Data Processing Agreement (DPA)

Working translation of the Polish version 2.1 of 19 November 2026, not reviewed by a lawyer. The Polish version is binding: you accept the Polish version, and in case of any discrepancy the Polish text prevails. Clients from outside the EEA: see also the Provisions for Clients outside the EEA.

This agreement sets out how we process the personal data that the Client entrusts to us in the Webomat Service (Article 28 GDPR).

The parties are:

the Client, who uses the Service (in accordance with the Terms) – the controller of the data,
JCD.PL spółka z ograniczoną odpowiedzialnością, with its registered office in Warsaw, ul. gen. Klemensa Stanisława Rudnickiego 1/35, 01-858 Warszawa, KRS 0000782199, NIP 1182192683, REGON 383120500, e-mail: [email protected] – the processor (hereinafter “we” or “us”).

Capitalised terms (e.g. Service, Client Panel, Source website, Project, Shop, Buyer) have the meanings given to them in the Terms.

§ 1. Conclusion and term

The Client concludes this agreement electronically (Article 28(9) GDPR): it ticks the acceptance box when creating an Account or placing an Order, or clicks “I accept” in the Client Panel. We record who accepted this agreement, when, from which IP address and which version of the agreement (acceptance register).
This agreement applies for as long as we provide the Client with services under which we process data on its behalf (preparing the Project and revisions, maintaining the website, forms, statistics, the Shop), and then until the activities described in § 7 are completed.
In matters concerning personal data, this agreement prevails over the Terms.
This version replaces the data processing agreement concluded so far as Annex 2 to the Terms.

§ 2. Subject matter and scope

We process data solely in order to provide the Client with the Service’s services: prepare the Project and revisions based on the Source website and the Client’s materials, maintain the Client’s website on our server, pass form messages on to the Client, count visits, run the Shop (orders, Buyer accounts, e-mails to Buyers), make backups, export data at the Client’s request and delete it. The Client also instructs us to create aggregate statistics from data in the Service (e.g. the number of Projects, pages and visits), from which no person or Client can be identified.
This agreement concerns persons whose data the Client enters into the Service or collects through its website:
1. persons whose data appear on the Source website and in materials provided by the Client (e.g. employees, collaborators, the Client’s customers, authors of reviews),
2. visitors to the Client’s website,
3. persons who send a contact form or sign up for the newsletter on the Client’s website,
4. Buyers in the Shop, including those who have a Buyer account.
Categories of data:
1. Source website content, materials and Project – data contained in the Client’s website or materials, e.g. names, job titles, photos of persons, contact details, reviews; screenshots of the Source website; the content of revision requests and of chats with the Service (the revision chat, the consultant in the Client Panel, the Shop setup assistant), if it concerns the Project or the Client gives data of other persons in it;
2. website visits – in visit statistics, instead of the IP address, a one-way hash with a key that is changed daily (once the key is deleted, after no more than 2 days, it cannot be linked to a person), the page, the previous page and the day;
3. forms and newsletter – first name, e-mail address, telephone number, message content, page, date of sending; for newsletter sign-ups also the consent and additional fields of the sign-up form;
4. Buyers – first and last name, e-mail address, telephone number, delivery and billing addresses, company name and tax ID (NIP), order data (goods, amounts, payment and delivery method, payment status, shipment number and label), invoices, statements of withdrawal from a contract and complaints, consents ticked when ordering together with the IP address and time they were given, consent to marketing information;
5. Buyer accounts – in addition, a hash of the password (we do not know passwords), saved addresses, registration and login dates, hashes of login tokens and a shortened browser identifier.
The Service is not intended for processing special categories of personal data (Article 9 GDPR), e.g. health data. The Client does not put such data in the materials or in the Project. However, the content of a form message depends on the person who sends it: if the Client’s website concerns e.g. healthcare services, a message may contain such data. We then process it in the same way as other messages (§ 7(3)), and the Client assesses whether the form on its website is an appropriate contact channel.
Our own purposes. In some matters we decide on the purposes and means of processing – to that extent we are the controller, not the processor, and we apply the Privacy Policy. This concerns: data of the Client’s Account and of persons who use the Service on its behalf, orders, payments and invoices; the introductory chat and the conversations with the Service’s chats insofar as they concern the Client itself and its orders, and messages that we send to the Client; server logs (IP address, date and time, page address, address of the previous page and browser information – also from traffic on Clients’ websites), which we keep for the security and maintenance of the Service for up to 90 days, and for protecting the Free preview against abuse; use of a Free preview as a starting point for a further project for the same Source website (§ 3(9) of the Terms – without materials provided by the Client); reports of unlawful content; and the acceptance register of documents, which we keep as evidence of the conclusion of the agreement for the limitation period of claims, including after the end of cooperation.
Project event log (the work of the agents, revision requests, chats with the Service, results of automatic checks of revision requests, website maintenance steps) we process on the Client’s behalf. We provide it to the Client on request together with the data export (§ 7(2)), and we delete it together with the Project or the Account. We do not keep it after the end of the agreement, unless the law requires it.

§ 3. Our obligations

We process data only on the Client’s documented instruction. The instruction is this agreement, the Terms, and the actions and settings that the Client carries out in the Service (e.g. ordering a Project, revisions, enabling a form, statistics or the Shop, Shop settings). We transfer data to countries outside the European Economic Area (EEA) only to the extent described in § 4, unless Union or Polish law requires it – in that case we inform the Client about it before processing, unless the law prohibits such information.
If we consider that an instruction of the Client infringes the GDPR or other data protection laws, we promptly inform the Client.
Only persons authorised by us, who are bound by confidentiality, have access to the data.
We apply the security measures required by Article 32 GDPR, in particular:
1. encrypted connections (HTTPS) to the Service, to Clients’ websites and to the Shop,
2. Buyers’ passwords stored only as a hash, and the Shop’s access keys to payment operators, carriers and mail – in encrypted form,
3. a separate database for each Shop,
4. Clients’ published websites as static files, without running server-side code,
5. the server on which the artificial intelligence agents work, with no access from the internet and connected to the Service through an encrypted tunnel; Buyers’ data and form messages do not reach the agents,
6. visit statistics without IP addresses and without cookies,
7. access control to the operator panel and to the servers,
8. backups that allow data to be restored after a failure.
We help the Client respond to requests of data subjects (e.g. access, rectification, erasure): the Client Panel allows viewing and exporting form messages, and the Shop panel allows viewing, exporting (CSV files), correcting and deleting Buyers’ data. In other matters we help upon a request sent to [email protected].
We help the Client meet its obligations under Articles 32–36 GDPR (security, breaches, impact assessment, consultation with the supervisory authority), to the extent permitted by the nature of the service and the information available to us.
We make available to the Client the information needed to demonstrate that we comply with this agreement and Article 28 GDPR (§ 6).

§ 4. Sub-processing

The Client gives us a general authorisation to use sub-processors (further processors). The current list of sub-processors – with the country, scope of data, place of processing and transfer basis – is available at webomat.io/en/subprocessors and forms part of this agreement.
We pass to sub-processors only the data needed for their task, on the basis of agreements ensuring the data protection required by Article 28(3) GDPR; on request we provide their material terms. Where such an agreement or the transfer basis is still being established for a given sub-processor, the Sub-processor List says so expressly. We are responsible towards the Client for their actions as for our own (Article 28(4) GDPR).
The content needed to prepare the Project reaches the providers of artificial intelligence models: the content and screenshots of the Source website, materials, the description of expectations, revision requests and chats with the Service. Buyers’ data, form messages, newsletter sign-ups, logs or visit statistics do not reach them.
Some sub-processors process data outside the European Economic Area (EEA). The list states, for each of them, the country and the transfer basis that we can demonstrate (a European Commission decision finding an adequate level of protection, including the EU-US Data Privacy Framework, or standard contractual clauses (SCC)). Where there is no Commission decision for a given country, or the transfer basis is still being established, the list says so expressly.
We inform the Client in the Client Panel at least 14 days in advance of a planned addition or change of a sub-processor, and we publish a new version of the list. During that time the Client may object with reasons at [email protected]. In that case we look for a solution (e.g. processing without that entity). If we do not reach agreement, the Client may terminate the services to which the objection relates, with immediate effect and without additional costs; for the paid but unused period of hosting of the website or Shop, we refund a proportionate part of the fee.
Providers selected by the Client are not our sub-processors: payment operators, carriers, the invoicing software and the Client’s mail provider in the Shop, the newsletter provider, tools embedded on the website (e.g. Google Analytics, the Meta pixel, maps, videos, booking calendars), and providers through which the Client itself directs traffic to its domain (e.g. the Client’s own Cloudflare account). We pass data to them on the Client’s instruction, on the basis of contracts that the Client concludes with them itself; the Client is responsible for the legal basis of this transfer and for these contracts.

