Data processing agreement (DPA)

1. Parties and subject

The client (controller) entrusts Schio spółka z ograniczoną odpowiedzialnością (processor) with processing personal data to provide LandTracker24 under Art. 28 GDPR. The agreement is concluded by accepting the Terms and lasts as long as the service.

2. Scope

Data subjects: plot sellers, brokers, contact persons, client team members. Data categories: name, phone, email, land register number, asking price, notes. Nature: storage, display, report generation and sending emails on the client’s instruction.

3. Processor obligations

Processes data only on the client’s documented instructions; ensures confidentiality of authorised persons; applies security measures (company data isolation, encryption in transit, access control, backups); assists with data subject rights and breach notification (without undue delay, within 48 hours of detection); deletes or returns data within 30 days after termination.

4. Sub-processors

Cloudflare (hosting, D1 database, R2 files, PDF rendering), Resend (email), Stripe (payments — billing data). The client gives general authorisation for sub-processors; changes are announced 14 days ahead with a right to object.

5. Audit

The client may request information needed to demonstrate compliance and conduct an audit after agreeing on a date.

Version: 2026-draft