Terms of the Personal Data Processing Agreement

This document is a translation of the Polish version of the Terms of the Personal Data Processing Agreement. In case of any ambiguity or discrepancy, the Polish version shall prevail. If you have any questions, please contact us.

TERMS OF THE PERSONAL DATA PROCESSING AGREEMENT

(hereinafter: the DPA Terms)

[Definitions]

§ 1

For the purposes of these DPA Terms, the following terms shall have the meanings set out below:

Controller means the User within the meaning of § 1(2)(j) of the mKsiegowa.pl Terms of Service, who alone determines the purposes and means of processing the entrusted personal data;
personal data means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly;
sensitive data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data processed for the purpose of uniquely identifying a natural person, or data concerning health or a natural person's sex life or sexual orientation, and personal data relating to criminal convictions and offences or related security measures, as specified in Articles 9 and 10 GDPR;
technical infrastructure means the set of interoperating devices and the software necessary to ensure the continuity of the services provided by the Processor;
sub-processor means an entity to which the Processor sub-entrusts personal data entrusted to it for processing under these DPA Terms;
breach of the entrusted personal data means:
1. a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or
2. unauthorised access to, personal data transmitted, stored or otherwise processed under these DPA Terms;
User Panel means the service operated by the Processor for the Controller, accessible via the website https://mksiegowa.pl at a unique URL;
Processor means Eurosaas sp. z o.o., with its registered office in Brwinów, ul. Otrębuska 42b, which processes the personal data entrusted to it on behalf of the Controller;
Controller's instruction means a statement made by the Controller to the Processor requiring it to carry out specific processing of the entrusted personal data;
entrusted data means the personal data of persons in respect of whom the User is the controller within the meaning of Article 4(7) GDPR and which have been entrusted to the Processor for processing on the terms set out in these DPA Terms;
Processor's personnel means natural persons under the permanent and direct supervision of the Processor who perform work for it under an employment contract, a civil-law contract (including persons running their own business) or any other legal relationship;
processing of entrusted data means an operation or set of operations specified in § 2(3) of these DPA Terms performed on the entrusted data, as well as operations performed on a separate instruction of the Controller;
mKsiegowa.pl Terms of Service means the mKsięgowa Terms of Service available at: https://mksiegowa.pl/www/regulamin
DPA Terms means these Terms of the Personal Data Processing Agreement;
GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;
operating system services means additional software - component parts of the operating system;
Service Agreement means the Agreement within the meaning of § 1(2)(h) of the mKsiegowa.pl Terms of Service

[General Provisions]

§2.

The Controller entrusts the Processor with the processing of personal data on the terms and to the extent set out in these DPA Terms.
The processing referred to in paragraph 1 is entrusted solely for the purpose of, and to the extent necessary for, the proper performance of the Service Agreement in accordance with the mKsiegowa.pl Terms of Service
The Processor is authorised to record, organise, structure, copy, store, alter, retrieve, consult, erase and destroy the personal data entrusted to it, and to perform any other operations on personal data to the minimum extent necessary to achieve the purpose of processing (the provision of services to the Controller under the mKsiegowa.pl Terms of Service).
The Processor sub-entrusts further processing of the personal data entrusted to it, referred to in paragraph 5, to a sub-processor – IQ PL Sp. z o.o., with its registered office in Gdańsk, ul. Geodetów 16, 80-298 Gdańsk, NIP (Tax ID): 5832736211 (hereinafter: IQ) – to the extent necessary to provide services related to the technical maintenance of the mKsiegowa.pl system, in line with the scope of services actually performed by that entity. The sub-entrustment is made under an agreement concluded between the Processor and IQ which imposes on IQ data protection obligations at least equivalent to those arising from these DPA Terms, in accordance with Article 28(4) GDPR.
The Controller entrusts the Processor with the processing of ordinary personal data of its business partners, as well as its employees and associates, in accordance with the general rules for preparing accounting records.
These DPA Terms do not apply to personal data which the Processor processes as a controller. This applies in particular to the data of persons who create an account and use the User Panel, processed to the extent necessary for:
1. concluding and performing the Service Agreement;
2. billing;
3. handling support requests;
4. ensuring the security of the mKsiegowa.pl service, including keeping system logs;
5. communicating with the User.
Except in the cases specified in the preceding point, the Processor does not use the entrusted data for its own purposes, in particular for marketing purposes or for training artificial intelligence models.

