webomat
PLEN
Check your website

Documents

Provisions for Clients outside the EEA

Version 1.1 · effective 4 November 2026

Working translation of the Polish version 1.1 of 4 November 2026, not reviewed by a lawyer. The Polish version is binding: you accept the Polish version, and in case of any discrepancy the Polish text prevails.

This document supplements the Terms and the Data Processing Agreement towards Clients whose country lies outside the European Economic Area (EEA). It describes how our obligations look in the language of the data protection law of the Client’s country and how the limitations of liability in the Terms work for such a Client.

“We” means JCD.PL spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw, ul. gen. Klemensa Stanisława Rudnickiego 1/35, 01-858 Warszawa, KRS 0000782199, NIP 1182192683, REGON 383120500, e-mail: [email protected]. Capitalised terms (e.g. Client, Consumer, Sole trader with consumer rights, Service, Project, Shop) have the meanings given to them in the Terms and the Data Processing Agreement.

General part

  1. Who it applies to. This document applies to a Client whose country lies outside the EEA. The Client’s country is the country given in the invoice details on the Account (for a company – the country of its registered office, for a natural person – the country of address) on the day of the event to which the matter relates. A change of the country to one outside the EEA requires acceptance of this document – when placing an Order or in the Client Panel. The Service currently accepts Orders from the following non-EEA countries: the United Kingdom, the United States, Switzerland and Ukraine. For such a Client, the general part and the section R applicable to their country apply.
  2. Acceptance. A Client from outside the EEA accepts this document together with the Terms and the Data Processing Agreement when placing an Order or with the “I accept” button in the Client Panel. We record the acceptance in the acceptance register (Data Processing Agreement, § 1(1)). This document and its subsequent versions bind the Client from the moment of acceptance – we do not apply tacit acceptance. Until a new version is accepted, the version accepted earlier applies; a Client who does not want to accept it may terminate the contract without costs (Terms, § 13(1)).
  3. Precedence. In matters regulated by this document, it takes precedence over the Terms and the Data Processing Agreement towards Clients from the given country. In other matters the Terms and the Data Processing Agreement apply unchanged.
  4. Binding version. The Polish version of this document, of the Terms and of the Data Processing Agreement is binding. We prepare translations for convenience; in case of discrepancy, the Polish text prevails.
  5. Governing law. Polish law and the GDPR apply to the contract (Terms, § 13(2); Data Processing Agreement, § 9(3)). The GDPR always applies to us because we operate in the European Union. The section R does not change the governing law; it takes into account the provisions of the Client’s country that apply to the Client regardless of the choice of law.
  6. Where the data is. We store the Client’s data and the data the Client entrusts to us in Poland (European Union), in the OVH data centre. We do not offer storage of data in the Client’s country. Further transfers outside the EEA are only those indicated in the Sub-processor List (Data Processing Agreement, § 4): Cloudflare (USA) for network traffic, and providers of artificial intelligence models – Anthropic (USA), Z.ai (Singapore), DeepSeek (China) and OpenAI (USA) – for content needed to prepare the Project and for conversations with the Service’s chats. For each of them the List gives the transfer basis, and where the basis is still being established, it says so directly.
  7. Assessment of the transfer. The transfer of data from the Client’s country to the European Union is assessed by the Client as controller, under the law of its country. We provide the information needed for this assessment: the place of processing, the Sub-processor List with the country and the basis of the transfer, and a description of security measures (Data Processing Agreement, § 3 and § 4). We do not give legal advice and do not carry out this assessment on the Client’s behalf.
  8. Cloudflare. Traffic to the Service and to Clients’ websites passes through the network of Cloudflare, Inc. (USA). Cloudflare declares certification under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, and as a fallback applies standard contractual clauses in its data processing agreement. If the law of the Client’s country requires an additional assessment of this transfer, the Client carries it out; we provide the necessary information.
  9. Deadlines. The deadlines from the Data Processing Agreement (including notification of a breach no later than within 36 hours of its discovery, § 5(1)) also apply to Clients from outside the EEA. If the law of the Client’s country requires a shorter deadline from the Client, we inform the Client without undue delay so that it can meet that deadline, but we do not commit to a deadline shorter than the one in the Data Processing Agreement.
  10. Currency of the limit. The amounts from § 8a(4)(2) of the Terms (fees over 12 months or PLN 500) are counted in Polish złoty. The Client pays for the services in the Service in this currency, also where the Price list shows prices indicatively in another currency.
  11. Liability towards Clients who are not Consumers. The limitations and exclusions of liability from § 8a(4) of the Terms and § 8(5) of the Data Processing Agreement apply under Polish law as the governing law. They do not exclude provisions of the Client’s country that apply regardless of the choice of law. The sections R introduce no separate limitations or exceptions to them, except for the highlighting in section R.2. For sub-processors on the Sub-processor List we are liable as for our own acts (Data Processing Agreement, § 4(2)).
  12. Consumers. Towards Consumers and Sole traders with consumer rights this document introduces no limitations or exclusions of liability: points 10 and 11 and points 7 and 8 of section R.2 do not apply to them. We are liable to them on general principles (Terms, § 8a(7)), and the choice of Polish law does not deprive them of the protection granted by mandatory provisions of the law of their country of habitual residence (Terms, § 13(2)).
  13. No local model agreements. We do not conclude with the Client separate local model data protection agreements (e.g. the International Data Transfer Agreement, BAA agreements or standard contractual clauses with the Client), unless agreed in writing.
  14. No declaration of compliance. We do not declare certificates or “compliance” with the law of the Client’s country. Our obligations are the Terms, the Data Processing Agreement with its security measures under § 3 of the Data Processing Agreement, and this document.

