Valeron Legal

Data Processing Agreement (Article 28)

Controller–processor terms for personal data processed in Valeron workspaces — Annex A of the Valeron order form, version 4.

Last updated: September 14, 2026

Current version: v4.0

Roles and scope

  • The customer is the data controller; Valeron (Grupa Rapid Sp. z o.o.) acts as processor for workspace personal data under GDPR Article 28.
  • Processing happens only on documented customer instructions and for the contracted services.
  • The subject matter, duration, nature, purposes and categories of data and data subjects are set out in the signed agreement and its annexes; the service description and this Legal Center give the overview.
  • The agreement is Annex A of the Valeron order form and is concluded together with it, for the whole term of the order including any trial period, until all data has been returned or deleted.

Form of the agreement

  • The data processing agreement forms Annex A to the Valeron order form. The agreement and annexes signed by the parties govern the processing.
  • Transfers outside the EEA by subprocessors rest on the EU Standard Contractual Clauses (Decision (EU) 2021/914, module three) and/or the EU–US Data Privacy Framework, as stated per provider on the Subprocessors page.

Processor commitments

  • Confidentiality obligations for all personnel authorized to process personal data.
  • Technical and organizational measures as described in the signed agreement and its annexes and in the Security policy.
  • Subprocessors are engaged under a general written authorisation with equivalent obligations and at least 14 days' prior notice of any change; the named register at /legal/subprocessors lists the legal entities, regions and transfer safeguards (version v2.1, audit of 14 September 2026).
  • Assistance with data-subject requests through the operational flow at /legal/privacy-requests (signed in).
  • Personal data breach notification without undue delay and no later than 36 hours after Valeron becomes aware of the breach, or of an incident that is likely to be one — including at a subprocessor, counted from the moment the subprocessor informs Valeron.
  • Deletion or return of all personal data at contract end, certified in writing, per the Retention & Deletion policy.

Liability

  • Valeron's liability for a breach of the agreement, including for the acts of its subprocessors, is limited to the higher of 20 000 zł or three times the net fees paid under the order form in the 12 months before the event causing the damage.
  • The limit does not apply to damage caused intentionally or to either party's liability towards data subjects (GDPR Article 82).

Version and signature

  • Current version: v4.0 of 14 September 2026 (legal pack v4). The agreement is signed together with the order form, and the signed copy with its annexes forms part of the customer's contract documents.
  • This page summarises the agreement for orientation; the signed text with its annexes is authoritative.