[Representations of the Parties]

§3.

The Controller represents that:

it is the controller within the meaning of Article 4(7) GDPR with respect to the personal data entrusted for processing;
the personal data have been collected in accordance with applicable law;
it has a legal basis for processing the entrusted data and for entrusting their processing to the extent set out in these DPA Terms;
it undertakes not to entrust the Processor with the processing of sensitive data;
the entrustment of personal data processing does not infringe the rights and freedoms of data subjects;
it undertakes, at the Processor's request, to provide the Processor with its own risk analysis concerning the entrusted data, prepared in accordance with Article 32 GDPR in a professional and reliable manner and on the basis of true data and information;
if it is required under Article 35 GDPR to carry out a data protection impact assessment concerning the entrusted data, it will promptly inform the Processor of its results once completed;
it will make its own backup copies of the entrusted data;
it undertakes to effectively secure the devices, operating systems and related services and applications that it manages;
it undertakes to cooperate with the Processor in implementing these DPA Terms, to provide the Processor with explanations in the event of doubts as to the lawfulness of the Controller's instructions, and to fulfil its specific obligations on time;
it bears full liability for all actions it performs itself or with the assistance of third parties (excluding the Processor) in or by means of the Processor's technical infrastructure which may cause or do cause a breach of personal data security or processing of personal data contrary to these DPA Terms or data protection laws, including in particular contrary to the GDPR;

The Processor represents that:

it is professionally engaged in providing electronic accounting software services and employs and works with persons who have the appropriate knowledge, experience and skills in this field;
it has appropriate organisational and technical measures to ensure that the processing of the personal data entrusted to it complies with the requirements of the GDPR and that the rights of data subjects are duly protected;
the personnel through whom it performs the Service Agreement have been granted appropriate authorisations to process personal data and have been familiarised with data protection laws and with the liability they face for non-compliance;
the persons referred to in point 3) have undertaken to keep confidential all information relating to the implementation of these DPA Terms, in particular information about the entrusted personal data;
it undertakes not to transfer the entrusted personal data outside the European Economic Area;
it is not liable for any actions performed by the Controller itself or with the assistance of third parties in or by means of the Processor's technical infrastructure which may cause or do cause a breach of personal data security or processing of data contrary to these DPA Terms or data protection laws, including in particular contrary to the GDPR.

[Controller's Instructions]

§4.

The Controller's documented instructions within the meaning of Article 28(3)(a) GDPR are:
1. the provisions of these DPA Terms and of the mKsiegowa.pl Terms of Service, insofar as they specify the purpose, scope and manner of processing the entrusted data;
2. actions performed in the User Panel using the functionalities of the mKsiegowa.pl service by the Controller or by persons to whom the Controller has granted access to the User Panel, in particular:
  - entering, importing, editing and deleting data;
  - issuing and sending documents, including to the National e-Invoicing System (KSeF) and electronically to the Controller's business partners;
  - generating and submitting tax returns and JPK (SAF-T) files;
  - configuring integrations with third-party systems;
  - granting and revoking access rights;
  - exporting data;
3. other instructions given in accordance with paragraph 2.
The Controller gives instructions other than those referred to in paragraph 1(a) and (b) in documentary form, via the User Panel or to the Processor's e-mail address indicated in the mKsiegowa.pl Terms of Service. An instruction sent from the e-mail address assigned to the Controller's account shall be deemed to have been given by the Controller.
Actions referred to in paragraph 1(b) performed using the access credentials of the Controller or of persons to whom it has granted access to the User Panel shall be deemed actions of the Controller. The Controller is responsible for granting, defining the scope of and revoking the permissions of such persons.
The Processor does not verify the purposefulness of individual actions referred to in paragraph 1(b). This is without prejudice to the obligation to inform the Controller immediately if, in the Processor's opinion, an instruction given to it infringes the GDPR or other data protection provisions (Article 28(3), second subparagraph, GDPR).
If carrying out an instruction of the Controller could involve a breach of law, in particular of the GDPR or other data protection laws, the Processor has the right to withhold carrying out that instruction, of which it shall promptly inform the Controller, stating the reasons for its position.
If, despite having been alerted to the risk of a breach of law resulting from the Processor carrying out the instruction, the Controller maintains its instruction, the Processor is entitled to restrict the scope of processing of the data to which those risks relate.

