Data processing agreement
Netiker · 2026-10-25
Updated: October 25, 2026
Seller and service provider
The seller and service provider of Netiker is Paweł Kopytko, an individual operating under Poland’s unregistered business activity regime (działalność nierejestrowana) under the Netiker brand.
- Address
- Niedźwiedza 72
32-854 Porąbka Uszewska
Poland - Tax ID (Poland)
- 8692010130
- [email protected]
- Phone
- +48 791 172 155
Parties and application
The controller is the customer identified in the account and order details. The processor is Paweł Kopytko, Netiker, Niedźwiedza 72, 32-854 Porąbka Uszewska, Poland, Polish tax ID 8692010130, [email protected]. This annex forms part of the electronically accepted terms and applies when Netiker processes personal data on the customer’s behalf. It prevails over general terms on processing matters.
Subject, duration and data
Processing covers retrieval, organization, storage, analysis, transformation, access by authorized users, export and deletion throughout the contract and the period necessary for return or deletion. Data subjects are the customer’s customers, prospects, contacts and employees. Data includes names, contact details, account identifiers, transaction/activity data and customer-selected report fields. Special-category and criminal-conviction data are excluded unless separately agreed.
Instructions and confidentiality
The customer is responsible for the legal basis and scope of data provided. Documented instructions include integration settings, imports, selected reports, roles, automations and exports. Netiker acts only on these instructions, including transfers, unless law requires otherwise, in which case it informs the customer beforehand unless legally prohibited. It also informs the customer of instructions it considers unlawful. Authorized persons are bound by confidentiality. Report data is not used for Netiker advertising or training general AI models.
Security and assistance
Netiker implements risk-appropriate GDPR Article 32 measures, including access controls, account permission separation, encrypted connections and integration tokens, password hashing, monitoring and log rotation, considering data nature and the state of the art. It assists the customer with data-subject rights, security, impact assessments and supervisory consultation. Personal-data breaches are reported to the customer without undue delay with available details on the incident, impact and response.
Subprocessors and transfers
The customer generally authorizes OVHcloud for hosting/email and Cloudflare for traffic delivery/security. Netiker imposes at least equivalent data-protection obligations on subprocessors and remains responsible for performance. It emails at least 30 days before adding or replacing a subprocessor, enabling reasoned objection before the change. If no solution is agreed, the customer may end the affected service without penalty. Transfers outside the EEA require GDPR Chapter V grounds and safeguards; locations, subprocessors and safeguards are available on request. Google Analytics does not receive entrusted reports; Stripe handles separate account billing.
Audit and end of processing
Netiker provides information demonstrating GDPR Article 28 compliance and permits and assists controller or authorized-auditor audits while protecting security and other customers’ data. At contract end, the customer chooses return or deletion of entrusted data, including copies, except legally required retention; any required retained data is segregated and restricted. Contact [email protected]. Statutory supervisory and data-subject rights remain unaffected.