Data Processing Agreement

This Data Processing Agreement (the "DPA") is made between the Client as data controller (the "Controller") and Michał Fox, trading as Kouryer, in Kraków, Poland, email hello@kouryer.com, as processor ("Kouryer").

The DPA is entered into by accepting the Terms of Service when opening an account in the Panel. It forms part of the Agreement and applies for as long as the Agreement lasts and, after it ends, until the data is deleted under section 10.

The DPA implements Article 28 of Regulation (EU) 2016/679 (GDPR). Where the UK GDPR also applies to the processing, references to the GDPR apply to it accordingly.

Capitalised terms have the meaning given in the Terms or in the GDPR. On personal data this DPA prevails over the Terms.

Kouryer processes data only to deliver the Subscription: picking Target companies and Contact persons, contacting them on the Controller's behalf, handling replies, booking calls and reporting in the Panel.

Processing covers: collecting data from publicly available sources according to the Ideal client profile, checking that addresses are valid, recording, storing, organising, sending Messages, receiving and reading replies, marking statuses, making the data available to the Controller in the Panel, and deleting it.

Processing lasts for the term of the Agreement and the period described in section 10.

Processing concerns:

1. 1)Contact persons at Target companies: owners, directors, employees and contractors;
2. 2)people who replied to a Message or were named in a reply as the right contact;
3. 3)people on the Controller's Exclusion list;
4. 4)participants of calls booked on the Controller's calendar.

The data processed is: first and last name, job title or role, business email address, company name and website, country and city, the address of a public professional profile where it is the source of the data, the content of correspondence, reply status, call time, notes by the Account manager and Users, and technical Message data such as the sending date and bounce information.

We do not process special categories of data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR). The Controller does not provide such data. If it appears in a reply, we only keep it as part of the thread and do not process it further.

Kouryer processes data only on the documented instructions of the Controller. Instructions are the Agreement, the Campaign settings in the Panel (Ideal client profile, markets, audience, Exclusion list, offer and tone) and Tickets.

If, in our opinion, an instruction infringes the GDPR or other data protection law, we tell the Controller without delay and suspend it until it is clarified.

We do not process the data for our own purposes, do not sell it, do not combine it with other clients' data and do not use it in other clients' campaigns. The only exception is the Suppression list in section 10.3, kept so that people who opted out receive no Message from any Kouryer client.

Kouryer:

1. 1)gives access to the data only to authorised people bound by confidentiality;
2. 2)applies the security measures described in section 6;
3. 3)assists the Controller with data subject requests: we forward requests for access, rectification, erasure or restriction to the Controller within 3 Business days, and we act on objections to contact and opt-outs immediately, as set out in the Outreach Policy;
4. 4)assists the Controller with its obligations under Articles 32 to 36 GDPR, in particular by providing the description of processing needed for a legitimate interest assessment and an impact assessment;
5. 5)notifies the Controller of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, describing its nature, the categories and approximate number of people affected, the likely consequences and the measures taken;
6. 6)keeps a record of the categories of processing activities (Article 30(2) GDPR).

The Controller may check our compliance with this DPA once a year and after a personal data breach. It gives at least 14 days' notice and carries out the audit primarily through questions and documents, and on site after agreeing a date, in a way that does not reveal other clients' data. The Controller bears the cost of the audit.

We apply technical and organisational measures appropriate to the risk, in particular:

1. 1)encrypted connections to the Website and the Panel (HTTPS);
2. 2)User passwords stored only as a scrypt hash with a random salt;
3. 3)a session held in a signed cookie that page scripts cannot read, valid for 14 days;
4. 4)roles in the Panel (owner, team member, view only) and access to data and attachments only from the account they belong to;
5. 5)separation of each client's data;
6. 6)storage on servers in Poland, with administrative access limited to authorised people;
7. 7)SPF, DKIM and DMARC records on every Sending domain;
8. 8)data minimisation: we collect only the data needed for contact, and the Suppression list keeps only the address or domain and the date;
9. 9)backups and a procedure for handling personal data breaches.

We may replace these measures with equally or more effective ones.

The Controller gives general authorisation for sub-processors in the following categories:

We give at least 14 days' notice by email and in the Panel before changing a sub-processor or adding a new category. During that time the Controller may raise a reasoned objection. If we cannot find a solution, the Controller may terminate the Agreement effective on the day of the change, including during the minimum term.

Each sub-processor has data protection obligations no weaker than those in this DPA. We are liable to the Controller for its acts as for our own.

The calendar the Controller connects in the Panel (Google Calendar, Microsoft Outlook or its own booking link) runs with the provider the Controller chose, on the Controller's account and terms. It is not our sub-processor.

We store Campaign data in Poland. Data leaves the European Economic Area only:

1. 1)to Contact persons in third countries, in the content of Messages, which is the very service the Controller ordered;
2. 2)to the push notification services in section 7.1, in encrypted form;
3. 3)to the Controller and its Users when they use the Panel from a third country.

If the Controller is based outside the EEA and the law requires it, at the Controller's request we sign the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, in the module for transfers from a processor to a controller, and for transfers subject to UK law the applicable UK addendum.

The Controller is responsible for the lawfulness of processing, in particular for:

1. 1)the legal basis for contacting Contact persons, including a legitimate interest assessment where that is the basis;
2. 2)the information duty under Article 14 GDPR; in every Message we state, on the Controller's behalf, the identity of the sender, the source of the data and how to object, with a link to the information in the Privacy Policy;
3. 3)the compliance of the offer and the Campaign with the electronic communications and consumer protection rules in the recipients' countries described in the Outreach Policy;
4. 4)keeping the Exclusion list up to date and the lawfulness of any data it provides for a Campaign itself.

The Controller does not instruct us to contact people on the Suppression list, private addresses or people outside the Ideal client profile.

For 30 days after the Agreement ends the Controller may download data from the Panel as set out in the Terms of Service. Then, within 30 days, we delete all Campaign data, including the content of the Sending mailboxes, and remove it from backups in their normal rotation.

At the Controller's request we delete the data earlier, or return it as a CSV file with the correspondence and then delete it. We confirm deletion in Documentary form.

We do not delete Suppression list entries: the address or domain and the opt-out date. We keep that list as a controller under the Privacy Policy, so that nobody who opted out is contacted again.

We keep data longer only where the law requires it, and tell the Controller so.

We are liable for damage caused by processing that breaches this DPA or the obligations the GDPR places directly on processors, under Article 82 GDPR.

Between the Parties, the limits of liability in the Terms of Service apply to the extent the law allows.

This DPA is governed by Polish law. Disputes are settled by the court identified in the Terms.

This DPA is available in Polish and English. If the versions differ, the Polish version prevails.

This DPA applies from 24 October 2026.