Data Processing Agreement

§ 1. The parties

1. This Data Processing Agreement (the "DPA") is concluded between: a) Mikhail Shabatura, a Polish sole proprietorship (JDG), NIP 9662192552, REGON 528667570, of Jana III Sobieskiego 11/21, 15-013 Białystok, Polska — the Processor; and b) the person or organisation operating a provider workspace on Relentu — the Controller.
2. Terms defined in the Terms of Service have the same meaning here. Where this DPA says Recipient it means what the Terms define — the person the Controller teaches, called a student in the product interface.
3. This DPA supplements the Terms of Service and forms part of the same contractual relationship.
4. In matters of personal-data protection this DPA prevails over the Terms of Service.

§ 2. Application

1. This DPA applies automatically from the moment the Controller opens a workspace on Relentu and either adds a Recipient or uploads personal data concerning a Recipient.
2. It applies where that Recipient is resident in the European Economic Area, the United Kingdom, or Switzerland, or is otherwise entitled to the protection of Regulation (EU) 2016/679 (GDPR). It also applies where the law of Israel requires an equivalent processor arrangement (§ 12).
3. No signature is required. Inviting a Recipient, or uploading a Recipient's data, is the Controller's acceptance.

§ 3. Subject-matter and duration

1. The Processor processes personal data on the Controller's behalf only to provide the services described in the Terms of Service and configured in the workspace: scheduling, video sessions, activity cards, notes, files, chat, and billing-related helpers.
2. Processing continues for as long as the workspace is open, together with the wind-down period in § 10.

§ 4. Categories of data and data subjects

1. The categories of personal data the Processor typically processes on the Controller's behalf are: a) identifiers — name, email, role, profile photo; b) contact information — time zone, availability; c) operational content the Controller adds — session notes, files, chat messages, activity cards, homework, recap notes; d) technical data — IP address, user-agent, timestamps — needed to operate and secure the Service.
2. The data subjects are the Controller's Recipients, and where a Recipient is a minor, the Guardian acting on that Recipient's behalf.
3. The Controller must not upload special-category data (art. 9 GDPR) unless the Controller has their own legal basis for doing so. The Service neither asks for nor needs such data.

§ 5. Instructions

1. The Processor processes personal data only on documented instructions from the Controller.
2. The Terms of Service, this DPA, the configuration the Controller sets in the workspace, and any express written instruction the Controller gives, count as documented instructions.
3. Where a law of the Union or of a Member State to which the Processor is subject requires processing beyond those instructions, the Processor shall notify the Controller of that legal requirement before processing, unless that law prohibits such notification on important grounds of public interest.

§ 6. Confidentiality

1. The Processor keeps personal data confidential.
2. The Processor requires every person authorised to process that data — whether employed directly or engaged as a sub-processor — to be bound by a confidentiality obligation of at least the same standard.

§ 7. Security measures

1. The Processor implements the technical and organisational measures required by art. 32 GDPR. They currently comprise: a) TLS 1.2 or higher in transit; encryption at rest on the database and on file storage; b) role-based access control on every endpoint, granted on a least-privilege basis; c) refresh tokens stored in HttpOnly, SameSite=Strict cookies; passwords hashed with a modern algorithm; d) regular dependency and container scanning, and an incident-response runbook; e) backups of the primary database, retained on a rolling 30-day cycle and then destroyed.
2. There is no administrative console. No person at Relentu has an interface that reaches into a Controller's workspace. The data is reachable only through the account it belongs to, or by direct database access, which is limited to the Processor's operator.
3. An up-to-date summary of the measures is available on request to security@relentu.com.
4. Because the Service is provided in Beta, formal third-party certifications (SOC 2, ISO 27001) have not been issued.

§ 8. Sub-processors

1. The Controller generally authorises the Processor to engage the sub-processors listed on the Sub-processors page, which identifies each one, the processing it performs, its region, and the data-protection agreement in place with it.
2. The Processor publishes an addition to, or replacement within, that list before the new sub-processor begins processing, so that the Controller has the opportunity to object required by art. 28(2) GDPR.
3. The Controller may object on reasonable data-protection grounds. Where the Processor cannot offer a reasonable alternative, either party may terminate the affected part of the Service for convenience, with a pro-rata refund of unused prepaid fees.
4. The Processor remains liable to the Controller for the acts and omissions of every sub-processor as if they were its own.