R.1 United Kingdom

  1. Where the Client is subject to the UK GDPR, references to the GDPR in the Terms and the Data Processing Agreement are also read as references to the UK GDPR and the Data Protection Act 2018. With regard to the data the Client entrusts to us, we are a processor within the meaning of Article 28 of the UK GDPR.
  2. We process data in Poland (EU); British law recognises the EEA states as ensuring adequate data protection. Further transfer to the USA by Cloudflare is based on the UK Extension to the Data Privacy Framework, which Cloudflare declares. For providers of artificial intelligence models the transfer basis is being established (Sub-processor List) – this also applies to data from the United Kingdom.

R.2 United States

  1. If the Client is subject to the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) or a similar state law, then with regard to the data it entrusts to us, we act as its service provider / processor.
  2. We process these personal data solely for the business purposes described in § 2(1) of the Data Processing Agreement: preparing the Project and revisions based on the Source website and the Client’s materials, maintaining its website on our server, forwarding to it messages from forms, counting visits, running the Shop (orders, Buyer accounts, e-mail messages to Buyers), backups, exporting data at the Client’s request and deleting it. Beyond these purposes we use this data only for the security of the Service and for aggregate statistics from which no person or Client can be identified.
  3. We do not sell personal data and do not make it available for behavioural advertising (sell / share). We do not retain, use or disclose them for any other purpose, including any other commercial purpose, nor outside our direct relationship with the Client. We do not combine them with data from other sources or with data of other Clients, unless the service for the Client requires it. We do not use the Projects of a Client whose country is the United States as a starting point for the projects of other Clients (Terms, § 3(9)).
  4. We provide this data with the protection described in the Data Processing Agreement, including reasonable security measures under its § 3(4).
  5. The Client may take reasonable steps to verify that we use the data in accordance with its obligations under the CCPA (§ 6 of the Data Processing Agreement), and – if it finds unauthorised use – may demand that it be stopped and its effects removed. We will notify the Client if we determine that we can no longer meet the obligations from this section.
  6. We help the Client respond to consumer requests (§ 3(5) of the Data Processing Agreement).
  7. DISCLAIMER OF WARRANTIES. TO THE EXTENT PERMITTED BY LAW, APART FROM THE OBLIGATIONS EXPRESSLY DESCRIBED IN THE TERMS AND THE DATA PROCESSING AGREEMENT, WE PROVIDE THE SERVICE AS IS AND AS AVAILABLE AND GIVE NO IMPLIED WARRANTIES, INCLUDING OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT OF THE RIGHTS OF THIRD PARTIES.
  8. LIMITATION OF LIABILITY. TO THE EXTENT PERMITTED BY LAW, WE ARE NOT LIABLE FOR LOST PROFITS OR FOR CONSEQUENTIAL, SPECIAL OR PUNITIVE DAMAGES, AND OUR TOTAL LIABILITY IS LIMITED IN ACCORDANCE WITH § 8a(4)(2) OF THE TERMS AND POINT 10 OF THE GENERAL PART, UNDER POLISH LAW (POINT 11 OF THE GENERAL PART). THESE LIMITATIONS DO NOT APPLY TO DAMAGE CAUSED INTENTIONALLY, TO FRAUD, OR TO LIABILITY THAT CANNOT BE LIMITED UNDER THE LAW.
  9. Points 7 and 8 do not apply to Consumers (General part, point 12).

R.3 Switzerland

  1. If the Client is subject to the Swiss Federal Act on Data Protection (DSG / LPD / FADP), references to the GDPR are also read as references to that Act. With regard to the data the Client entrusts to us, we are a processor (Auftragsbearbeiter / sous-traitant, Article 9 DSG). The general consent in § 4(1) of the Data Processing Agreement is prior consent to sub-processors within the meaning of Article 9(3) DSG.
  2. We process data in Poland, which Switzerland recognises as a country with an adequate level of protection. Further transfer to the USA by Cloudflare is based on the Swiss-U.S. Data Privacy Framework, which Cloudflare declares. For providers of artificial intelligence models the transfer basis is being established (Sub-processor List) – this also applies to data from Switzerland.

R.4 Ukraine

  1. If the Client is subject to the Ukrainian law on the protection of personal data, the Client is the володілець and we – with regard to the data it entrusts to us – are the розпорядник. The Data Processing Agreement, concluded in electronic form, defines the purpose and scope of processing (§ 2); we process data only for that purpose and within that scope.
  2. We process data in Poland, in the EEA, which Ukrainian law recognises as ensuring adequate data protection. Further transfers to sub-processors outside the EEA (Cloudflare and providers of artificial intelligence models from the Sub-processor List) may require an assessment under Ukrainian law; the Client carries it out (General part, points 7–8).

Changes in this version

Version 1.1 (published 4 November 2026) contains corrections made before version 1.0 took effect. It binds a Client from outside the EEA from the moment of their acceptance – when placing an Order or in the Client Panel:

  • the country of the Client is the country given in the invoice details on the day of the event; a change of country to one outside the EEA requires acceptance (point 1); this document binds from acceptance, without tacit consent (point 2),
  • the limitations of liability apply under Polish law, without separate rules in sections R.1, R.3 and R.4; the limit is counted in Polish złoty (points 10 and 11),
  • USA: data only for the service, security and aggregate statistics; projects are not used as a starting point for other Clients; no declaration of CCPA compliance; exclusions written in capital letters (R.2),
  • transfer bases are given only to the extent we can demonstrate (point 6, R.1–R.3),
  • towards Consumers and sole traders with consumer rights this document still does not limit liability (point 12).