A
Altanik
Back to Altanik

Data Processing Agreement

Last updated: 2 November 2026

Draft — pending legal review

This document is a working draft and has not yet been reviewed by a lawyer. Text in [SQUARE BRACKETS] is a placeholder that will be completed before Altanik accepts paid customers.

This Data Processing Agreement (“DPA”) forms part of the Altanik Terms of Service between [COMPANY NAME — JDG registered name], NIP [NIP], [REGISTERED ADDRESS], Poland (“Altanik”, the processor) and the customer using the Service (“Customer”, the controller). It sets out the terms required by Article 28(3) GDPR. It is accepted together with the Terms; a countersigned copy is available on request at [CONTACT EMAIL].

1. Definitions

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in Regulation (EU) 2016/679 (“GDPR”). “Customer Personal Data” means personal data that Altanik processes on behalf of Customer when providing the Service.

2. Subject matter, duration, nature and purpose

  • Subject matter — hosting and processing Customer Personal Data to provide the Altanik Service.
  • Duration — the term of the Terms, plus the period until the data is deleted under section 8.
  • Nature — storage, organisation, retrieval, display, transmission (for example through share links and email notifications), backup and deletion.
  • Purpose — providing the Service in accordance with Customer’s documented instructions.

3. Data subjects and categories of data

Data subjects: Customer’s clients and their contacts; Customer’s team members, collaborators and guests; contact persons at suppliers.

Categories of data: names, email addresses, phone numbers, postal and project addresses, project notes, messages and comments, uploaded files and images, and approval records (name, decision, date and item snapshot).

The Service is not designed for special categories of personal data (Art. 9 GDPR), and Customer will not upload such data.

4. Altanik’s obligations

Altanik will:

  • process Customer Personal Data only on Customer’s documented instructions — the Terms, this DPA and Customer’s use and configuration of the Service — unless EU or Member State law requires otherwise, in which case Altanik will inform Customer first unless the law prohibits it;
  • ensure that anyone authorised to process Customer Personal Data is bound by confidentiality;
  • implement the technical and organisational measures described in the Annex (Art. 32 GDPR);
  • help Customer respond to data subject requests, primarily through the Service’s self-serve export, correction and deletion tools;
  • help Customer meet its obligations under Articles 32–36 GDPR, taking into account the nature of processing and the information available to Altanik;
  • notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information Customer needs to meet its own notification duties;
  • make available the information necessary to demonstrate compliance with Article 28 GDPR and allow for audits, primarily through documentation and written questionnaires; on-site audits require 30 days’ notice, take place at most once a year and are at Customer’s cost.

5. Sub-processors

Customer gives Altanik general written authorisation to engage sub-processors. The current list is published on the Sub-processors page. Altanik will give at least 30 days’ notice of any new or replacement sub-processor by email and on that page.

Customer may object on reasonable data-protection grounds within the notice period. If the parties cannot resolve the objection, Customer may terminate the affected subscription and receive a pro-rata refund of prepaid fees for the unused period.

Altanik imposes data-protection obligations on each sub-processor that are no less protective than this DPA, and remains liable to Customer for its sub-processors’ performance.

6. International transfers

Customer Personal Data is stored in the EU. Altanik transfers it outside the EEA only where an adequacy decision applies or under the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), together with any supplementary measures required.

7. Customer’s obligations

Customer is responsible for having a lawful basis for the data it uploads, for informing data subjects, for the accuracy of the data and for configuring share links and team access appropriately.

8. Return and deletion

Customer can export its data at any time. When the Terms end, Altanik deletes Customer Personal Data from live systems, and it is purged from backups within the 30-day backup retention period, unless EU or Member State law requires Altanik to keep it.

9. Liability, precedence and governing law

Each party’s liability under this DPA is subject to the limitations in the Terms, to the extent permitted by the GDPR. If this DPA and the Terms conflict on a data-protection matter, this DPA prevails. This DPA is governed by Polish law.

Annex — Technical and organisational measures

  • Hosting in the EU (Frankfurt) on dedicated, access-restricted servers.
  • Encryption in transit (TLS) and at rest (encrypted storage volumes).
  • Row-level security on every database table to isolate each customer’s data.
  • Private object storage; files are served only through short-lived signed URLs.
  • Optional two-factor authentication for users.
  • Secrets kept in environment configuration, never in source code.
  • Nightly encrypted off-site backups with 30-day retention and tested restores.
  • Least-privilege administrative access and logging of administrative actions.
  • A documented incident-response and breach-notification procedure.