Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the StatSwift Terms of Service ("Terms") between BPROBOTICS sp. z o.o. ("StatSwift", "we", "us", the "Processor") and the Customer that uses StatSwift for business purposes ("Customer", "you", the "Controller"). It sets out the terms required by Article 28 of Regulation (EU) 2016/679 ("GDPR") for personal data that we process on your behalf.

1. Scope and conclusion

1.1. This DPA applies when you use the Service for business purposes and Customer Data that you enter into the Service contains personal data ("Customer Personal Data"). It is concluded automatically when you accept the Terms for business use; no separate signature is needed. If an Enterprise agreement contains its own data processing terms, those prevail.

1.2. This DPA does not cover personal data that we process as a controller, such as Account, Organization, billing, security and website data. That processing is described in our Privacy Policy.

1.3. This DPA does not apply to Consumers using the Service for private purposes.

1.4. Terms defined in the Terms and in the GDPR have the same meaning in this DPA. If this DPA and the Terms conflict on the processing of Customer Personal Data, this DPA prevails.

2. Roles and instructions

2.1. You are the controller of Customer Personal Data and we are your processor.

2.2. We process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA and your use and configuration of the Service, such as running an analysis. We will inform you if we believe an instruction infringes data protection law, and we may refuse to follow it.

2.3. We may process Customer Personal Data otherwise only where Union or Member State law requires it; in that case we will inform you before processing, unless that law prohibits it.

2.4. You are responsible for the lawfulness of the data you enter, including having a legal basis and informing data subjects, and for not entering the categories of data excluded by section 13.5 of the Terms.

3. How the Service processes Customer Personal Data

3.1. When you run an analysis, the statistics application sends the data needed for it to our servers, which compute the result and return it to you. We process Customer Personal Data in memory only for the time needed to compute the result. We do not store it on our servers, in databases or in logs.

3.2. Your worksheets, drafts and results are saved in your browser's storage on your device. That storage is under your control and is not processed by us.

3.3. The details of the processing are set out in Annex 1.

4. Confidentiality

We ensure that persons authorized to process Customer Personal Data are bound by confidentiality obligations or are under an appropriate statutory obligation of confidentiality.

5. Security

5.1. We implement the technical and organizational measures described in Annex 2, appropriate to the risk, as required by Article 32 GDPR.

5.2. We may update these measures as technology develops, provided that the overall level of security is not reduced.

6. Sub-processors

6.1. You give us general authorization to engage sub-processors. The current sub-processors are listed in Annex 3.

6.2. We will inform you at least 30 days before adding or replacing a sub-processor, by email to the owners of your Organization or by updating Annex 3 and notifying you. You may object on reasonable data protection grounds within that period. If we cannot address your objection, you may terminate the affected Subscription before the change takes effect.

6.3. We impose on each sub-processor data protection obligations that are substantially the same as those in this DPA, and we remain responsible to you for its performance.

7. International transfers

Customer Personal Data is processed in the European Economic Area. Where a sub-processor processes it outside the EEA, the transfer is based on an adequacy decision of the European Commission, including the EU–US Data Privacy Framework for certified companies, or on the European Commission's standard contractual clauses with supplementary measures where needed.

8. Assistance

8.1. Taking into account the nature of the processing, we will assist you with appropriate technical and organizational measures in responding to requests from data subjects exercising their rights. Because we do not store Customer Personal Data, such requests can generally be met using the data held on your devices. If we receive a request directly, we will forward it to you without undue delay and will not respond ourselves, except to tell the data subject to contact you.

8.2. We will provide reasonable assistance with data protection impact assessments, prior consultations with supervisory authorities and your other obligations under Articles 32 to 36 GDPR, taking into account the information available to us.

9. Personal data breaches

9.1. We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

9.2. The notification will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will provide further information as it becomes available and take reasonable steps to contain and remedy the breach.

10. Deletion and return

Because we do not store Customer Personal Data after computing a result, no Customer Personal Data remains on our systems to be returned or deleted when the Subscription ends. Data saved in your browser remains under your control and can be exported or deleted by you at any time.

11. Audits

11.1. We will make available to you the information necessary to demonstrate compliance with Article 28 GDPR and this DPA, primarily by answering written questions sent to privacy@statswift.io.

11.2. If that information is not sufficient, or a supervisory authority requires it, you may audit our compliance, including by an independent auditor bound by confidentiality, no more than once in any 12 months, with at least 30 days' written notice, during normal business hours and without unreasonably disrupting our operations. You bear the costs of the audit.

12. Liability and term

12.1. Each party's liability under this DPA is subject to the limitations in the Terms, to the extent permitted by law.

12.2. This DPA applies for as long as we process Customer Personal Data on your behalf.

12.3. We may update this DPA for the reasons and with the notice described in section 19 of the Terms. Changes will not reduce the level of protection of Customer Personal Data.

13. Contact

Questions about this DPA: privacy@statswift.io, or BPROBOTICS sp. z o.o., ul. Jagiełka 6A lok. 1, 30-240 Kraków, Poland.

Annex 1 — Details of the processing

• Subject matter and duration: computing statistical analyses requested by the Customer in the StatSwift statistics application, for the duration of each request, during the term of the Customer's Subscription.
• Nature and purpose: receiving the data selected for an analysis over an encrypted connection, computing statistical results in memory and returning them to the User. No storage, profiling or other use.
• Categories of data subjects: as determined by the Customer through the data it chooses to analyse, typically the Customer's employees, contractors, customers or other persons whose data appears in measurements, records or study data.
• Categories of personal data: as determined by the Customer, typically identifiers or attributes included in datasets, such as names, employee or sample identifiers, dates and measurement values linked to a person.
• Special categories: none; excluded by section 13.5 of the Terms unless an Enterprise agreement allows them.
• Frequency: each time a User runs an analysis.
• Retention: none beyond the processing of a request (section 3.1).

Annex 2 — Technical and organizational measures

• Encryption in transit: all connections to the Service use HTTPS (TLS).
• No persistence: analysis requests are processed in memory; the application has no database or file storage for Customer Data, request bodies are not written to logs, and model computations run in short-lived processes that are terminated when finished or after a time limit.
• Access control: every analysis request requires a valid, short-lived sign-in token, and the application verifies that the User holds an active licence before computing.
• Separation of customers: platform data is separated per organization by database-level access rules; Customer Data is not shared between requests or customers.
• Hosting: the statistics application runs in Microsoft Azure data centres in the EU (West Europe).
• Personnel and administrative access: access to production systems is limited to authorized staff who need it, using individual accounts; staff are bound by confidentiality.
• Secure development: code changes are reviewed and tested before release; dependencies are kept up to date.
• Incident response: security issues can be reported at /legal/responsible-disclosure; breaches are handled and notified as described in section 9.

Annex 3 — Sub-processors