1. Parties and purpose
This Data Processing Agreement (“DPA”) forms part of the agreement for the Vindrose service (the “Main Agreement”) between:
- the Customer: [company name], [registered address], [registration number / NIP] (the “Controller”); and
- Vindrose: Vindrose sp. z o.o. (a Polish limited liability company, spółka z ograniczoną odpowiedzialnością, registered at ul. Piękna 58c, 50-506 Wrocław, Poland; entered in the National Court Register under KRS No. 0001261581; tax ID (NIP) 8993066384) (the “Processor”).
It sets out the terms on which the Processor processes personal data on behalf of the Controller under Article 28 of Regulation (EU) 2016/679 (“GDPR”). If this DPA conflicts with the Main Agreement on data protection, this DPA prevails.
2. Subject matter and duration
The Processor records, transcribes, stores and makes searchable the Controller’s two-way radio traffic, and provides alarms and incident reports, as described in the Main Agreement. Processing lasts for the term of the Main Agreement and until the data is deleted or returned under section 11.
3. Nature and purpose of processing
Recording radio transmissions on the Vindrose gateway at the Controller’s site; speech-to-text transcription on the gateway; transfer of audio, transcripts and metadata to the Processor’s cloud in the EU; storage, search, playback, export, keyword alarms and incident reports for the Controller’s authorised users; technical support and maintenance. The purpose is to give the Controller a searchable record of radio traffic for safety, security, operations and incident investigation.
4. Categories of data and data subjects
| Data subjects | The Controller’s employees, contractors and other people who speak on the recorded radio channels; people mentioned in transmissions; the Controller’s users of the Vindrose application. |
|---|---|
| Personal data | Voice recordings; transcripts and any personal data spoken in them (for example names, locations, vehicle numbers); radio ID, callsign or channel; date and time of transmissions; user account data (name, work email, role); access, playback and export logs. |
| Special categories | Not intended. Transmissions may incidentally contain such data (for example health information after an accident). Voice recordings are not used to identify people by their voice, so they are not processed as biometric data. |
5. Controller’s obligations
- The Controller decides which channels are recorded and ensures it has a lawful basis for recording them.
- The Controller informs the people who use its radios about the recording, as required by Art. 13 GDPR and applicable labour law (for example Art. 22³ of the Polish Labour Code), and handles their requests.
- The Controller records only radio networks it owns or is authorised to use.
6. Processor’s obligations
The Processor shall:
- process personal data only on the Controller’s documented instructions, including those in the Main Agreement and the Controller’s settings in the Service, and inform the Controller if it believes an instruction infringes data protection law;
- ensure that people authorised to process the data are bound by confidentiality;
- implement the technical and organisational measures in Annex 1 (section 13);
- respect the conditions for engaging sub-processors in section 8;
- assist the Controller, as far as possible, in responding to data subject requests and in meeting its obligations under Articles 32–36 GDPR;
- not use the data for its own purposes and not analyse emotions or evaluate individual employees;
- make available the information necessary to demonstrate compliance and allow audits under section 10.
7. Location of processing
Recordings are processed on the gateway at the Controller’s site and in data centres in the European Union. The Processor does not transfer the Controller’s recordings and transcripts outside the European Economic Area without the Controller’s prior written consent and appropriate safeguards under Chapter V GDPR.
8. Sub-processors
The Controller gives general authorisation for the Processor to engage the sub-processors listed below. The Processor informs the Controller of any intended addition or replacement at least 30 days in advance; the Controller may object on reasonable data protection grounds and, if no solution is found, terminate the affected Service. The Processor imposes the same data protection obligations on each sub-processor and remains liable for it.
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting and storage of the Service | Germany (EU) |
| Brevo (Sendinblue SAS) | Service and alarm emails | France (EU) |
9. Personal data breaches
The Processor notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Controller’s data. The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records, likely consequences and measures taken or proposed.
10. Audits
The Processor makes available documentation of its measures and answers the Controller’s reasonable written questions. The Controller may, at its own cost and with at least 30 days’ notice, carry out an audit or have it carried out by an independent auditor bound by confidentiality, no more than once a year unless a breach or a supervisory authority requires otherwise.
11. Return and deletion
When the Main Agreement ends, the Controller can export its recordings and transcripts within 30 days. After that period the Processor deletes the Controller’s personal data from the cloud, including backups within their normal rotation, unless EU or Member State law requires storage. Data stored locally on gateways owned by the Controller remains under the Controller’s control; on request the Processor provides instructions to wipe it.
12. Liability and governing law
Liability under this DPA is governed by the Main Agreement, without limiting liability that cannot be limited under the GDPR. This DPA is governed by the laws of Poland; the courts of Wrocław have jurisdiction.
13. Annex 1: technical and organisational measures
- Encryption of data in transit between gateway, cloud and users (TLS).
- Encryption of data at rest in the cloud [confirm] and on the gateway storage [confirm].
- Role-based access by channel and site; logging of every playback and export.
- Logical separation of each customer’s data.
- Configurable retention with automatic permanent deletion.
- Remote, authenticated software updates for gateways.
- Backups in the EU and a tested restore procedure [confirm].
- Staff access on a need-to-know basis, with confidentiality obligations.
14. Signatures
[name, position]
Date:
[name, position]
Date: