Data Processing Agreement (DPA)

• Controller — the B2B Customer that determines the purposes and means of processing end users' data;
• Processor — Mateusz Popielarz, operating under the Cortify Labs brand (cortifylabs.com), processing data solely on the Controller's documented instructions;
• GDPR — Regulation (EU) 2016/679.

Processing covers activities necessary to provide the AI assistant: receiving and storing conversation content, generating answers using language models, and supporting related features (e.g. summaries, forms). The purpose and scope are determined by the Controller.

Processing may involve identification and contact data (e.g. name, email, phone, company) and the content of messages from the Controller's end users. The Controller undertakes not to entrust special categories of data without separate arrangements.

Processing lasts for the term of the main services agreement, subject to the provisions on return and deletion of data.

• process only on the Controller's documented instructions;
• ensure confidentiality of persons authorised to process the data;
• implement security measures appropriate to the risk (Art. 32 GDPR);
• promptly inform the Controller if an instruction infringes data protection law.

The Controller gives general authorisation to engage sub-processors. The current list includes: Railway, Cloudflare, Resend, Microsoft (Azure), Langfuse, Sentry and ipapi. The Processor undertakes to impose on sub-processors obligations no less protective than this DPA and to inform the Controller of intended changes to the list, allowing objections.

Transfers to sub-processors outside the EEA rely on the Standard Contractual Clauses approved by the European Commission together with additional safeguards (Art. 46 GDPR).

The Processor assists the Controller, as far as possible, in fulfilling data subject requests and obligations under Articles 32–36 GDPR, including data protection impact assessments (DPIA).

Upon termination of the services, the Processor, at the Controller's choice, deletes or returns the data and deletes existing copies, unless retention is required by law.

The Processor makes available the information needed to demonstrate compliance with Art. 28 GDPR and allows audits, including inspections, by the Controller or an authorised auditor, within a reasonable scope and timeframe.

The Processor notifies the Controller of a personal data breach without undue delay and no later than 48 hours after becoming aware, providing the information needed to fulfil obligations under Articles 33–34 GDPR.

Liability of the parties is governed by the GDPR and the main agreement. Matters not regulated here are governed by Polish law and EU regulations. To execute a signed DPA please contact: [email protected].