# Data Processing Agreement (DPA)

**Service Provider / Operator:** Brillnet Piotr Adamski, ul. Henryka Sienkiewicza 73/6, 90-057 Łódź, Polska, NIP 7321779060, REGON 101551294

**Service contact:** [kontakt@wm-admin.pl](mailto:kontakt@wm-admin.pl)

**Privacy and breach contact:** [privacy@brillnet-app.com](mailto:privacy@brillnet-app.com)

**Website:** [wm-admin.pl](https://wm-admin.pl/?lang=en)

**Version:** 2026-10-12-beta.2

This is an informational translation. The Polish version is binding.

## 1. Parties and entry into force

1. This DPA is entered into between:
   - the **Controller or Primary Processor:** the Customer identified in the acceptance event and order; and
   - the **Processor:** Brillnet Piotr Adamski, with the details in the header.
2. If the Customer is a management company acting as a community's processor, it declares that it has the controller's written authorisation to engage a subprocessor.
3. The DPA takes effect with the main Agreement or the first transfer of personal data, whichever occurs first, and remains in force until all entrusted data has been deleted or returned.
4. The DPA is a processing agreement under Article 28 GDPR. The acceptance event identifies the full business/entity name, address, tax identification number (NIP), representative, basis of authority, document version and checksum.

## 2. Subject matter, nature and purpose

1. Brillnet processes data solely to host and provide WM Administrator features, secure the Service, create backups, provide support, perform export/deletion and operate integrations enabled by the Customer.
2. Detailed subject matter, operations, categories of individuals and data are in the [Description of processing](/umowa-powierzenia-opis?lang=en).
3. Documented instructions comprise the DPA, Terms, Service configuration by an authorised User, support requests and other instructions in recorded form.
4. If an instruction infringes the GDPR or other data protection law, Brillnet informs the Customer before carrying it out, unless the law prohibits such information.

## 3. Brillnet's obligations

Brillnet:

1. processes data only on the Customer's documented instructions, including transfers outside the European Economic Area (EEA);
2. ensures that persons admitted to data are bound by confidentiality and have access only as necessary;
3. implements the risk-appropriate measures in the [Technical and organisational measures annex](/umowa-powierzenia-zabezpieczenia?lang=en);
4. assists the Customer in responding to individuals' requests, conducting impact assessments and prior consultations, and fulfilling Articles 32–36 GDPR, taking the nature of processing into account;
5. maintains required records and makes available information necessary to demonstrate compliance;
6. returns or deletes data after services end under section 11;
7. does not sell data or use it for advertising, building profiles or training generative models.

## 4. Customer obligations

The Customer:

1. has an appropriate legal basis and fulfils information obligations towards individuals;
2. gives lawful, unambiguous instructions and configures retention;
3. grants permissions according to least privilege, reviews them and revokes them without delay;
4. assesses whether the Service and measures are sufficient for its risks, especially before entering special categories of data, children's data, debt information or dispute data;
5. does not instruct Brillnet to perform processing it cannot lawfully entrust;
6. informs Brillnet when acting as a primary processor and of restrictions arising from its agreement with the controller.

## 5. Confidentiality and support access

1. Ordinary Brillnet personnel have no standing access to Community content.
2. Support access to data is granted for the duration and scope of an accepted request, audited and automatically expires. Particularly privileged access requires additional approval and justification.
3. Emergency access may be activated to protect individuals, data or continuity, with subsequent Customer notification unless legally or technically impossible.

## 6. Subprocessors

1. The Customer gives general authorisation for the subprocessors listed in [Subprocessors](/podprocesorzy?lang=en).
2. Brillnet enters into an agreement with each subprocessor imposing data protection obligations no less significant than the corresponding DPA obligations and remains responsible for the subprocessor's performance under Article 28 GDPR.
3. A planned new subprocessor is announced at least 14 days in advance. The Customer may raise a reasoned data protection objection within that period.
4. The parties will agree a reasonable solution in good faith. If excluding the subprocessor or finding an alternative is impossible, the Customer may terminate the affected service before the new entity begins processing.
5. In a security or continuity emergency, the period may be shorter; Brillnet will inform the Customer without undue delay and explain why.

## 7. International transfers

1. Persistent data in D1, R2 and Durable Objects is configured with EU jurisdiction. Stateless Workers may execute code outside the EEA, and global providers may process limited metadata outside the EEA.
2. Transfers rely on an adequacy decision, EU–US Data Privacy Framework certification where applicable to the recipient and data type, or the European Commission's standard contractual clauses with a transfer risk assessment and supplementary measures.
3. On the Customer's request, Brillnet provides information about the transfer basis, taking confidentiality and security into account.

