Skip to content
Czat AI Order PL Log in

Version of 22 October 2026

Agreement on the processing of personal data on behalf of the Controller

This is a translation provided for convenience. The Polish version is binding. Polish version

The agreement (Article 28 GDPR) is concluded in the client panel czat.iwaszka.pl/konto together with acceptance of the Terms of Service — by ticking the box “I enter into the data processing agreement” (electronic form, Article 28(9) GDPR). The panel records the version of the agreement, a hash of its text, the date and the account from which it was concluded.

Parties: the Client — the business or institution for which an account was created in the panel (details from the order), as the Controller; and Jacek Iwaszkiewicz, carrying on business under the name Iwaszka Jacek Iwaszkiewicz, Odonów 168, 28-500 Kazimierza Wielka, Tax ID (NIP) 795-25-38-265, as the Processor. This agreement is linked to the agreement for the provision of the “Czat AI · Iwaszka” service (the Main Agreement).

§ 1. Subject matter, nature and purpose

  1. The Controller entrusts the Processor with the processing of personal data solely for the purpose of providing the Service: conducting conversations between the AI assistant and visitors to the Controller’s websites, forwarding “Write to us” messages to the address indicated by the Controller, searching the catalogue and — where the Service includes it — handling enquiries from logged-in customers of the Controller’s shop, reports and suggested improvements.
  2. Nature of the processing: collection (the conversation), recording, storage, transmission to the AI model in order to prepare a reply, forwarding by email to the Controller, display to the Controller in the panel (with email addresses and telephone numbers masked), deletion.
  3. Duration: for the term of the Main Agreement and until the data is deleted in accordance with § 7.

§ 2. Type of data and categories of data subjects

  • Visitors to the Controller’s websites: the content of chat messages (including data that the visitor provides themselves), the rating of the reply, a hash of the IP address created with a secret key (not the IP address itself), the time and language of the conversation.
  • Persons sending a “Write to us” message: name, email address, the content of the message, the record of the conversation and its summary.
  • Logged-in customers of the Controller’s shop (where the Service includes it): account identifier, name, order and ticket data shown by the shop in response to the customer’s question.

The Service is not intended for the processing of special categories of data (Article 9 GDPR). The assistant does not ask for them, and the privacy policy asks visitors not to provide them. If a visitor does provide them, they are processed solely as the content of the conversation and deleted within the periods set out in § 7.

§ 3. Obligations of the Processor

The Processor:

  1. processes data only on documented instructions from the Controller — the Main Agreement, this agreement and the settings in the panel constitute such instructions; it shall immediately inform the Controller if, in its opinion, an instruction infringes the law;
  2. ensures that persons authorised to process the data have committed themselves to confidentiality;
  3. applies the security measures set out in § 5;
  4. engages sub-processors only on the terms of § 4;
  5. assists the Controller in responding to requests from data subjects (access, rectification, erasure, objection) — in particular, it finds and deletes the conversations of the person concerned within 7 days of the request;
  6. assists the Controller in meeting the obligations under Articles 32–36 GDPR, including notifying the Controller of a personal data breach without undue delay and no later than 36 hours after becoming aware of it, together with the information referred to in Article 33(3) GDPR;
  7. after the Service ends, deletes or returns the data in accordance with § 7;
  8. makes available to the Controller the information necessary to demonstrate compliance with the obligations and allows for an audit (§ 6).

§ 4. Sub-processors

The Controller gives general authorisation to use sub-processors of the following types:

  • AI model provider — the language model that prepares the replies; it processes the content of the conversation via an API. The provider may be established outside the European Economic Area — the transfer takes place on the basis of standard contractual clauses (Commission Decision (EU) 2021/914). The provider does not train models on API data and deletes it within 30 days (longer only in the event of a breach of the terms of use or where required by law).
  • Server provider — the server on which the Service and the conversation database run; the data centre is in the European Union.
  • Email and backup provider — sending emails (messages, login codes, notifications) and storing encrypted backups; transfers outside the EEA take place on the basis of standard contractual clauses.

The names, registered offices and transfer bases of these entities are set out in the list of sub-processors made available to the Controller in the client panel (czat.iwaszka.pl/konto, the “Terms and data processing agreement” tab) before the agreement is concluded and throughout its term. The list forms part of this agreement.

  1. The Processor shall inform the Controller by email at least 14 days in advance of any intention to add or replace a sub-processor. During that time the Controller may object; if the parties fail to reach an agreement, the Controller may terminate the Main Agreement with immediate effect.
  2. The Processor imposes on sub-processors data protection obligations no less stringent than those in this agreement and remains liable to the Controller for their performance (Article 28(4) GDPR).
  3. If the Controller uses conversation preview in its own system (Terms of Service § 2(5)), the Controller is itself responsible for granting and withdrawing its employees’ access to that preview.

§ 5. Security measures (Article 32 GDPR)

  1. Encrypted connections (HTTPS, HSTS); a chat window without cookies; a conversation is accessible only with a one-time key held in the visitor’s browser.
  2. The visitor’s IP address is not stored — only a hash created with a secret key; server logs contain no IP addresses and no conversation content.
  3. Client panel: login with a code sent by email (attempt limits, lockout), a session protected against forged requests; the Controller sees only its own websites, and email addresses and telephone numbers in conversations are masked.
  4. A reply filter that blocks numbers, email addresses and domains that are not in the website’s knowledge; access keys are kept outside the database.
  5. The server connects only to public addresses (outbound firewall); the Controller’s website is read as by an ordinary visitor — without logging in and without submitting forms.
  6. Backups are encrypted (AES-256) before being sent off the server, with a restore test; administrative access to the server is by SSH key only; software changes go through a deployment procedure with checks.

§ 6. Audit

  1. The Controller may carry out an audit once a year (and additionally after a personal data breach) — first by means of a questionnaire and documents and, if that is not sufficient, by an auditor bound by a duty of confidentiality, with the date agreed 14 days in advance.
  2. The Controller bears the costs of the audit, unless the audit reveals a material breach of this agreement.

§ 7. Retention periods and deletion of data

  1. Conversations — 90 days from the last message; conversations containing a “Write to us” message and conversations of logged-in customers of the shop — 12 months; data is deleted automatically (daily retention job).
  2. Encrypted backups — daily backups for 30 days, monthly backups for 12 months; data deleted from the database disappears from the backups once these periods have elapsed.
  3. After the Main Agreement ends, the Processor — at the Controller’s choice notified within 14 days — provides it with an export of the conversations and then deletes the data from the database within 30 days; backups expire within the periods set out in § 7(2). On request, it confirms the deletion in documentary form.

§ 8. Final provisions

  1. The liability of the parties for damage resulting from a breach of data protection provisions is governed by Article 82 GDPR.
  2. The agreement remains in force for the term of the Main Agreement. Amendments require documentary form (email or acceptance of a new version in the panel).
  3. Matters not regulated here are governed by the GDPR, Polish law and the Main Agreement. In the event of a conflict on data protection matters, this agreement prevails.
  4. The agreement is also available in English — for convenience only. In the event of any discrepancy, the Polish version prevails.

Terms of Service

Back to top ↑