§ 5. Personal data breaches

We notify the Client of a personal data breach concerning data entrusted by the Client without undue delay, and no later than 36 hours after discovering it, by e-mail to the Account address.
We provide the information the Client needs to notify the supervisory authority and to inform data subjects (Article 33(3) GDPR): the nature of the breach, the categories and approximate number of persons and records, the likely consequences, the measures taken and proposed, and the contact person’s details. If we do not know all the information immediately, we provide it in stages.
Notifying the supervisory authority of a breach and informing data subjects is the responsibility of the Client as controller.

§ 6. Audit

The Client may check whether we comply with this agreement. In the first instance we answer questions sent to [email protected] within 14 days.
An audit (including by an auditor indicated by the Client and bound by confidentiality) is possible if we are notified at least 14 days in advance, on working days, no more than once a year, unless a breach of the Client’s data has occurred or the supervisory authority requires it. An audit may not breach the confidentiality of other Clients’ data or the security of the Service.
The Client bears the costs of the audit, and our participation in an audit exceeding 4 hours of work is charged at a rate agreed before the audit. If the audit shows that we have materially breached this agreement, we bear the costs.

§ 7. End of processing

After the hosting of the website or Shop ends, we proceed in accordance with § 3a(11) and § 11(2) of the Terms: for 60 days from the last order, the functions for handling placed orders remain available, and until the website files are deleted the Client may download the Project and export the Shop data. Afterwards we delete the website files, screenshots and files of the Source website, materials and Shop data (including the conversation with the Shop setup assistant).
The Project together with its revision history remains in the Client’s Account until the Client deletes it (in the Client Panel) or requests deletion of the Account. Before deletion, the Client may download its data in a commonly used electronic format (ZIP archive of the website, CSV files from the Shop and forms), and on request sent to [email protected] we also provide it with the Project and Account event logs (§ 2(6)). Deleting a Project also deletes its form messages, statistics, event log and Shop data. Deleting the Account deletes all its Projects and conversations.
Contact form messages and newsletter sign-ups are available in the Client Panel (with export to a file). We keep them until the Client deletes the Project or the Account is deleted, and after the end of hosting of the website – until the time limit in § 7(1). We do not delete them earlier on our own initiative: the Client, as controller, decides how long they are needed (§ 8), and on the Client’s instruction, sent to [email protected], we delete the indicated entries (if necessary, before that time has elapsed). We notify the Client by e-mail of each new form message. We keep Buyer account data until the account is deleted by the Buyer or the Client, and we delete unconfirmed accounts (without orders) after 30 days.
We make backups so that data can be restored after a failure. Deleted data disappear from backups in the cycle of their overwriting (we provide that cycle to the Client on request). We do not use backups for other purposes.
Deletion does not cover data that we process as controller (§ 2(5)), including the acceptance register and accounting documents, nor data which Union or Polish law requires us to keep. We do not retain entrusted data, including the event log (§ 2(6)), for our own purposes.

