Data processing agreement (Article 28 GDPR)

Version of 10 November 2026

Processor:
Business Safety Coaching International Sp. z o.o., Romana Dmowskiego 22/112, 43-100 Tychy, Poland, NIP PL6463026358.
info@bsci.coach

1. Parties and acceptance

This agreement is concluded between the user of the SuitBadge app who collects contacts with a form (the controller) and the company indicated above (the processor). It is an annex to the app terms of use and is accepted together with them in the app.

2. Subject, duration, nature and purpose

The processor stores the answers sent with the controller’s forms and makes them available to the controller in the app, together with notes, export and deletion. Processing lasts as long as the controller’s account. The only purpose is to provide this function.

3. Data and data subjects

Data subjects: people who fill in a form on the controller’s page. Data: the fields the controller chooses (for example name, email, phone, company, message, a choice), the consent text accepted and the date. The controller does not collect special categories of data (Article 9 GDPR) or data of minors.

4. Instructions

The processor processes the data only on documented instructions of the controller: these terms, the settings of the forms and the actions in the app. If an instruction appears to infringe data protection law, the processor informs the controller.

5. Confidentiality

People authorised by the processor to access the data are bound to confidentiality. Access is limited to what is necessary to operate and secure the service.

6. Security (Article 32 GDPR)

answers and notes encrypted field by field with AES-256-GCM, with the key kept separately in a secret store;
pseudonymisation of the controller’s account with a random internal ID and keyed hash;
encryption at rest of database and files and encryption in transit (TLS);
every request authorised with the controller’s sign-in token; no access to other users’ data;
least-privilege access to infrastructure, no storage of visitors’ IP addresses;
data stored in the European Union (AWS, Frankfurt); database backups for 7 days.

7. Sub-processors

The controller gives a general authorisation to use sub-processors. Current sub-processors: Amazon Web Services EMEA SARL (hosting, database, files, content delivery; Frankfurt, with CloudFront delivery network). Google Ireland Ltd and Google LLC (Firebase Authentication) process only the controller’s sign-in data, not the contacts. The processor informs the controller in the app at least 30 days before adding or replacing a sub-processor; the controller can object and, if no solution is found, delete the account. Sub-processors are bound to the same data protection obligations.

8. Assistance

The processor helps the controller to answer requests of data subjects (the app allows viewing, exporting and deleting each contact) and, as far as necessary, with security, breach notifications, impact assessments and prior consultations. Requests sent by data subjects to the processor are forwarded to the controller without delay.

9. Personal data breaches

The processor notifies the controller without undue delay and in any case within 48 hours of becoming aware of a breach affecting the contacts, with the information available, and supports the controller in its obligations.

10. End of processing

When the controller deletes a contact or the account, the data is deleted immediately from the active database; backups are overwritten within 7 days. Before deletion the controller can export the contacts in CSV or JSON.

11. Audits

The processor makes available the information necessary to demonstrate compliance and allows audits by the controller or an auditor it appoints, with reasonable notice, in a way that does not compromise the security or confidentiality of other users. Certifications of the sub-processors can be used as evidence.

12. International transfers

Contacts are stored in the EU. If a transfer outside the EEA becomes necessary, it takes place only with appropriate safeguards under Chapter V GDPR (adequacy decision or Standard Contractual Clauses).

13. Controller’s obligations

The controller ensures that collection is lawful: a clear purpose, a correct consent text, use of the contacts only for that purpose, and the link to the visitors’ notice, which the processor shows under each form.