Data Processing Agreement

§ 1. Parties

1. Controller – a User of the veedeck Platform (a designer, studio or design office) who has accepted the Terms of Service, acting as the controller of the data of the people whose data they enter into the Platform.
2. Processor – Daniel Rychlik, conducting business under the name Daniel Rychlik Management, ul. Młynarska 2A/17, 51-116 Wrocław, Poland, NIP 8943229341, REGON 527749980, contact: contact@veedeck.com (hereinafter "veedeck" or the "Processor").
3. The Agreement is concluded in electronic form (Art. 28(9) GDPR) upon acceptance of the Terms of Service, of which it forms an integral part.

§ 2. Definitions

1. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
2. Platform – the veedeck service available at veedeck.com, including the designer panel, client panel, contractor panel, the Veepick extension and the AI Agent.
3. Data – personal data entered into the Platform by the Controller or on its behalf (including by its clients, contractors and team members), processed by veedeck on behalf of the Controller.
4. Sub-processor – an entity to which veedeck entrusts further processing of the Data.
5. Terms not defined here have the meaning given to them in the GDPR or the Terms of Service.

§ 3. Subject matter and duration

1. The Controller entrusts veedeck with processing the Data to the extent and for the purpose set out in the Agreement, and veedeck undertakes to process it in accordance with the Agreement, the GDPR and other laws.
2. The Agreement remains in force for as long as Platform services are provided to the Controller and for the period needed to delete or return the Data in accordance with § 11.
3. veedeck charges no separate fee for processing Data under the Agreement beyond the plan fee set out in the Terms of Service.

§ 4. Nature and purpose of processing

1. veedeck processes the Data solely to provide Platform services to the Controller in accordance with the Terms of Service, including: storage, organisation, making it available to persons authorised by the Controller (clients, contractors, team members), sending e-mail notifications, creating backups, and operating features based on artificial intelligence (AI Agent, voice dictation, Veezard, AI summaries).
2. Processing is carried out by automated means in the IT systems of veedeck and its Sub-processors.
3. The AI Agent processes Data only to the extent the person using it has access to in the given workspace, and performs actions that change Data only after that person confirms them. Neither veedeck nor its Sub-processors use the Data to train artificial intelligence models.

§ 5. Types of data

veedeck processes the following types of Data, to the extent the Controller enters them:

• identification and contact data: first and last name, company name, e-mail address, phone number, project address;
• collaboration data: projects, schedules, payments and billing stages, shopping lists, notes, tasks, events;
• communication content: messages in Discussions, comments and pins, survey responses, contractor questions;
• files: visualisations, drawings, photos, documents, moodboards, voice recordings attached to pins;
• client panel and contractor panel account data: login, activity history;
• the content of conversations with the AI Agent, and recordings and transcripts of dictated commands, to the extent they contain the above data.

The Controller should not enter special categories of data (Art. 9 GDPR) or data relating to criminal convictions (Art. 10 GDPR) into the Platform, unless this is necessary and the Controller has a legal basis for it.

§ 6. Categories of data subjects

• the Controller's clients (investors, contact persons, their family members indicated as contacts);
• the Controller's contractors and subcontractors and their employees;
• members of the Controller's team;
• other people whose data the Controller enters into the Platform (e.g. suppliers).

§ 7. veedeck's obligations

veedeck undertakes to:

1. process the Data only on documented instructions from the Controller; such instructions include the Terms of Service, the Agreement and actions performed in the Platform by the Controller and persons authorised by it. If the law requires veedeck to process the Data, veedeck will inform the Controller, unless the law prohibits this;
2. immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other laws;
3. ensure that persons authorised to process the Data have committed themselves to confidentiality;
4. apply the security measures required by Art. 32 GDPR, described in Annex 2;
5. assist the Controller, insofar as possible and by appropriate technical measures, in fulfilling data subjects' rights (access, rectification, erasure, restriction, portability, objection); requests addressed directly to veedeck will be forwarded to the Controller without undue delay;
6. assist the Controller in meeting its obligations under Arts. 32–36 GDPR (security, breach notification, impact assessment, prior consultation), taking into account the nature of processing and the information available;
7. keep a record of categories of processing activities carried out on behalf of Controllers (Art. 30(2) GDPR).