§ 8. Client’s obligations and liability

The Client is responsible for ensuring that:
1. it has a legal basis for processing the data that it enters into the Service or collects through its website and Shop, and it has the right to pass to us the Source website content and materials together with the personal data of the persons they contain,
2. it informs data subjects about the processing (Articles 13 and 14 GDPR) – including through the privacy policy of its website; the Client checks the privacy policy template prepared in the Service and changes it if necessary,
3. it obtains consents where required (e.g. for cookies of analytics and advertising tools, newsletter, marketing information), and sets up tools on its website in accordance with the law,
4. it exercises the rights of data subjects and responds to their requests,
5. if it prepares or maintains a website for another controller (e.g. as an agency for its client) – it has that controller’s consent to entrust data to us on the terms of this agreement; in that case we are a sub-processor, and the Client passes instructions to us.
We are liable for damage caused to a data subject in accordance with Article 82 GDPR: where we have not complied with obligations that the GDPR imposes directly on processors, or where we acted outside the Client’s lawful instructions or contrary to them. This agreement does not change liability towards such persons or liability towards the supervisory authority.
If one party pays compensation to the data subject for damage for which the other party is responsible, it may claim from the other party reimbursement of the corresponding part (Article 82(5) GDPR).
The Client, if it is neither a Consumer nor a sole trader with consumer rights, indemnifies us and bears the costs (including reasonable legal costs) of third-party claims and proceedings that result from the Client’s violation of law, of the Terms or of third parties’ rights to materials, from the Client’s lack of a legal basis for processing data, from data entered contrary to this agreement, or from our performance of the Client’s instruction in accordance with its content – unless the damage results from our breach of this agreement or we did not warn the Client, although we found that the instruction violates the law (§ 3(2)). The indemnity does not cover administrative fines imposed on us. The same wording appears in § 8a(4)(4) of the Terms.
Towards a Client who is neither a Consumer nor a sole trader with consumer rights, our liability under this agreement and under the Terms is subject to a single aggregate cap and to the exclusions in § 8a(4) of the Terms: the cap is the higher of two amounts – the sum of fees paid by the Client in the 12 months before the event that caused the damage, or PLN 500. The cap also covers the Client’s recourse claims against us under Article 82(5) GDPR (point 3) and our liability for sub-processors (§ 4(2)). The cap and the exclusions do not apply to damage caused intentionally or to liability that cannot be excluded or limited under the law, and the exclusions do not cover loss or breach of data protection in the Service (§ 8a(6) of the Terms). Towards Consumers and sole traders with consumer rights, point 4 and this point do not apply – we are liable towards them on general principles.

§ 9. Changes and governing law

We inform the Client of a change to this agreement in the Client Panel or by e-mail at least 14 days before the planned date of its taking effect. A new version binds the Client from the moment it accepts it in the Service (e.g. with a button in the Client Panel) – we do not apply tacit acceptance. Until acceptance, the version previously accepted applies. A Client who does not accept the changes may terminate the services under which we process data on its behalf, with immediate effect and without additional costs (refund rules as in § 4(5)).
A change to the list of sub-processors takes place in accordance with § 4(5) and does not require a change of this agreement.
Matters not regulated here are governed by the GDPR and Polish law.
Version 2.1 of this agreement applies from 19 November 2026 to Clients who accept it (point 1), and replaces, before it takes effect, version 2.0 published on 4 November 2026. The earlier version was Annex 2 to the Terms (versions 1.1 and 1.2).

Changes in this version

Version 2.1 – corrections before version 2.0 took effect:

We create aggregate statistics without the possibility of identifying persons or the Client on the Client’s instruction (§ 2(1)); we keep server logs as controller (§ 2(5)).
The Project event log is provided to the Client with the export and deleted together with the Project or the Account (§ 2(6), § 7).
Sub-processors: agreements ensuring the protection required by Article 28(3) GDPR, and transfer bases only to the extent we can demonstrate (§ 4).
Liability (§ 8): the limit covers recourse claims under Article 82(5) GDPR and liability for sub-processors; the indemnity is narrower, without Consumers and without administrative fines; wording consistent with § 8a of the Terms.
A change to the agreement binds from acceptance, without tacit consent (§ 9).

Version 2.0 compared with Annex 2 to the Terms:

This agreement is a separate document and replaces Annex 2 to the Terms.
It covers all data that we process for the Client: content of the Source website and materials (with personal data of persons), website visits, forms and newsletter, statistics and the Shop (§ 2).
We list our own purposes, for which we are the controller, including the acceptance register (§ 2(5)).
The full list of sub-processors, including the providers of artificial intelligence models, is on a separate page; we announce changes in the Client Panel at least 14 days in advance, with a right to object (§ 4).
The description of security measures corresponds to what we actually apply (§ 3(4)); we describe backups in general terms (§ 7(4)).
The rules on audit and on deleting data after the end of services are described (§ 6 and § 7).
Liability, recourse and indemnification (§ 8) are consistent with the new § 8a of the Terms.