the nature of the breach including, where possible, the categories and approximate number of Data Subjects and records concerned,
  • the likely consequences of the breach,
  • the measures taken or proposed to address the breach and mitigate its consequences,
  • the contact point where more information can be obtained.

  1. Where it is not possible to provide all the information at the same time, the Company shall provide it in phases without undue delay after it is ascertained.

  2. The Company shall provide the User with the assistance necessary to fulfil its obligations to notify a personal data breach to the supervisory authority pursuant to Article 33 GDPR and to Data Subjects pursuant to Article 34 GDPR. Notification to the supervisory authority and to Data Subjects shall be made by the User as controller; the Company shall make such notifications only on the express instruction of the User or where required to do so by legal regulations.

  3. The Company documents personal data breaches, including the related facts, consequences and remedial measures taken, and shall make this information available to the User upon request.

  4. Notification of a personal data breach under this Article shall not be construed as an acknowledgement by the Company of liability for the breach or for any damage resulting from it.

Article 12 - Audits and Demonstration of Compliance

  1. Upon the User's written request, the Company shall provide the User with the information necessary to demonstrate compliance with the obligations under Article 28 GDPR and this Data Processing Agreement. Compliance is demonstrated primarily by providing written information, a description of the measures adopted, the results of internal checks and available certificates, audit reports or other evidence of Sub-processors' compliance (e.g. SOC 2, ISO/IEC 27001), where available to the Company and where the terms of the Sub-processors allow them to be disclosed.

  2. If the information under point 1 is reasonably insufficient to demonstrate compliance, the User is entitled to carry out, itself or through an independent auditor bound by confidentiality, an audit or inspection of processing under this Data Processing Agreement, subject to the following conditions:

  • the audit shall be notified to the Company in writing at least 30 days in advance, stating the scope, subject matter and expected duration of the audit,
  • the audit shall be carried out no more than once every 12 months, unless the audit is triggered by a personal data breach or a request of the supervisory authority,
  • the audit shall be carried out during normal business hours, in a manner that does not unreasonably disrupt the Company's operations, and to an extent limited to the processing of User Personal Data,
  • the auditor must not be a competitor of the Company and shall conclude a non-disclosure agreement with the Company before the audit begins,
  • the costs of the audit, including the Company's reasonable costs of assisting with the audit, shall be borne by the User, unless the audit reveals a material breach of this Data Processing Agreement by the Company.

  1. The audit does not extend to the premises and systems of Sub-processors; in respect of them, compliance is demonstrated by the evidence under point 1 and by the inspection rights that the Company has vis-à-vis the Sub-processors.

  2. The Contracting Parties agree that information obtained during the audit is confidential and the User shall use it solely for the purpose of demonstrating compliance with the GDPR. The User shall provide the Company with a copy of the audit report.

  3. The right of the supervisory authority to carry out an inspection in accordance with legal regulations is not affected by this Article.

Article 13 - Term, Termination and Erasure of Personal Data

  1. This Data Processing Agreement is concluded for the term of the Contract. Upon termination of the Contract for any reason, this Data Processing Agreement also terminates, with the exception of provisions which by their nature are intended to survive its termination, in particular provisions on confidentiality, erasure of personal data, liability and governing law.

  2. Before termination of the Contract, the User shall export from the Application all User Personal Data and Information that it wishes to retain, using the functionalities of the Application (in particular export to PDF or another available format) in accordance with Article XV point 5 of the GTC. At the User's request delivered before termination of the Contract, the Company shall provide reasonable assistance with the export of data.

  3. After termination of the Contract, the Company shall, in accordance with Article XV point 6 of the GTC, erase or irreversibly anonymise User Personal Data no later than 90 days from the date of termination of the Contract and shall ensure their erasure by Sub-processors within the periods set out in their terms. The Company shall delete existing copies, with the exception of:

  • data which the Company is obliged or entitled to retain under European Union law or the law of the Slovak Republic, in particular accounting and tax documents,
  • data necessary for the establishment, exercise or defence of legal claims,
  • backup copies, which shall be deleted in the course of the regular backup rotation cycle, no later than 90 days from termination of the Contract, and access to which is restricted solely for the purpose of system recovery.

  1. Data retained under point 3 shall remain subject, after termination of the Contract, to the confidentiality and security obligations under this Data Processing Agreement and the Company shall not process them for any other purpose.

  2. At the User's request, the Company shall confirm in writing that erasure under point 3 has been carried out.

Article 14 - Liability

  1. Each Contracting Party is liable for damage caused by a breach of its obligations under this Data Processing Agreement and the GDPR in accordance with Article 82 GDPR. The Company is liable for damage caused by processing only where it has not complied with obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to lawful instructions of the User.

