Data Processing Agreement

This Data Processing Agreement ("DPA") is made between the Client as the data controller ("Controller") and Michał Fox, doing business under the Querora brand, in Kraków, Poland, email: hello@querora.com, as the processor ("Querora").

The DPA is concluded electronically when the Client accepts the Terms of Service on entering into the Contract, and meets the requirements of Article 28(3) and 28(9) GDPR. GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council.

The DPA applies for as long as the Contract runs and until the data is deleted or returned under Section 10. On personal data it prevails over the Terms, and a separate data processing agreement signed by the parties prevails over this template.

Capitalized terms have the meaning given in the Terms.

The Controller entrusts Querora with processing the personal data Querora can access in the Client Accounts and on the Client Website, solely to perform the Subscription.

Processing includes, in particular: reading and viewing data in the CMS, on the server and in the Google Business Profile while shipping fixes and content; analyzing data from Google Search Console, Bing Webmaster Tools and Google Analytics 4 in aggregated form; and storing in the Panel the content of Tickets and the attachments the Controller adds to them.

Querora does not use the entrusted data for its own purposes, does not combine it with other clients' data and does not pass it to AI Engines. We send AI Engines only the Questions from the Measurement list.

The entrusted processing may cover the following categories of data subjects and data:

Google Search Console and Bing Webmaster Tools provide aggregated search data, which as a rule is not personal data.

The Controller does not entrust special categories of data (Article 9 GDPR) or data on criminal convictions. If such data exists in the systems of the Client Website, for example health data in a clinic's forms, the Controller says so before granting access, and Querora does not view that data and uses only the parts of the system needed for the work.

Querora:

1. 1)processes the data only on documented instructions from the Controller, which are the Contract, the DPA and instructions given in Tickets, including with regard to transfers outside the European Economic Area;
2. 2)informs the Controller immediately if in its opinion an instruction infringes the GDPR or other law;
3. 3)gives access to the data only to authorized people who have committed to confidentiality;
4. 4)applies the security measures in Section 5;
5. 5)uses sub-processors only under Section 6;
6. 6)assists the Controller in responding to requests from data subjects (Section 8);
7. 7)assists the Controller in meeting its obligations under Articles 32 to 36 GDPR, taking into account the nature of processing and the information available;
8. 8)deletes or returns the data after the Contract ends under Section 10;
9. 9)makes available the information needed to demonstrate compliance with Article 28 GDPR and allows audits (Section 9).

Querora applies technical and organizational measures appropriate to the risk, in particular:

1. 1)encrypted connections when working with the Client Accounts and the Client Website;
2. 2)separate accounts and roles instead of shared passwords where the Controller's system allows it, and two-factor authentication on Querora's accounts;
3. 3)the least privileges needed for the work, including read-only access to Google Search Console, Bing Webmaster Tools and Google Analytics 4;
4. 4)not copying personal data from the Controller's systems to Querora's devices or into the Panel, other than the content of Tickets and the attachments added by the Controller;
5. 5)keeping login details in an encrypted password manager;
6. 6)the ability to roll back every change shipped on the Client Website;
7. 7)removing access within 7 days of the end of the Contract.

The Controller gives Querora general authorization to use sub-processors from the following categories:

Email runs on Querora's own server at the server provider listed above, without a third-party email service.

We give at least 14 days' notice by email before adding or replacing a sub-processor. During that time the Controller may object, and if we do not reach an agreement, terminate the Contract effective on the date of the change, at no extra cost.

A sub-processor is bound by data protection obligations no weaker than those in the DPA, and Querora is liable for its actions as for its own.

Data is transferred outside the EEA only on the basis of a European Commission adequacy decision or standard contractual clauses.

Google, Microsoft, the CMS provider and the hosting of the Client Website are not Querora's sub-processors. The Controller uses them under its own agreements.

Querora notifies the Controller of a breach involving the entrusted data without undue delay and no later than 48 hours after becoming aware of it, by email to the account owner.

The notification includes the information listed in Article 33(3) GDPR, to the extent available. Anything else is sent as soon as it is known.

Querora takes steps to limit the effects of the breach and documents them.

A request from a data subject sent to Querora about the entrusted data is passed on to the Controller within 3 Business Days, and we do not answer it ourselves unless the Controller asks us to.

On the Controller's instruction we help carry out the request, in particular by finding, correcting or deleting data in the systems of the Client Website.

At the Controller's request we provide information about the processing and the security measures within 14 days.

The Controller may carry out an audit once a year, and also after a personal data breach, with at least 14 days' notice. The audit takes place in support hours, without access to other clients' data, and is paid for by the Controller unless it shows a breach of the DPA.

Within 30 days of the end of the Contract, Querora deletes the entrusted data, and on a request made by the Controller before the Contract ends returns it in an agreed format. It also removes its access to the Client Accounts within the time in clause 5.1.

We confirm the deletion by email. This does not apply to data we must keep under the law.

The parties are liable for damage caused by an infringement of the GDPR under Article 82 GDPR. The limitation of liability in clause 13.2 of the Terms applies to the extent the law allows.

Matters not covered here are governed by the Terms, the GDPR and Polish law.

This DPA is effective from 24 October 2026.