Data Processing Agreement

The business accepting the closed-beta terms is controller of the customer records it enters or asks OfraVo to collect. Jakub Kamiński, ul. Górna 12/4, 72-003 Bezrzecze, Poland; support.ofravo@gmail.com, is processor for those records. This agreement is incorporated into the accepted beta terms. Account administration and OfraVo’s own records are separate controller processing under the Privacy Policy.

Processing covers collection, organization, storage, presentation, scheduling, customer notifications, invoice generation and delivery, export, correction and deletion for the single-owner Core service. Data subjects are business customers and their contacts. Data includes names, contact and service addresses, order and appointment records, invoices, recorded payments/refunds, costs, business communications and necessary identifiers. No health records, card numbers, SSNs or other sensitive-category processing is instructed by this agreement.

Duration is the service period, agreed retrieval period and completion of return/deletion, subject to narrowly justified legal retention. Use of documented functions and verified written support instructions are documented processing instructions. We act only on those instructions, including for transfers, unless law requires otherwise; we inform the controller before legally required processing unless prohibited. We notify the controller if an instruction appears unlawful.

Access is limited to authorized persons subject to confidentiality obligations. Measures appropriate to the processing include tenant isolation, authenticated owner checks, restricted server privileges, private invoice storage, transport security, guarded financial writes, audit records, encrypted external file backups, operator MFA and incident/recovery procedures. The controller is responsible for its own lawful collection, devices and credentials.

We maintain appropriate technical and organizational measures and review their effectiveness. We do not promise perfect security or recovery without any loss. Changes must not reduce protection below applicable contractual and legal requirements.

The controller gives general written authorization for Supabase (database, Auth, Storage and functions), Vercel (application/APIs), Cloudflare (network/security and encrypted R2 backups), Resend (transactional email) and GitHub (CI, health and backup automation) for the purposes described in the Privacy Policy. Their relevant subprocessors may act within that authorized service chain subject to equivalent applicable protections.

Support through Google/Gmail is limited to minimal necessary support correspondence; it is not authorization to send full customer records. AI offer scanning through OpenAI is limited to business price-list images without private customer information. Processing personal customer information through additional support or AI services requires an appropriate documented arrangement before that use.

We must bind subprocessors to the applicable data-protection obligations and remain responsible to the controller for our subprocessor obligations as required by law. Before adding or replacing a subprocessor for customer personal data, we provide advance notice with a reasonable opportunity for a reasoned objection, normally at least 15 days. An unresolved objection must be addressed before the affected processing, or through a practicable export and termination route.

EEA storage does not establish EEA-only processing. Restricted transfers must be covered by an applicable lawful mechanism and necessary supplementary measures. On request we provide relevant information about subprocessors and safeguards, with proportionate protection for confidential information and security.

Taking account of the nature of processing and information available, we assist with data-subject requests, security, impact assessments and regulatory consultation as applicable. Requests received directly about customer records are forwarded to the controller unless instructed or legally required otherwise.

We notify the controller without undue delay after becoming aware of a personal-data breach, providing known scope, likely effects, mitigation and contact details, with updates as information becomes available. A routine availability incident is evaluated separately and is not automatically a personal-data breach.

We make information needed to demonstrate compliance available and allow proportionate audits or inspections as required by law. Scheduling and safeguards may protect other businesses’ data and system security, but must not prevent a necessary response to a regulator or material incident.

At the controller’s choice, we return or delete personal data when processing ends unless applicable law requires narrow retention. The 180-day retrieval opportunity does not postpone a valid earlier deletion instruction. We review source rows, files, export copies, access and provider-held copies according to applicable instructions and schedules, documenting specific exceptions.

Backup copies remain isolated from normal use until expiry under applicable schedules. Any restore must reapply current erasure instructions before access and delivery workers resume. We maintain a minimal separate erasure journal to support this reconciliation, with restricted access and retention reviewed against remaining restorable copies and applicable legal necessity.

The beta terms’ contractual allocation of liability applies only to the extent lawful and does not restrict mandatory statutory rights of data subjects, supervisory powers or obligations that cannot lawfully be limited. If this agreement conflicts with the service terms concerning personal-data processing, this agreement prevails.