[Sub-entrustment of Personal Data Processing]

§5.

The Controller grants the Processor general authorisation to sub-entrust the personal data covered by these DPA Terms to sub-processors.
However, before each sub-entrustment of data processing, the Processor shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors, thereby giving the Controller the opportunity to object to such changes.
Failure to object within 7 calendar days of the Controller being informed of the intended sub-entrustment shall be deemed consent by the Controller.
Raising the objection referred to in paragraph 3 entitles the Processor to terminate the Service Agreement with immediate effect for reasons attributable to the Controller.
The Processor shall impose on the sub-processor to which processing has been sub-entrusted the same obligations as those set out in these DPA Terms, in particular the obligation to provide sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing meets the requirements of the GDPR.

[Informing the Controller]

§6.

Taking into account the nature of the processing, the Processor undertakes, insofar as possible, to assist the Controller in fulfilling its obligation to respond to requests from data subjects exercising their rights laid down in Chapter III GDPR.
In the event of a breach of the entrusted personal data, such as loss, hacking, theft or unauthorised disclosure of personal data, the Processor shall:
1. notify the Controller thereof without undue delay, and in any case no later than 72 hours after discovering the breach;
2. immediately take all possible remedial action to prevent and minimise the consequences of the breach of the entrusted personal data;
3. document the circumstances of the breach of the entrusted personal data, including its consequences and the remedial action taken;
4. support the Controller in technical and IT matters in the procedure for notifying the breach to the supervisory authority, should it turn out that the incident may result in an infringement of the rights and freedoms of natural persons.
If, during the performance of the Service Agreement, the Processor becomes aware of conduct by the Controller which may result in a breach of the GDPR or other data protection laws with respect to the entrusted data, it may request the Controller to provide explanations and to restore compliance with the law and these DPA Terms, setting an appropriate deadline for doing so.
Until compliance with the law is restored, the Processor is entitled to suspend performance of the mKsięgowa.pl Terms of Service, these DPA Terms and the Service Agreement, in whole or in part, which shall not affect the Controller's obligation to pay the subscription fee for that period.
If the deadline referred to in paragraph 3 expires to no effect, the Processor is entitled to terminate the Service Agreement with immediate effect for reasons attributable to the Controller.

[Disclosure of Personal Data]

§7.

In order to implement these DPA Terms, the Processor may use the assistance of personnel who have been authorised in advance to process personal data and who are bound to keep confidential any information obtained as a result of implementing these DPA Terms. Processing, in particular disclosure, of the entrusted personal data to the persons referred to in the preceding sentence does not constitute a breach of these DPA Terms.
The Processor shall promptly notify the Controller of any request made by a third party that interferes with the processing of the entrusted personal data, in particular a request to copy, secure or disclose such personal data. In such a case, the Processor shall promptly notify the Controller of the request, unless otherwise provided by law.
Where a provision of law requires the Processor to perform a specific operation on the entrusted personal data, in particular where there is a legal obligation to disclose personal data to the entities referred to in paragraph 2, the fulfilment of that obligation does not constitute a breach of these DPA Terms.

[Supervision]

§ 8.

