Data Processing Agreement

This DPA forms part of the Terms of Service between BINARY BRAIN TECHNOLOGIES SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ ("Processor", "we"), whose company details are set out below, and the customer using Convertly ("Controller", "you").

"Personal Data" means any information relating to an identified or identifiable natural person. "Processing" means any operation performed on Personal Data. "Sub-processor" means any third party engaged by us to process Personal Data. "Data Subject" means the individual to whom Personal Data relates. "GDPR" means Regulation (EU) 2016/679.

We process Personal Data on your behalf to provide the Convertly service. Categories of data: names and email addresses of quiz respondents (including partial leads saved before a quiz is finished), their answers, scores and results; names and email addresses of your team members. Data subjects: your quiz respondents (leads) and your team members. Processing activities: storage, quiz rendering, scoring, lead management, analytics, sending emails (lead alerts to you, results to respondents), and delivering leads to the integrations you connect.

We shall: process Personal Data only on your documented instructions; ensure persons authorized to process data are bound by confidentiality; implement appropriate technical and organizational security measures; assist you in fulfilling data subject rights requests; delete or return Personal Data upon termination of the service; make available all information necessary to demonstrate compliance; allow and contribute to audits conducted by you or your auditor.

We implement the following security measures: encryption at rest (AES-256 via Supabase); encryption in transit (TLS 1.2+); row-level security for workspace data isolation; regular access reviews and security updates; incident detection and response procedures; automated backups with point-in-time recovery.

The sub-processors we currently use are listed in the table below. We will notify you before adding or replacing a sub-processor, and you may object within 30 days. Tools you connect yourself (for example email marketing or CRM integrations, Zapier or webhooks) receive lead data on your instruction and are not our sub-processors.

Personal Data is processed mainly in the EU (Supabase and Upstash in Frankfurt, application functions on Vercel in Frankfurt, Resend in Ireland, Sentry in Germany, PostHog EU cloud). Transfers outside the EU/EEA (Vercel's edge network and secondary function region, Anthropic for AI generation, Google sign-in) rely on the EU-US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses approved by the European Commission.

We will assist you in responding to data subject requests including: right of access (Article 15 GDPR); right to rectification (Article 16); right to erasure (Article 17); right to restriction (Article 18); right to data portability (Article 20); right to object (Article 21). Response timeline: within 72 hours of receiving your request.

We will notify you of any Personal Data breach without undue delay, and no later than 48 hours after becoming aware. Notification will include: nature of the breach, categories of data affected, approximate number of data subjects, likely consequences, measures taken.

We keep Personal Data for the duration of the service agreement. When you delete leads, quizzes or your account, the data is deleted from the production database immediately; database backups are kept for 7 days, so it is gone from them within 8 days. Quiz session and answer analytics are deleted after 180 days. On termination, data is deleted as described above unless the law requires us to keep it.

You may audit our compliance with this DPA once per year. Audits require 30 days written notice. We will provide reasonable cooperation and access to relevant documentation.

Our liability under this DPA is subject to the limitations set out in the Terms of Service. Each party is liable for damages caused by processing that infringes the GDPR.

This DPA is effective for the duration of your use of Convertly. Obligations regarding data deletion survive termination.