§ 9. Data-subject rights and assistance to the Controller

1. Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to requests to exercise the data-subject rights in Chapter III GDPR (art. 15–22).
2. Self-service tooling in the Controller's workspace covers the common case — a full export of the account's data.
3. Anything narrower, such as the records of a single Recipient or of a single Session, is done by writing to privacy@relentu.com. The Processor responds without undue delay and in time for the Controller to meet their own deadline under art. 12(3) GDPR.
4. The Processor likewise assists the Controller in complying with art. 32–36 GDPR — security of processing, notification of a personal data breach, and, where applicable, data-protection impact assessments and prior consultation.

§ 10. Return or deletion at the end of the service

1. At the choice of the Controller, on termination of the Service the Processor shall either: a) return all personal data it processes on the Controller's behalf, in a structured, commonly used, machine-readable format; or b) delete or anonymise that personal data such that re-identification is not reasonably possible.
2. Return or deletion takes place within thirty (30) days of termination, unless a longer period is required by Union or Member-State law.
3. Encrypted backups age out on the normal 30-day rotation and are then destroyed.
4. Where retention is required by law — typically billing and tax records under Polish law — the Processor may retain the minimum necessary, segregated from the operational store, for the duration of that legal obligation.

§ 11. Personal data breach

1. On becoming aware of a personal data breach affecting personal data processed on the Controller's behalf, the Processor shall notify the Controller without undue delay and in any event within forty-eight (48) hours.
2. The notification shall include, to the extent then known: a) the nature of the breach, including the categories and approximate number of data subjects and of records affected; b) the likely consequences of the breach; c) the measures taken or proposed to address the breach and to mitigate its adverse effects; d) the contact point for further information.
3. The forty-eight-hour period is chosen so that the Controller can meet their own seventy-two-hour obligation to a supervisory authority under art. 33 GDPR. The Processor provides further information as the investigation progresses.
4. Notifications are sent to the email addresses registered by the workspace administrators, and to security@relentu.com as a backup channel. The Controller keeps those addresses current.

§ 12. International transfers

1. The Processor may transfer personal data outside the European Economic Area only: a) to a country covered by an adequacy decision of the European Commission; b) under the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), incorporated into the Processor's contract with the destination party; c) under the UK International Data Transfer Addendum, where the transfer is to the United Kingdom; or d) under the Swiss FDPIC additions, where the transfer involves Swiss data subjects.
2. Personal data of Israeli residents is transferred out of Israel in accordance with the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations 5761-2001.

§ 13. Audits

1. The Processor makes available to the Controller all information necessary to demonstrate compliance with this DPA.
2. Where the Controller reasonably requests an audit: a) the Processor's preferred means of satisfying it is a response to a reasonable written security questionnaire, on no less than thirty (30) days' notice and no more than once in any twelve (12) months; b) an on-site audit is available on separately agreed terms and at the Controller's cost; c) a supervisory authority may audit under its own powers, regardless of these limits.

§ 14. Liability

1. The Processor's liability under this DPA is subject to the limitations in the Terms of Service.
2. None of those limitations applies to: a) a breach of confidentiality; b) unlawful processing of personal data; c) a party's obligation to indemnify a third-party claim it caused; d) a liability that cannot be limited under applicable data-protection law.

§ 15. Term and termination

1. This DPA runs co-extensively with the Terms of Service and terminates automatically when the Controller's workspace is closed.
2. Clauses that logically survive termination — confidentiality, return or deletion, liability, and cooperation in a supervisory authority's investigation — remain in force.

§ 16. Order of precedence

1. In matters of personal-data protection this DPA prevails over the Terms of Service.
2. In all other matters the Terms of Service apply.
3. The mandatory law of a Member State prevails over both.

§ 17. Contact

1. Data-protection contact: privacy@relentu.com.
2. Security incidents: security@relentu.com.
3. Post: Mikhail Shabatura, Jana III Sobieskiego 11/21, 15-013 Białystok, Polska, NIP 9662192552, REGON 528667570.
4. The version of this DPA in force, and the date on which it took effect, are displayed on this page. It is effective as of 2026-08-01.