§ 8. Sub-processors

1. The Controller gives veedeck general authorisation to engage the Sub-processors listed in Annex 1 for further processing of the Data.
2. veedeck imposes on its Sub-processors, by contract, the same data-protection obligations as in the Agreement, in particular the obligation to implement appropriate security measures. veedeck remains liable to the Controller for the performance of the Sub-processors' obligations.
3. veedeck informs the Controller of any intended addition or replacement of a Sub-processor at least 14 days in advance, by updating Annex 1 on veedeck.com and by e-mail or a notice in the Platform.
4. Within that period, the Controller may raise a reasoned objection at contact@veedeck.com. If the parties do not agree on a solution, the Controller may terminate the service agreement with immediate effect, and veedeck will refund the fee for the unused period. No objection means consent to the change.

§ 9. Transfers of data outside the EEA

1. Some Sub-processors process Data outside the European Economic Area (Annex 1).
2. Transfers take place only on the basis of a European Commission adequacy decision (including the EU-US Data Privacy Framework) or of standard contractual clauses approved by the European Commission (Decision 2021/914), together with supplementary measures where necessary.
3. At the Controller's request, veedeck will provide information on the safeguards applied.

§ 10. Personal data breaches and audits

1. veedeck notifies the Controller of a personal data breach without undue delay, no later than 36 hours after becoming aware of it, at the e-mail address of the Controller's account. The notification contains the information required by Art. 33(3) GDPR to the extent available; any missing information is provided in phases.
2. veedeck makes available to the Controller the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.
3. The Controller has the right to an audit, including an inspection, carried out by the Controller or an authorised auditor bound by confidentiality, with at least 14 days' notice, on business days, no more than once a year (unless a personal data breach has occurred or a supervisory authority requires it) and in a way that does not disrupt veedeck's operations. In the first instance, veedeck answers questions in writing and provides the documents it holds.
4. The costs of the audit are borne by the Controller.

§ 11. End of processing

1. After the services end, the Controller may download its Data for 30 days using the export functions available in the Platform or by request at contact@veedeck.com.
2. After that period, veedeck deletes the Data, including copies, unless EU or Polish law requires further storage. Backups are deleted as they are overwritten, no later than within 90 days.
3. AI Agent data is deleted within the periods set out in the Privacy Policy, also while the Agreement is in force. Voice dictation recordings and transcripts are not stored by veedeck; the service provider stores them on the terms described in Annex 1.

§ 12. Final provisions

1. The parties' liability for damage resulting from a breach of the Agreement is governed by the GDPR and the Terms of Service, provided that the limitations of liability in the Terms of Service do not exclude liability arising mandatorily from data-protection law.
2. In the event of a conflict between the Agreement and the Terms of Service regarding personal data protection, the Agreement prevails.
3. veedeck may amend the Agreement for important reasons (changes in the law, changes to Platform features), informing the Controller with the advance notice set out in the Terms of Service for amendments to the Terms. Changes to Annex 1 follow the procedure in § 8.
4. Matters not covered by the Agreement are governed by the GDPR, Polish law and the Terms of Service.
5. The Agreement is effective from October 30, 2026.

Annex 1. List of Sub-processors

As of October 30, 2026. Changes are published on this page in accordance with § 8.

Integrations enabled by the Controller (e.g. Google Calendar sync, Sign in with Google, browser push notifications) are not veedeck Sub-processors. Data is sent to them on the Controller's instruction, to the Controller's own account with the given provider, under the Controller's agreement with that provider.

Annex 2. Security measures

veedeck applies in particular the following measures (Art. 32 GDPR):

1. Encryption of SSL/TLS connections between the browser and the Platform and between the Platform and Sub-processors. User passwords are stored only as cryptographic hashes (bcrypt).
2. Access control: account login, separation of data between workspaces, permissions of team members, clients and contractors set by the Controller; contractors have no access to shopping lists or prices.
3. veedeck staff access limited to authorised persons bound by confidentiality, to the extent needed to maintain and support the Platform.
4. AI Agent: access only to the data and modules the person using the agent has access to; actions that change data require confirmation and are logged with the option to undo; content entered by third parties is treated as data, not instructions; automatic deletion of agent data after the periods set out in the Privacy Policy.
5. Voice dictation: voluntary, started with a button and indicated in the interface; recordings are not stored by veedeck and are kept by the provider for as long as the service is used; use of recordings to train the provider's models is disabled.
6. Backups stored with the hosting provider in the EEA.
7. Event logging: access and error logs, AI Agent action logs, used to detect abuse and handle incidents.
8. Updates and reviews: regular software updates and infrastructure security reviews.
9. Breach-handling procedure ensuring notification to the Controller within the deadline in § 10.
10. Agreements with Sub-processors meeting the requirements of Art. 28 GDPR.