Service Provider: Studio Kreacja Przemysław Bazanowski, ul. Artura Grottgera 15/11, 63-100 Śrem, Poland, NIP (tax ID) 7851746559, e-mail: office@socialu.ai, website: https://socialu.ai
§ 1. Parties and subject matter
The controller is the Customer concluding the Agreement; the processor is Studio Kreacja Przemysław Bazanowski, ul. Artura Grottgera 15/11, 63-100 Śrem, Poland, NIP 7851746559, e-mail: office@socialu.ai, website: https://socialu.ai. The DPA forms part of the Agreement for the use of Socialu.
The processing serves to provide CRM, publishing, marketing, automation, AI, recording and other features launched by the Controller. It lasts for the term of the Agreement and the period of technical deletion of data.
§ 2. Nature and categories of data
Operations: storage, organisation, retrieval, transmission, analysis, generation, deletion. Data subjects: clients, prospective clients, marketing recipients, employees and associates of the Controller, persons captured in recordings.
Categories: first name, surname, telephone, e-mail, lead data, communication history, content, activity data, voice, image, recordings, transcriptions and any special categories of data contained in materials.
§ 3. Instructions and confidentiality
The Processor processes data only on documented instructions from the Controller, including with regard to international transfers, unless required to do so by law. It informs the Controller of legal obstacles to the extent permitted by law.
The Processor ensures that authorised persons are bound by confidentiality and applies adequate security measures.
§ 4. Security
The Processor applies appropriate technical and organisational measures, in particular access control, authentication, encryption in transit, event logging, backups, permission management and incident response procedures, to the extent actually implemented.
§ 5. Sub-processing
The Controller gives general authorisation to use the sub-processors listed in Annex A. The Processor informs of planned changes in advance, allowing a reasoned objection to be raised.
The Processor imposes on sub-processors data protection obligations no less stringent than those arising from this Agreement and is responsible for their performance in accordance with Art. 28 GDPR.
§ 6. Transfers outside the EEA
Data is stored on OVH infrastructure in the United Kingdom. AI operations may result in data being processed by OpenAI and Anthropic in the USA.
For the United Kingdom, the current adequacy decision applies. With regard to specific recipients in the USA, the processor applies an appropriate transfer mechanism under Chapter V GDPR.
§ 7. Assistance and breaches
The Processor assists the Controller in handling data subject requests, data protection impact assessments, consultations with the supervisory authority and the performance of security obligations, within the limits of the nature of the processing.
The Processor notifies the Controller of a detected personal data breach without undue delay and provides the available information necessary to assess the incident.
§ 8. Audit and information
The Processor makes available the information necessary to demonstrate compliance with Art. 28 GDPR and allows audits and inspections in an agreed, proportionate manner, respecting the security of other Customers.
§ 9. Return and deletion
After the end of the services, depending on the Controller's decision, the Processor returns or deletes the data, unless the law requires its further storage. Standard export: ZIP/JSON with files.
Deletion from active systems takes place without undue delay, within 14 days at most; backup rotation — 30 days at most, with appropriate access restrictions. These periods do not limit the mandatory rights of the Controller.
Annex A. List of sub-processors
| Sub-processor | Scope | Location |
|---|---|---|
| OVHcloud (OVH sp. z o.o.) | hosting, databases, files | United Kingdom |
| OpenAI | processing of prompts and content by AI models | USA |
| Anthropic | processing of prompts and content by AI models | USA |
| Amazon Web Services / Amazon SES | e-mail sending | — |
| OVH | e-mail sending | — |
Stripe and Przelewy24 — payment operators; they may act as separate controllers of payment data and are not included in the list as sub-processors.
Annex B. Controller's instructions
The Controller determines the configuration of integrations, the scope of automation, contact lists, campaign objectives, available recordings and their retention periods within the Platform's features. Transferring special categories of data requires an appropriate legal basis and appropriate safeguards.