Data Processing Agreement (DPA)
Last updated: 28 June 2026. Annex to the Terms; the Polish version is authoritative.
The Customer is the controller of personal data contained in content entered into the Service; FIFO Prosta S.A. is the processor, processing such data solely to provide the Service on the controller's documented instructions (Art. 28 GDPR).
Subject, duration, purpose
Processing necessary to provide the Service, for the term of the agreement: storage, organisation and availability within quote generation and account operation.
Data & persons
Contacts/representatives of the Customer's counterparties and persons named in inquiries/quotes; identification and contact data. No special-category data should be entered.
Processor obligations
Process only on documented instructions; confidentiality; Art. 32 security (encryption in transit, hashed passwords, access control, logging, backups); assist with data-subject rights and Art. 32–36; delete/return on termination.
Sub-processors
General authorisation for the sub-processors listed at Sub-processors; we notify of changes and allow reasoned objection.
Transfers
Outside the EEA only under appropriate safeguards (EU SCC or adequacy).
Breach
We notify the controller without undue delay (Art. 33).
Deletion/return & audit
On termination we delete or return the data; we provide information needed to demonstrate Art. 28 compliance and allow reasonable audits.