Version 1.0, effective from 2026-10-06. The Polish version prevails.
This agreement is concluded under Article 28 GDPR (Regulation (EU) 2016/679) and forms part of the contract for the Servavio service. It is concluded electronically when it is accepted at account registration by a person acting for the Controller; the version, date and IP address of the acceptance are recorded. No separate signature is needed.
1. Parties
Controller: the User of the Servavio service within the meaning of the Terms, that is the company the account was created for.
Processor:Flowbity sp. z o.o., registered office at os. Jana III Sobieskiego 40/2N, 60-688 Poznań, Poland, entered in the register of entrepreneurs kept by the Sąd Rejonowy Poznań - Nowe Miasto i Wilda w Poznaniu, VIII Wydział Gospodarczy Krajowego Rejestru Sądowego (District Court Poznań - Nowe Miasto and Wilda in Poznań, 8th Commercial Division of the National Court Register) under KRS 0001225616; VAT ID (NIP) 9721376119, REGON 544047871, share capital PLN 5,000.00, contact: admin@flowbity.com.
2. Subject matter and scope
The Controller entrusts the Processor with processing the personal data it enters into the service itself or that is created there on its instruction, solely to provide the service described in the Terms. The data of people using the account, to the extent the Processor needs it to conclude and settle the contract and to ensure security, is processed by the Processor as a separate controller, in line with the Privacy Policy.
3. Duration
The agreement applies for as long as the service is provided and until the deletion of data described in §11 is complete.
4. Nature and purpose of processing
Storing, organising, reading and analysing content (including automatically, with AI models), sending offers and photos to the Controller's account on the marketplace, making backups. Purpose: preparing, publishing and synchronising the Controller's car-part offers.
5. Types of data
Data of the users of the Controller's account visible in content and in the activity log: e-mail address, role, actions performed.
Personal data that may appear in content entered by the Controller: in photos of parts and labels, in notes, descriptions and in the details of a producer or a person responsible for a product.
The service is not intended for special categories of data or for buyers' data. The Controller does not enter such data.
6. Categories of data subjects
The owner, administrators and employees of the Controller who use the account.
People whose data the Controller placed in content (for example a person responsible for a product).
7. Obligations of the Processor (Article 28(3) GDPR)
Processes the data only on the Controller's documented instructions. The Terms, this agreement, the account settings and the actions performed in the service count as instructions. If the Processor considers an instruction unlawful, it informs the Controller.
Gives access to the data only to persons bound by confidentiality.
Applies the security measures described in §9 (Article 32 GDPR).
Uses sub-processors under the rules in §8.
Assists the Controller in answering data subjects' requests, in particular through the export and deletion functions of the service.
Assists the Controller in meeting its obligations under Articles 32-36 GDPR, to the extent matching the nature of the processing and the information available.
After the service ends, deletes or returns the data as described in §11.
Makes available the information needed to demonstrate compliance and allows audits under the rules in §10.
8. Sub-processors
The Controller gives its general authorisation for the use of the sub-processors listed on the Sub-processors page. The Processor ensures that each of them is bound by data processing terms giving protection at least equivalent to this agreement, and is liable for their actions as for its own. The Processor gives notice of an intended addition or change of a sub-processor by e-mail or by a message in the service at least 30 days in advance. The Controller may object within that time; if the parties cannot agree, the Controller may terminate the service contract before the change takes effect.
Data is transferred outside the EEA only on the grounds provided for in Chapter V GDPR, indicated in the sub-processor list.
9. Security measures (Article 32 GDPR)
Passwords stored only as bcrypt hashes.
Marketplace access tokens encrypted in the database.
Encrypted connections (HTTPS/TLS).
Separation of companies' data at application level and user roles (administrator, employee).
Rate limiting of sign-in attempts and lockout after failed attempts.
A log of sensitive actions; masking of e-mail addresses, tax IDs and tokens in logs.
Daily database backups and a weekly restore test.
Administrative access to the server limited to persons authorised by the Processor.
10. Breaches and audit
The Processor notifies the Controller of an established breach of the entrusted data without undue delay and no later than 48 hours after establishing it, at the account administrator's e-mail address, stating the known circumstances, effects and measures taken.
The Controller may once a year, and also after a breach, audit compliance with this agreement: first through written questions and documents, and where that is not enough - at an agreed time, with 30 days' notice, at its own cost and without access to other customers' data.
11. Deletion and return of data
Data is returned through the "Export data" function available in the service settings until the account is deleted.
After the account is deleted the Processor keeps the data for 30 days solely to allow the account to be restored at the Controller's request, and then permanently deletes it from the production system and from the photo archive.
In backups the data expires by rotation, after 12 months at the latest; until then it is used for no other purpose.
Offers and photos sent to the marketplace stay on the Controller's account on that marketplace.
The duty to delete does not cover data the Processor keeps as a separate controller under the law (in particular accounting documents).
12. Liability and final provisions
The parties' liability under this agreement is subject to the limitations set out in the Terms, to the extent permitted by law. This does not limit the rights of data subjects.
This agreement is changed in the same way as the Terms.
Governing law: the law of Poland; disputes are resolved by the court having jurisdiction over the Processor's registered office.