## 8. Individual requests

1. Brillnet does not substantively answer a request concerning Customer Data without instructions, unless required by law.
2. Brillnet forwards received requests to the Customer without undue delay and provides search, export, rectification, restriction and deletion tools within available functionality.
3. The Customer is responsible for identifying the individual and deciding the scope and timing of the response.

## 9. Personal data breaches

1. Brillnet notifies the Customer without undue delay upon becoming aware of a Customer Data breach. The internal target is a first useful notification within 24 hours; it does not justify waiting when earlier information is available. Information is supplied in stages without awaiting full confirmation of every circumstance.
2. As available, the notice covers the nature of the breach, systems and Communities, categories of individuals and data, likely effects, measures taken, contact point and known indicators of compromise.
3. Brillnet provides updates as findings progress, preserves evidence and cooperates with the Customer. Notification does not constitute an admission of liability.
4. The Customer, as controller, decides on notifying the authority within 72 hours and communicating with individuals. Brillnet does not notify on the Customer's behalf without a documented instruction or legal obligation.

## 10. Audit

1. Brillnet provides current information on architecture, measures, tests, subprocessors and material incidents.
2. The parties first use documentation, reports and written responses. If insufficient, the Customer may conduct an audit once a year with at least 30 days' notice, during business hours and without compromising other customers' data.
3. Frequency and notice limits do not apply to a confirmed breach, an authority's instruction or a justified suspicion of material non-compliance.
4. The Customer pays routine audit costs; Brillnet bears its own reasonable remediation costs if the audit establishes material non-compliance by Brillnet.

## 11. Return, export and deletion

1. The Customer may perform full exports during the Agreement.
2. After termination, data is available for read-only access and export for 90 days, unless the Customer instructs earlier deletion and the law permits it.
3. After the export period, Brillnet deletes production data. Backup data expires in the normal cycle within 90 days and is not used for other purposes.
4. A legal obligation or documented legal preservation hold may suspend deletion only as necessary. Data remains isolated and is not actively used.
5. On request, Brillnet confirms completion of deletion.

## 12. Liability and document precedence

1. The parties' liability is governed by the Terms, without limiting individuals' rights or the authority's powers under the GDPR.
2. In data protection matters, the DPA takes precedence over the Terms. A more protective, specific DPA provision prevails over a general one.
3. Invalidity of one provision does not affect the others; the parties will replace it with a lawful provision whose purpose is as close as possible.

## Readiness for KSC/NIS2

KSC/NIS2 readiness rests on security measures, supplier controls and incident procedures relevant to WM Administrator. Statutory duties are qualified by entity, sector, service, size and exceptions. Operator duties, customer duties and contractual commitments are separate. On a justified request, relevant service information is supplied with confidentiality safeguards. Using WM Administrator does not itself ensure customer compliance, registration or certification.

## Scope of backup periods

D1/R2 windows concern application infrastructure. They are not universal retention statements for every email-provider or other recipient copy. Sending data, own billing and security require separate role, purpose, retention and basis mapping. Deletion requests are assessed accordingly; a supplier term alone does not replace a legal basis or customer instruction.

## Switching providers — Data Act

For a data processing service covered by Regulation (EU) 2023/2854, we apply switching and export rights. From 12 January 2027, we do not charge switching fees prohibited by Article 29. Separately commissioned work may be charged only where lawful; it cannot circumvent free switching or restrict required assistance. The relevant service terms set out export scope and timing.

Requests to switch provider, port to on-premises infrastructure or erase without switching may be sent to the service contact. For a service within the Data Act, notice does not exceed two months and the standard transitional period does not exceed 30 calendar days. We provide required assistance, security and continuity of contracted functions. If 30 days is technically unfeasible, within 14 working days of the request we give reasons and an alternative period of at most seven months. The customer may extend the transition once. Data remain retrievable for at least 30 days after it ends. Export exclusions cannot impede or delay switching. A preservation hold alone does not bar export; restrictions require a specific basis and scope. Contract termination and deletion are coordinated with this procedure and the customer’s instructions.

The agreement for the service subject to switching ends when switching succeeds, or after the notice period for erasure without switching. This procedure takes precedence over a conflicting general end-of-paid-period term. The 90-day window does not shorten the right to retrieve data for at least 30 days after transition. Export includes customer structured data, settings, documents and attachments. Proprietary code, secrets, internal safeguards and other customers’ data are excluded only without impeding portability. Extra work is quoted only beyond required assistance and where lawful.


> Contact details and domains in this presentation were updated on 2026-09-08. The original document and previous acceptances remain unchanged.