  2. The Company's liability to the User for damage under this Data Processing Agreement is governed by Article XIII of the GTC, including the limitation of the total amount of compensation and the exclusion of indirect and consequential damage, unless mandatory provisions of the GDPR or other legal regulations provide otherwise. The limitations of liability do not apply to compensation for damage to Data Subjects pursuant to Article 82 GDPR to the extent that it cannot be limited.

  3. The User is liable to the Company for damage, fines and costs incurred by the Company as a result of a breach of the User's obligations as controller, in particular as a result of the absence of a legal basis for processing, failure to comply with the information obligation towards Data Subjects, entering personal data contrary to Article 5 of this Data Processing Agreement or giving unlawful instructions, in accordance with Article XVI of the GTC.

  4. If the supervisory authority imposes a fine on one Contracting Party for a breach for which the other Contracting Party is responsible, the other Contracting Party shall compensate it for the loss incurred to the extent permitted by legal regulations.

Article 15 - Final Provisions

  1. This Data Processing Agreement enters into force and effect on the date stated in its heading and, in relation to a specific User, at the moment of acceptance of the GTC in accordance with the procedure set out in Article III of the GTC. For Users who concluded the Contract before that date, it takes effect in accordance with the procedure set out in Article XX of the GTC.

  2. The Company is entitled to amend this Data Processing Agreement in accordance with the procedure set out in Article XX of the GTC, in particular due to changes in legal regulations, decisions of supervisory authorities, changes in the scope of the Services or changes of Sub-processors. Changes to Annex 3 are notified in accordance with the procedure set out in Article 8 of this Data Processing Agreement.

  3. This Data Processing Agreement and the relationships arising from it are governed by the laws of the Slovak Republic, in particular the GDPR and zákon č. 18/2018 Z. z. o ochrane osobných údajov (Act No. 18/2018 Coll. on the Protection of Personal Data). Disputes arising from this Data Processing Agreement shall be decided by the courts of the Slovak Republic having jurisdiction determined in accordance with Article XXI point 3 of the GTC.

  4. If any provision of this Data Processing Agreement is or becomes invalid, ineffective or unenforceable, this shall not affect the remaining provisions; the invalid provision shall be replaced by a provision that comes closest to its purpose and to the requirements of Article 28 GDPR.

  5. If, for a User established in another Member State of the European Union or the European Economic Area, additional requirements for the content of a contract with a processor arise under the law of that state, the Contracting Parties undertake to conclude, at the User's request, an addendum reflecting those requirements.

  6. This Data Processing Agreement is drawn up in the Slovak language. The Company may make translations of it available; in the event of any discrepancy, the Slovak version shall prevail.

  7. Annex 1 (Subject Matter, Nature and Purpose of Processing), Annex 2 (Technical and Organisational Measures) and Annex 3 (List of Sub-processors) form an integral part of this Data Processing Agreement.

Annex 1 - Subject Matter, Nature and Purpose of Processing

Subject matter of processing: processing of personal data of Clients and other Data Subjects which the User enters or imports into the Application or which arise in the Application in the course of using the Services, on behalf of and in accordance with the instructions of the User.

Nature of processing: collection, recording, organisation, storage, consultation, use for creating Calculations and Quotes, geocoding of construction site addresses, import and processing of price lists and reviews, transfer to Sub-processors to the extent necessary for the provision of the Services, making available to Clients via a link or e-mail in accordance with the User's instructions, backup, restriction, erasure and anonymisation. Processing is carried out by automated means through the Application.

Purpose of processing: provision of the Services under the Contract, in particular:

  • management of data on Clients, construction site addresses and the User's projects in the Application,
  • creation of Calculations, including AI-assisted Calculations (Kalkulant), and geocoding of the construction site address to determine the region,
  • import of the User's price lists (including photographs, PDFs and Word documents) and their AI-assisted processing,
  • import of reviews of the User's business from Google and their AI-assisted processing for the purpose of displaying them in the User's Quotes and presentation materials,
  • creation, sending, sharing and export of Quotes, tracking of their opening and online acceptance by the Client,
  • sending e-mail notifications relating to Quotes,
  • backup, security and technical support of the Application.

Categories of Data Subjects:

  • Clients of the User (natural persons or contact persons of legal entities) to whom the User addresses Quotes or with whom it shares Calculations,
  • employees, collaborators and other persons authorised to act on behalf of the User, if the User enters their data into the Application (e.g. into a Quote or the Account settings),
  • authors of reviews of the User's business (reviewers) whose reviews the User imports from Google into the Application,
  • persons whose data are contained in price lists imported by the User (e.g. contact persons of suppliers), if the price lists contain such data,
  • other persons whose data the User enters into the Application (e.g. on-site contact persons).

