1. Parties and nature of the agreement
This data processing agreement (the “Agreement”) is concluded between a customer of the Nextriv service — the data controller within the meaning of Art. 4(7) GDPR (the “Controller”) — and Thermonext Michał Sendrowski with its registered office at ul. Olszowa 8B, 18-400 Konarzyce, Poland, tax ID (NIP) 7182165488, acting as a processor within the meaning of Art. 4(8) GDPR (the “Processor”).
The Agreement constitutes a processing agreement under Art. 28(3) GDPR and is concluded as part of the agreement for the provision of the Nextriv service (the “Main Agreement”). In the event of any conflict concerning personal data protection, this Agreement prevails.
2. Subject matter and duration of processing
The Controller entrusts the Processor with the processing of personal data to the extent necessary to provide the Nextriv service — a cloud-based environmental monitoring system (collection of measurement data, alerts and notifications, reports, management of user accounts within the Controller's organisation).
The processing lasts for the term of the Main Agreement. Termination of the Main Agreement ends the processing, subject to the obligations described in section 6 (deletion or return of data).
3. Nature and purpose of processing
Nature of processing: automated operations performed within the service infrastructure, in particular collection, recording, storage, organisation, consultation, use for generating notifications and reports, disclosure to users authorised by the Controller, and erasure.
Purpose of processing: provision of the Nextriv service in accordance with the Main Agreement and the Controller's documented instructions. The Processor does not process the entrusted data for its own purposes.
4. Categories of data and data subjects
The processing covers the following categories of ordinary data:
- identification and contact data of account users within the Controller's organisation: name, business e-mail address, optionally phone number (SMS notifications), system role;
- data of external contacts designated by the Controller as notification recipients: name, e-mail address, phone number;
- user activity data within the service: event logs, audit trail entries, session metadata (e.g. IP address);
- content entered by users (e.g. location names, notes, alarm comments) — to the extent it contains personal data.
5. Data subjects and prohibition of special categories
Data subjects include in particular: the Controller's employees and contractors using the service, and persons designated by the Controller as notification recipients.
The service is not intended for processing special categories of data (Art. 9 GDPR) or data relating to criminal convictions (Art. 10 GDPR). The Controller undertakes not to enter such data into the service.
5a. Obligations of the Controller
The Controller undertakes to entrust only lawfully processed data: to ensure a valid legal basis for the processing of the entrusted data, to fulfil the information obligations towards data subjects (Art. 13–14 GDPR), and to enter into the service only data it is entitled to entrust.
The Controller is responsible for the content and lawfulness of the instructions it issues and for its own configuration of the service (including the scope of the data entered and the selection of notification recipients), and shall promptly inform the Processor of any circumstances affecting the lawfulness of the processing.
6. Obligations of the Processor
The Processor undertakes to:
- process the personal data only on documented instructions from the Controller (deemed to include the Main Agreement and the service configuration made by the Controller), including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the Processor is subject; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;
- immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions;
- ensure that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
- implement the technical and organisational measures required by Art. 32 GDPR — including encrypted transmission (TLS), logical data isolation between organisations (separation at the application and data-model level), role-based access control, two-factor authentication and security event logging;
- assist the Controller, insofar as possible and taking into account the nature of processing, in responding to data subject requests (Art. 12–22 GDPR) and in complying with the obligations under Art. 32–36 GDPR;
- notify the Controller without undue delay, and no later than 48 hours, after becoming aware of a personal data breach concerning the entrusted data, providing the information necessary to assess the breach and to notify the supervisory authority where required;
- after the end of the provision of services — at the Controller's choice — delete the entrusted data or enable their return (export in open formats), and then delete existing copies, unless Union or Member State law requires their storage;
- make available to the Controller the information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR.
7. Sub-processing (sub-processors)
The Controller gives general authorisation for the Processor to engage further processors (sub-processors) to the extent necessary to provide the service — in particular cloud infrastructure and hosting providers, e-mail delivery services (Resend), an SMS gateway (SMSAPI), network and security services (Cloudflare), and Google and Microsoft tools. The detailed list of legal entities, their roles, processing locations and transfer mechanisms is set out in the sub-processor list referred to in paragraph 2.
The current list of sub-processors is published at nextriv.com/legal/subprocessors. The Processor informs the Controller of intended changes concerning the addition or replacement of sub-processors by e-mail to the administrative e-mail address indicated in the Main Agreement, giving the Controller the opportunity to object within 14 days of notification.
In the event of an objection, the parties shall in good faith seek an alternative solution. If no alternative solution is possible, the Controller may terminate the Main Agreement in the part whose provision requires the involvement of the contested sub-processor, with 30 days' notice and without contractual penalties.
The Processor imposes on each sub-processor — by way of a contract — the same data protection obligations as set out in this Agreement, and remains liable to the Controller for the performance of the sub-processors' obligations.
The Processor processes the entrusted data primarily in data centres located within the European Economic Area. Where sub-processors process data outside the EEA, the transfer relies solely on the mechanisms of Chapter V GDPR (adequacy decisions, including the EU–US Data Privacy Framework (DPF), or Standard Contractual Clauses).
8. Right of audit
The Controller has the right to carry out audits or inspections of compliance with this Agreement — directly or through an authorised auditor that is not a competitor of the Processor.
An audit is announced at least 14 days in advance, conducted during business hours in a manner that does not unreasonably disrupt the Processor's operations, and no more than once a year — unless the audit follows an identified breach or a supervisory authority's request.
The Processor satisfies the right of audit primarily by providing documentation, descriptions of security measures and the results of internal audits. The parties may agree that the costs of an audit going beyond this scope are borne by the Controller.
9. Liability
Each party is liable for damage caused by its processing that infringes the GDPR or this Agreement, in accordance with Art. 82 GDPR.
The limitations of liability provided in the Main Agreement apply to this Agreement solely between the parties (inter partes). They do not limit or exclude liability towards data subjects under Art. 82 GDPR or, under Polish law, liability for damage caused intentionally (Art. 473 § 2 of the Polish Civil Code).
10. Final provisions
The Agreement remains in force for the term of the Main Agreement and expires with it, subject to obligations that by their nature survive its termination (confidentiality, deletion/return of data).
The Agreement is governed by Polish law. Matters not regulated herein are subject to the GDPR and national data protection provisions.
This document is a template provided for information and does not constitute an offer. The binding content of the processing agreement is established when concluding the Main Agreement. The Agreement is concluded in electronic form — by accepting it in the registration process or when concluding the Main Agreement (Art. 28(9) GDPR permits written form, including electronic form); at the customer's request, the DPA may also be concluded in writing.