Legal

DATA PROCESSING ADDENDUM (DPA)

Effective date: October 13, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between GoPublica ("Processor") and the Business Client ("Controller") for the use of the GoPublica SaaS platform.

1. DEFINITIONS

  • Controller: The Business Client (tenant) who determines the purposes and means of processing personal data of their end customers.
  • Processor: GoPublica, who processes personal data on behalf of the Controller.
  • Data Subject: End customers of the Controller (e.g., restaurant guests, salon clients) whose personal data is processed through the platform.
  • Sub-Processor: Third-party services engaged by GoPublica to assist in processing (see §4).

2. SCOPE AND PURPOSE OF PROCESSING

GoPublica processes personal data solely to provide the SaaS platform services as instructed by the Controller, including:

  • Customer account management (registration, login, profiles)
  • Order processing and delivery coordination
  • Reservation and booking management
  • Beauty service appointment scheduling
  • Job application collection (careers pages)
  • Form submissions and contact inquiries
  • Payment processing (via Stripe)
  • Notification delivery (via Telegram)
  • Media hosting (via Cloudinary)

3. CONTROLLER OBLIGATIONS

The Controller agrees to:

  1. Ensure a valid legal basis (Art. 6 GDPR) for all personal data processed through the platform.
  2. Provide privacy notices to their end customers as required by Art. 13/14 GDPR.
  3. Implement their own cookie consent mechanisms on their storefront pages.
  4. Respond to data subject requests from their end customers within the legally required timeframes.
  5. Not use the platform to process special category data (Art. 9 GDPR) without explicit consent and appropriate safeguards.

4. SUB-PROCESSORS

The following sub-processors are engaged by GoPublica:

| Sub-Processor | Purpose | Data Processed | Location | Safeguard | |---|---|---|---|---| | Stripe, Inc. | Payment processing | Payment metadata (amount, currency, order ID) | USA | EU-US DPF + SCC | | Furgonetka Sp. z o.o. | Parcel delivery | Recipient name, phone, email, delivery address | Poland (EU) | N/A (EU) | | Telegram FZ-LLC | Notification delivery | Order/reservation details, customer name/phone | UAE | SCC (Module 2) | | Cloudinary, Inc. | Media hosting | Uploaded images/videos | USA | SCC + DPA | | Vercel, Inc. | Frontend hosting | Page views (anonymized) | USA | EU-US DPF | | MongoDB Atlas (AWS) | Database storage | All platform data | Germany (EU) | N/A (EU) | | Hetzner Online GmbH | Server infrastructure | All API traffic | Germany (EU) | N/A (EU) | | Kilo Code Inc. | AI model gateway (admin AI assistant) | Masked prompt text (content + brand context; PII masked before transmission) | USA | SCC (Art. 46(2)(c)) | | OpenRouter, Inc. | AI model gateway (fallback provider) | Masked prompt text (content + brand context; PII masked before transmission) | USA | SCC (Art. 46(2)(c)) |

The Controller acknowledges that GoPublica may engage additional sub-processors with prior notification. Material changes to the sub-processor list will be communicated with 30 days' notice.

5. DATA TRANSFERS

Transfers outside the European Economic Area are protected by:

  • EU-US Data Privacy Framework (DPF) adequacy decisions
  • Standard Contractual Clauses (SCC) approved by the European Commission (Art. 46(2)(c) GDPR)

6. DATA RETENTION

Personal data is retained in accordance with the retention periods specified in the GoPublica Privacy Policy. The Controller may request early deletion of their end customers' data by contacting support@gopublica.com.

7. DATA SUBJECT RIGHTS

GoPublica assists the Controller in fulfilling data subject rights through:

  • Data export: GET /api/public/profile/export (JSON format)
  • Account deletion with cascade: DELETE /api/public/profile (anonymizes orders, deletes wishlists, CVs, and consent records)
  • Consent withdrawal: PUT /api/public/profile/consent

The Controller remains responsible for verifying the identity of data subjects before acting on requests.

8. DATA BREACH NOTIFICATION

GoPublica will notify the Controller of any personal data breach within 72 hours of becoming aware, providing:

  • Nature of the breach
  • Categories and approximate number of data subjects affected
  • Likely consequences
  • Measures taken or proposed to address the breach

9. AUDIT RIGHTS

The Controller may request evidence of GoPublica's compliance with this DPA, including:

  • This DPA document
  • Technical and organizational measures (TOMs)
  • Sub-processor agreements
  • Encryption and access control documentation

10. TERMINATION

Upon termination of the agreement:

  1. GoPublica will make all personal data available for export within 30 days.
  2. After the export period, all personal data will be permanently deleted within 60 days.
  3. GoPublica will provide written confirmation of deletion.

11. GOVERNING LAW

This DPA is governed by Polish law and subject to the jurisdiction of the courts in Warsaw, Poland.

GoPublica — support@gopublica.com