Categories of personal data:

  • identification and contact data: first name, surname, business name, address, e-mail address, telephone number,
  • project data: address of the construction site or place of performance (including its geocoding to determine the region), description and scope of the project, content of Calculations and Quotes including prices, measurements, schedule and instalment plan,
  • review data: name or nickname of the reviewer, text of the review, rating and date of the review to the extent imported from Google,
  • imported price lists: content of price lists uploaded by the User (including photographs, PDFs and Word documents), if they contain personal data, e.g. names or contact details of suppliers,
  • data on the User's business entered into Calculations and Quotes: name, address, logo, business description and contact details, if provided by the User,
  • communication data: notes of the Client when viewing or accepting a Quote, information on acceptance of a Quote,
  • technical interaction data: date and time of opening of a Quote and, where applicable, the IP address and basic data on the Client's device and browser to the extent necessary to track opening and secure access via the link,
  • data on employees and collaborators of the User: name, job position, contact details, if provided by the User.

Special categories of personal data: not processed. The User undertakes not to enter special categories of personal data into the Application.

Duration of processing: for the term of the Contract and thereafter until erasure or anonymisation pursuant to Article 13 of this Data Processing Agreement, no later than 90 days from termination of the Contract, subject to the exceptions under Article 13 point 3. The User may itself delete Client data, Calculations, Quotes, imported price lists and reviews in the Application at any time during the term of the Contract.

Annex 2 - Technical and Organisational Measures

The Company has adopted and maintains in particular the following technical and organisational measures:

1. Encryption

  • User Personal Data are encrypted in transit between the device of the User, the Client and the Server using the TLS protocol.
  • Data stored in the database, file storage and backups are encrypted at rest using the tools of the cloud infrastructure provider.
  • User passwords are stored exclusively in the form of a cryptographic hash.

2. Data Segregation and Access Control to Information

  • Access to data in the database is controlled by Row Level Security policies, which ensure that the User has access exclusively to its own Information and data on its own Clients.
  • Quotes are made available to Clients via unique, hard-to-guess links; access to a Quote is limited to the data of that Quote.

3. Personnel Access Management

  • Only authorised persons of the Company have access to production systems and User Personal Data, to the extent necessary for the performance of their tasks (principle of least privilege).
  • Administrator access is protected by strong passwords and multi-factor authentication, where the relevant system allows it.
  • Access permissions are reviewed regularly and revoked without delay upon termination of cooperation with the person concerned.
  • The User's access to the Account is secured by an e-mail address and a password meeting the Company's requirements or, alternatively, by login via a third-party account (Google or Apple).

4. Backup and Availability

  • The database is regularly and automatically backed up via the cloud infrastructure provider; backups are encrypted and access to them is restricted.
  • Backups are retained for a limited period and are automatically overwritten or deleted upon expiry of that period.
  • The database, file storage and authentication services are operated in a data centre in the European Union (Frankfurt region, eu-central-1) with physical security measures, redundancy and monitoring; server functions and delivery of Application content are provided by the global network of the hosting provider.

5. Logging and Monitoring

  • Access to systems, authentication events and significant data operations are recorded in logs with restricted access.
  • The Company monitors the availability and security events of the Application and uses security alerts from infrastructure providers.
  • The Application applies rate limiting and other measures against automated abuse.

6. Minimisation in the Use of Artificial Intelligence and External Services

  • Only inputs necessary to create a Calculation or other AI content (in particular project parameters, room, trade, city, the User's answers in the wizard, imported price lists, data on the User's business and review texts) are passed to the services of the artificial intelligence model provider (Google Gemini models called via Lovable AI); Client identification and contact data are not passed in the inputs unless the User itself enters them into the input.
  • The Company uses exclusively interfaces of artificial intelligence model providers intended for business customers (API), under which the provider, according to its contractual terms, does not use inputs and outputs to train its models.
  • Only the construction site address, without Client identification data, is passed to geocoding services; only the name and address of the User's business are passed to the review import service.
  • The User is notified in the Application of the obligation not to enter personal data beyond the necessary extent into inputs for artificial intelligence.

7. Organisational Measures

  • Persons authorised to process User Personal Data are bound by confidentiality and instructed on the principles of personal data protection and security.
  • The Company has an established procedure for handling security incidents and personal data breaches, including their documentation and notification to the User.
  • Sub-processors are selected with regard to the security guarantees they provide (in particular SOC 2 or ISO/IEC 27001 certifications) and are bound by contractual data processing terms.
  • Changes to the Application are tested before deployment to production; dependencies and infrastructure are updated on an ongoing basis.

8. Data Erasure

  • The User may delete Client data, Calculations, Quotes, imported price lists and reviews in the Application at any time.
  • After termination of the Contract, the Company shall erase or irreversibly anonymise User Personal Data no later than 90 days in accordance with Article XV point 6 of the GTC and Article 13 of this Data Processing Agreement, subject to the exceptions set out in this Data Processing Agreement.

Annex 3 - List of Sub-processors

As at the effective date of this Data Processing Agreement, the Company engages the following Sub-processors. The current list of Sub-processors, including any changes, is published on the Website together with this Data Processing Agreement. Changes to the list are notified in accordance with the procedure set out in Article 8 of this Data Processing Agreement.

1. Supabase, Inc. (via Lovable Cloud)

  • Registered office: United States of America
  • Purpose of processing: database, User authentication, file storage, scheduled tasks, backup
  • Categories of data: all data stored in the Application (Client data, construction site addresses, Calculations, Quotes, imported price lists, reviews, logos and other files)
  • Place of processing: European Union, Frankfurt region (eu-central-1); support and administrative activities may take place in the USA
  • Transfer mechanism: EU-US Data Privacy Framework, where the entity is certified, otherwise EC standard contractual clauses

2. Lovable Labs Incorporated

  • Registered office: United States of America
  • Purpose of processing: hosting and operation of the Application and server functions; intermediation of artificial intelligence services (Lovable AI) vis-à-vis the model provider listed in point 3
  • Categories of data: data passing through the Application and server functions during its operation; inputs and outputs of AI functions to the extent set out in point 3
  • Place of processing: infrastructure of Cloudflare, Inc. (United States of America), a global network in which processing takes place at the location nearest to the visitor of the Application
  • Transfer mechanism: EU-US Data Privacy Framework, where the entity is certified, otherwise EC standard contractual clauses

3. Google Ireland Limited / Google LLC (Gemini artificial intelligence models)

  • Registered office: Ireland / United States of America
  • Purpose of processing: provider of the Gemini artificial intelligence models called via Lovable AI; processing of inputs for the creation of Calculations and other AI content to the extent necessary to generate the output
  • Categories of data: text of Calculations and answers from the wizard, imported price lists (including photographs, PDFs and Word documents), data on the User's business, review texts
  • Place of processing: region not fixed (European Union / USA / other regions depending on service settings)
  • Transfer mechanism: EU-US Data Privacy Framework, where the entity is certified, otherwise EC standard contractual clauses

4. Plus Five Five, Inc. (Resend)

  • Registered office: United States of America
  • Purpose of processing: sending e-mails, including sharing a Quote with a Client and e-mail notifications
  • Categories of data: e-mail address and name of the recipient, content of the e-mail, link to the Quote
  • Place of processing: USA
  • Transfer mechanism: EU-US Data Privacy Framework, where the entity is certified, otherwise EC standard contractual clauses

5. OpenStreetMap Foundation (Nominatim service)

  • Registered office: United Kingdom
  • Purpose of processing: geocoding of the construction site address to determine the region when creating a Calculation
  • Categories of data: construction site address
  • Place of processing: United Kingdom / European Union
  • Transfer mechanism: adequacy decision of the European Commission for the United Kingdom; no transfer mechanism is required within the European Union

6. U.S. Census Bureau (Geocoder service)

  • Registered office: United States of America
  • Purpose of processing: geocoding of addresses of construction sites located in the USA; used exclusively in the US Country Version
  • Categories of data: construction site address
  • Place of processing: USA
  • Transfer mechanism: EU-US Data Privacy Framework, where the entity is certified, otherwise EC standard contractual clauses

7. SerpApi, LLC

  • Registered office: United States of America
  • Purpose of processing: import of Google reviews of the User's business into the Application
  • Categories of data: the name and address of the User's business are passed; the service returns reviewer names, review texts and related review data
  • Place of processing: USA
  • Transfer mechanism: EU-US Data Privacy Framework, where the entity is certified, otherwise EC standard contractual clauses

Note on services processing exclusively User data: The Stripe payment gateway (Stripe Payments Europe, Ltd. and Stripe, Inc.), login via a Google or Apple account and analytical tools (Google Analytics 4) process exclusively data of the User, in respect of which the Company acts as controller, and such processing is governed by the privacy policy available on the Website. These services are not used for the processing of Client personal data and their providers are not Sub-processors under this Data Processing Agreement.