The Processor shall make available to the Controller the information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, insofar as they concern the processing of personal data entrusted under these DPA Terms. This information may be provided in particular in the form of answers to questions, descriptions of the procedures applied, security documentation, audit results or certificates, where available and appropriate to the scope of the request.
The Processor is not obliged to prepare individual data protection documentation for the Controller, to carry out separate risk analyses on its behalf or to perform advisory services that go beyond the Processor's obligations under the GDPR and these DPA Terms. This does not exclude the obligation to provide the information and assistance required by law.
The Controller has the right to conduct audits, including inspections, concerning the processing of the entrusted personal data, either itself or through an authorised auditor. The audit should be limited to the scope necessary to verify that the processing of the entrusted personal data complies with the GDPR and these DPA Terms.
Before conducting an audit, the Controller shall first ask the Processor to provide information or documentation enabling verification of the matters covered by the planned audit. If the information provided proves insufficient for such verification, the Controller may conduct a broader audit, including an on-site inspection at the place of processing. This provision does not limit the Controller's right to conduct an audit where it is necessary to demonstrate that the processing complies with the GDPR.
The Controller shall notify the Processor of a planned audit at least 10 days in advance, specifying its purpose, scope, proposed date and the persons taking part in the audit. The Parties shall agree on the date and manner of conducting the audit, taking into account legitimate organisational needs, the security of IT systems and the continuity of the services provided by the Processor. The prior notice requirement may be shortened or waived where this is justified by a suspected personal data breach, an established breach of data protection laws or a request from the competent supervisory authority. The preferred method of conducting an audit is a remote audit. If the Controller requires an on-site audit, the schedule must take into account the Processor's office opening hours and a time limit not exceeding 1 business day.
Except in cases justifying more frequent checks, audits carried out at the Controller's initiative should not take place more than once per calendar year. This frequency limit does not apply where an additional audit is justified by an established or suspected personal data breach, a material change in the circumstances of the processing, reasonable doubts as to the compliance of the processing with the GDPR or a request from the competent supervisory authority. This provision does not exclude the Controller's rights under mandatory provisions of law.
The Controller may conduct the audit itself or through an authorised employee or an external auditor with qualifications appropriate to the scope of the audit. The Controller is liable for the acts and omissions of persons acting on its behalf to the extent provided by applicable law.
The Controller shall ensure that persons participating in the audit are informed of, and comply with, the security and confidentiality rules in force at the Processor. The Processor may require such persons to sign a confidentiality undertaking, provided that this requirement is proportionate and does not unduly hinder the exercise of the Controller's rights under the GDPR.
The auditor may not be a person whose participation in the audit would give rise to an actual conflict of interest, unauthorised disclosure of the Processor's trade secrets or a material threat to the security of the data processed. The mere fact that the auditor engages in activities competing with those of the Processor does not constitute sufficient grounds for refusing their participation in the audit if the risk associated with such participation can be mitigated by appropriate confidentiality undertakings and security measures. Persons currently involved in providing services to the Processor or having access to its confidential information by virtue of employment or cooperation may participate in the audit only if this does not give rise to a conflict of interest or a threat to the confidentiality and security of data.
Competing activities means business activities consisting in offering products or services that compete with the Processor's products or services. The mere conduct of such activities by the auditor does not exclude their participation in the audit. The Processor may, however, apply proportionate measures to protect its legitimate interests, in particular by restricting access to information unrelated to the subject matter of the audit, information about other clients, source code, details of technical safeguards and other information constituting trade secrets, provided that these restrictions do not prevent effective verification of the compliance of the processing of the entrusted personal data with the GDPR.
The audit shall be conducted to the extent necessary to achieve its purpose. The Processor shall provide access to those premises, information, documents and systems that are necessary to verify the correctness of the processing of the entrusted personal data, taking into account the technical and organisational capabilities of providing the service. The audit may not lead to unauthorised access to the personal data of other clients, disruption to the continuity of services or unjustified disclosure of confidential information or trade secrets. If a particular audit method poses such a risk, the Parties shall agree on an alternative solution that allows effective verification of the compliance of the processing with the GDPR.
The Controller and persons acting on its behalf are obliged to keep confidential the information obtained during the audit, in particular information constituting trade secrets of the Processor or its clients, information about the security of IT systems and personal data to which they have gained access. This information may be used solely for the purpose of conducting the audit, fulfilling legal obligations or pursuing claims related to personal data protection. The confidentiality obligation does not limit the right to provide information to the competent supervisory authority, a court or another authorised body where required by law. The Controller is liable for breaches of the confidentiality obligation by persons acting on its behalf to the extent provided by applicable law.
The Controller shall bear the costs of the audit, including the fee of an external auditor. If conducting the audit requires the Processor to incur additional, reasonable and documented costs or to perform activities going beyond standard cooperation in providing information, the Parties shall agree in advance on the scope of these activities and the rules for covering the costs. The costs borne by the Controller must be proportionate to the actual work involved and must not in practice prevent or unduly hinder the audit. No fee shall be charged for the mere fact of conducting an audit, nor any flat fee that does not correspond to actual, reasonable costs. This provision does not make the exercise of the Controller's rights under the GDPR conditional on prior payment of a fee.
A report shall be drawn up on the audit, setting out at least its scope, date, a description of the activities performed, the findings and any recommendations. The Controller shall provide the Processor with the relevant part of the report concerning the processing of the entrusted personal data, to the extent necessary to enable the findings to be clarified and any corrective action to be taken. The report should not contain confidential information or data of other clients of the Processor that are not necessary to achieve the purpose of the audit.
The Controller is liable for damage caused during the audit for reasons attributable to the Controller or persons acting on its behalf, on the terms set out in applicable law. This liability does not cover damage for which the Processor is liable under the law, nor does it limit the obligations of either Party arising directly from the GDPR or other mandatory provisions of law.

[Term]

§ 9.

The Controller entrusts the Processor with the processing of personal data for the term of the Service Agreement, unless otherwise provided by law.
Upon termination or expiry of the Service Agreement, the provisions of these DPA Terms relating to the entrustment and protection of personal data shall cease to apply and the Processor shall cease processing the personal data entrusted to it, unless the Parties decide otherwise. The provisions of these Terms may remain in force for a longer period if the Processor stores the Controller's data in accordance with § 10(2) for a period after the termination or expiry of the Agreement

[Deletion of Personal Data]

§ 10.

After termination or expiry of the Service Agreement, the Processor shall, as instructed by the Controller, either delete the entrusted data or return them to the Controller, and shall delete existing copies thereof, subject to paragraphs 2–5 and to cases where European Union law or Polish law requires the Processor to continue storing the data.
By accepting these DPA Terms, the Controller instructs the Processor to store the entrusted data in an archive for a period of 5 years from the day following the day on which the subscription expires (hereinafter: the Archiving Period), on the terms set out in § 12 of the mKsiegowa.pl Terms of Service. During the Archiving Period, the Processor stores the data solely to enable the Controller to access and export them. It does not perform any other operations on them, except those necessary to ensure their security.
The Controller may at any time, including during the Archiving Period, instruct the Processor to delete the data via the User Panel or in documentary form from the e-mail address assigned to the account. The Processor shall delete the data within 30 days of receiving the instruction. Until deletion, backup copies shall be secured and used solely to restore data following a failure.
After the Archiving Period has expired, the Processor shall delete the data without a separate instruction, within the time limits set out in paragraph 3. At least 30 days before deletion, the Processor shall inform the Controller thereof at the e-mail address assigned to the account. Failure to deliver this information for reasons attributable to the Controller, in particular due to an out-of-date e-mail address, shall not suspend deletion.
Until the data are deleted, these DPA Terms shall apply accordingly, regardless of the termination or expiry of the Service Agreement.
Data are returned by enabling the Controller to export them via the User Panel. At the Controller's request, the Parties shall draw up a handover report.
At the Controller's request, the Processor shall confirm the deletion of the data by means of a statement sent to the e-mail address assigned to the account.

[Liability]

§ 11.

With respect to damage arising from non-performance or improper performance of these DPA Terms by the Parties, the provisions of this section shall take precedence over the civil liability provisions set out in the Terms of Service.
The Processor is liable to the Controller for non-performance or improper performance of the obligations under these DPA Terms on the terms set out in applicable law, subject to the provisions of this section.
1. The Processor is not liable for non-performance or improper performance of obligations to the extent that this results from circumstances for which the Processor is not responsible, in particular from:
  1. instructions of the Controller that are contrary to the law or these DPA Terms, if the Processor was not obliged to carry them out or justifiably refused to carry them out;
  2. acts or omissions of the Controller, persons acting under its authority or other persons for whom the Processor is not responsible under applicable law;
  3. errors in the data or information provided by the Controller, if they contributed to the damage;
  4. circumstances beyond the Processor's control, the effects of which could not be prevented despite exercising the due diligence required by law.
2. Subject to paragraph 3, the Processor's total liability to the Controller for damage resulting from a single event or a series of related events connected with the performance of these DPA Terms is limited to a total amount equal to twelve times the net monthly subscription fee payable for the service provided to the Controller, as applicable on the date of the event giving rise to the damage.
3. The limitations of liability set out in paragraphs 2(a) shall not apply to the extent that their application would be impermissible under mandatory provisions of law, in particular with respect to liability for damage caused intentionally. The provisions of this section do not limit the rights of data subjects or the obligations or liability of the Parties arising directly from the GDPR or other mandatory provisions of law.
4. The Processor's liability to the Controller for the acts or omissions of a sub-processor to which data have been sub-entrusted is governed by the rules set out in this paragraph and in applicable law, including Article 28(4) GDPR.
5. Subject to paragraph 4, the Processor's liability to the Controller on any legal basis, to the extent permitted by law, covers only the losses actually incurred by the Controller (actual damage). It does not cover benefits that the Controller could have obtained had the damage not been caused (lost profits). This applies in particular to lost profit or revenue and lost contracts, orders or clients. The Parties agree that this paragraph constitutes a contractual provision within the meaning of Article 361 § 2 of the Polish Civil Code.
The Processor is not liable for damage suffered by the Controller or a third party as a result of:
1. a justified refusal to carry out an instruction of the Controller, if carrying out that instruction could result in a breach of law;
2. a justified suspension of the performance of these DPA Terms in accordance with § 4(5) and (6) of these DPA Terms;
3. the fulfilment of an obligation arising from provisions of law;
4. termination of the Service Agreement by the Processor with immediate effect in the cases expressly provided for in these DPA Terms and for reasons attributable to the Controller;
5. The Processor is not liable for damage suffered by the Controller or a third party caused through the fault of the Controller, in particular as a result of:
  1. a breach of the GDPR;
  2. unlawful processing of personal data;
  3. sharing the account with third parties;
  4. non-performance or improper performance of these DPA Terms or the mKsiegowa.pl Terms of Service;
  5. entrusting the processing of personal data for which the Controller has no legal basis for processing;
  6. processing personal data in a manner inconsistent with the purposes for which it obtained them;
  7. the carrying out of an unlawful instruction of the Controller where the Controller, even unintentionally, misled the Processor as to the circumstances determining the unlawfulness of carrying out that instruction;
  8. storing, providing and exchanging content, information or data that are contrary to the law, these DPA Terms or the Service Agreement;
6. use of the technical infrastructure in a manner inconsistent with its intended purpose and with the mKsiegowa.pl Terms of Service;
7. failure to apply the safeguards recommended by the Processor;
The Processor is not liable for the proper protection of personal data in that part of the ICT system which is managed by the Controller.
In particular, the Processor is excluded from liability for the protection of personal data at the operating system services layer and at the layer of applications installed by the Controller on end devices.
If the Processor or its clients suffer damage as a result of the Controller's non-performance or improper performance of these DPA Terms, in particular as a result of applying inadequate safeguards or improper use, configuration, updating or securing of the operating system/operating system services or applications, the Controller shall compensate for such damage in full.
If, as a result of an act or omission of the Controller constituting a breach of these DPA Terms, the mKsięgowa.pl Terms of Service or applicable law, in particular as a result of carrying out an instruction of the Controller, the President of the Personal Data Protection Office imposes an administrative fine or other sanction on the Processor or a sub-processor, the Controller shall compensate the Processor in full for the resulting damage, including in particular by reimbursing the fine paid by the Processor.
If, as a result of an act or omission of the Controller constituting a breach of these DPA Terms, the mKsięgowa.pl Terms of Service or applicable law, in particular as a result of carrying out an instruction of the Controller, a person whose personal data are processed under these DPA Terms brings a claim for damages against the Processor, the Controller shall:
1. release the Processor from the debt by taking its place and satisfying the claims of the claimant, and
2. compensate the Processor in full for the resulting damage, including in particular by reimbursing the amount of compensation paid by the Processor.

[Final Provisions]

§ 12.

Unless these DPA Terms provide otherwise, in the event of any conflict between the provisions of these DPA Terms and the mKsięgowa.pl Terms of Service, the provisions of these DPA Terms shall prevail.
These DPA Terms, as amended in 2026, enter into force on 1 November 2026 and from that date replace the previous version of the DPA Terms, subject to the rules for the effective introduction of amendments to agreements concluded before that date and to mandatory provisions of law.
Where necessary, the Processor may amend these DPA Terms. In such a case, §13 of the mKsiegowa.pl Terms of Service shall apply accordingly.
These DPA Terms may be amended where this becomes necessary as a result of changes to generally applicable law.
The court competent to resolve disputes arising from these DPA Terms is the court having jurisdiction over the Processor's registered office at the relevant time.
These DPA Terms apply from the moment the Controller accepts their provisions.
In matters not governed by these DPA Terms, the GDPR, national data protection laws, the Polish Civil Code and other relevant provisions shall apply.