Working translation of the Polish version 1.1 of 19 November 2026, not reviewed by a lawyer. The Polish version is binding: you accept the Polish version, and in case of any discrepancy the Polish text prevails. Clients from outside the EEA: the transfer bases in the table are those under the GDPR; how they apply under the law of your country is described in the Provisions for Clients outside the EEA.
The Client using Webomat is the controller of the data of persons on its website and in its Shop: visitors, persons sending forms, Buyers, and persons whose data appear on the Source website and in the Client’s materials. We – JCD.PL spółka z ograniczoną odpowiedzialnością, with its registered office in Warsaw, ul. gen. Klemensa Stanisława Rudnickiego 1/35, 01-858 Warszawa, KRS 0000782199, NIP 1182192683, REGON 383120500, e-mail: [email protected] – process this data on the Client’s instruction, on the basis of the Data Processing Agreement.
On this page we list all entities to which we further entrust the processing of this data (sub-processors). The list forms part of the Data Processing Agreement (§ 4). We are responsible towards the Client for sub-processors as for our own actions. We conclude agreements with sub-processors that ensure the data protection required by Article 28(3) GDPR, and on request we provide their material terms. Where such an agreement or the transfer basis for data outside the EEA is still being established, the table says so directly.
Last change to the list: 19 November 2026 (version 1.1 – corrections to the description of transfer bases before version 1.0 took effect; the list of sub-processors unchanged).
Sub-processors of Clients’ data
| Entity | Registered office | What it does for Webomat | Data | Where it processes | Transfer basis | Since |
|---|---|---|---|---|---|---|
| OVH (OVHcloud group) | France / Poland | Servers on which the Service runs: Clients’ websites, Shops, forms, statistics, the database, backups and the server of the artificial intelligence agents (screenshots and analysis of the Source website) | All data in the Service | Poland (OVH data centre) | European Economic Area – not applicable | since the launch of the Service (30 September 2026) |
| Cloudflare, Inc. | USA | Protection against attacks and traffic acceleration: connections to webomat.io (including form submissions, the visit counter, the cart, orders and Buyer accounts) and to websites at the address name.webomat.io pass through the Cloudflare network; Cloudflare encrypts the connection and passes it on to our server | Network traffic: IP address, browser information and the content of pages and forms transmitted; Cloudflare does not store the Service’s database | A worldwide network of servers, usually closest to the user (for users in Poland – in Europe) | EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) and standard contractual clauses (SCC) in Cloudflare’s data processing agreement | since the launch of the Service (30 September 2026) |
| Anthropic, PBC | USA | The Claude artificial intelligence model for the agent that designs, codes, checks and revises the Project | Content and screenshots of the Source website, the Client’s materials (texts, photos, logo), the structured description of expectations, revision requests | USA | We use the Claude model on Anthropic subscription terms, without a data processing agreement and without standard contractual clauses. Transfer basis: being established | since the launch of the Service (30 September 2026) |
| JINGSHENG HENGXING TECHNOLOGY PTE. LTD. (Z.ai service) | Singapore | The GLM artificial intelligence model for the agent (as above) and for the Service’s chats: the introductory chat, the revision chat, the consultant in the Client Panel, the Shop setup assistant, the logo generator and checking of names in the Service’s domain | As above, and the content of conversations with the Service’s chats; in the conversation with the setup assistant also the Seller’s data (without keys and passwords – we mask them before sending) | Singapore | Singapore has no European Commission decision on an adequate level of protection. Transfer basis: being established (we are checking whether the terms of the service include standard contractual clauses). The Z.ai service belongs to the Zhipu AI group, whose parent company is based in China | since the launch of the Service (30 September 2026) |
| Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (DeepSeek) | China | The artificial intelligence model for the agent (as above) and for the Service’s chats (as above), and for preliminary checking of revision requests | As in the Z.ai row | China | China has no European Commission decision on an adequate level of protection, and we have not concluded standard contractual clauses with DeepSeek. Transfer basis: being established. Only content needed to prepare the Project and chat conversations reach DeepSeek – never Buyers’ data, form messages or visit statistics | from 12 October 2026 |
| OpenAI | USA | Generating images on the Client’s request in the website editor; a backup model for the Service’s chats when the others are unavailable | The description of the image entered by the Client; if used as the backup model – the content of the chat conversation | USA | Transfer basis: being established (we are checking whether the agreement with OpenAI includes standard contractual clauses) | from 1 October 2026 |
We send Service and Shop e-mails from our own mail server, which runs on OVH servers – we do not use external sending providers.
Buyers’ data, form messages, newsletter sign-ups, server logs or visit statistics do not reach the providers of artificial intelligence models. The Service’s chats (the introductory chat, the revision chat, the consultant in the Client Panel, the Shop setup assistant) are handled in turn by DeepSeek, Z.ai and OpenAI – the next one when the previous one is unavailable. Content of conversations that concerns the Project or the data of other persons we process on the Client’s behalf; content that concerns the Client itself and its orders, and the introductory conversation before an Account is created – as the controller.
Providers selected by the Client (not our sub-processors)
These entities receive data on the Client’s instruction, on the basis of contracts that the Client concludes with them itself. The Client is responsible for the legal basis of the transfer of data and for the contracts with them:
- payment operators in the Shop (PayU, Przelewy24, Tpay), carriers (InPost, DPD, DHL), invoicing software (Fakturownia) and the Client’s mail provider, when the Shop sends messages through the Client’s own mail server,
- the newsletter provider (e.g. MailerLite, Mailchimp), when the Client connects its sign-up form to it,
- tools embedded on the Client’s website and enabled after the visitor’s consent (e.g. Google Analytics, the Meta pixel, Google Maps, YouTube, Vimeo, Calendly, Booksy, ZnanyLekarz),
- providers through which the Client itself directs traffic to its domain (e.g. its own Cloudflare account) and with which it registers the domain.
Services for which we are the controller
For transparency: these entities help us for our own purposes described in the Privacy Policy, and not in processing data entrusted by Clients:
- PayU S.A. (Poland) – payments by Clients for Webomat services; PayU is a separate controller of the data provided at payment,
- Google Ireland Limited (Ireland) together with Google LLC (USA) – visit statistics for webomat.io (Google Analytics 4), only after consent in the cookie banner,
- LINK Mobility Poland sp. z o.o. (Poland, SMSAPI service) – SMS reminders about the end of website hosting, when the Client provides a phone number,
- providers of artificial intelligence models from the table above (on the same transfer bases) – also in the introductory chat before an Account is created and in the Service’s chats, when the conversation concerns the Client itself and its orders.
Changes to the list
We inform the Client in the Client Panel at least 14 days in advance of a planned addition or change of a sub-processor, and we publish a new version of the list here. During that time the Client may object with reasons at [email protected]; if we do not reach agreement, it may terminate the services to which the objection relates, without additional costs (§ 4(5) of the Data Processing Agreement).
- Version 1.1 (19 November 2026) – corrections before version 1.0 took effect: transfer bases only to the extent we can demonstrate; the list of sub-processors unchanged.
- Version 1.0 (published 4 November 2026) – first publication of the full list. Previously, Annex 2 to the Terms listed OVH and Cloudflare, and the providers of artificial intelligence models were listed in the Privacy Policy.