Data processing agreement. The company’s data under the company’s control.

1. Parties and conclusion of the agreement

The controller is the Customer of the Mivare Space service, i.e. the entrepreneur who has registered a Company Account, hereinafter the “Controller”.

The processor is MIVARE GROUP PROSTA SPÓŁKA AKCYJNA, with its registered office in Krasnobród, KRS 0001268091, NIP 9223092251, REGON 545767254, operating under the Mivare Space brand, hereinafter the “Processor” or “Mivare”.

This data processing agreement, hereinafter the “DPA”, is an agreement within the meaning of Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). It is concluded in electronic form upon acceptance of the Mivare Space Terms of Service (MSP-LEG-001) at registration of the Company Account and remains in force for the term of the Contract and until completion of the activities described in section 12.

Capitalised terms have the meanings given to them in the Terms of Service. In matters of personal data protection, the DPA takes precedence over the Terms of Service.

2. Subject matter, nature and purpose of processing

The Controller entrusts the Processor with the processing of personal data entered into the Application by the Controller, the Users and External Persons using the public functions of the Application (the Controller's clients, architects and persons acting for B2B partners), solely for the purpose of providing the Mivare Space service.

Processing comprises the operations necessary to provide the service: storage, organisation, structuring, retrieval, consultation, alteration and erasure of data on the Controller's instructions, displaying the data to Users and External Persons to the extent set by the Controller, generating documents and summaries, recording the device's position when attendance is registered, removing metadata from uploaded photographs, sending e-mail messages to the Controller's clients triggered by Users or by the Application settings, operating the public functions of the Application, preparing summaries by means of the Mivi assistant, where the Account Administrator and the User have enabled it, making backups, and access within technical support and the remedying of failures.

The Processor does not process the entrusted data for its own purposes, does not combine it with the data of other customers, does not sell it and does not use it for profiling or for training artificial intelligence models.

3. Categories of data subjects and data

Categories of data subjects:

• the Controller's clients: natural persons, including those conducting business activity, and contact persons of clients that are companies;
• employees and co-workers of the Controller, including Users of the Application;
• architects and designers invited by the Controller to projects;
• the Controller's B2B partners, their contact persons and the clients whose data the partner provides in its submissions;
• subcontractors of the Controller and their contact persons;
• contact persons of suppliers and other contractors of the Controller;
• other persons whose data the Controller enters into the Application in accordance with its intended purpose.

Categories of personal data:

• identification and contact data: first name and surname, company name, address, correspondence address, telephone number, e-mail address, preferred contact channel and language;
• identifiers: NIP, REGON, KRS, EU VAT number and, where the Controller enters it, the PESEL number;
• project and property data: addresses and locations of projects, units and rooms, floor plans with outlines and markers, scope of work, schedules, tasks, notes, conversations, quotations, selections of materials and fittings together with prices, changes to the scope, acceptance protocols, defects and warranties;
• photographs of interiors at the stages of work, photographs of variants and inspirations, photographs of defects sent by clients and other files attached by Users and External Persons;
• decisions, acceptances and comments given in the Application or in its public functions;
• data on cooperation with B2B partners: submissions, authorisations to take decisions, rates and settlement of commissions;
• consents and communication preferences of the Controller's clients and contact history;
• data of employees and co-workers: contact details, emergency contact, position, skills, form and period of cooperation, attendance records with the device's position at the start and end of work, timesheets, cost rates, equipment issued;
• technical data: IP address and timestamps of actions performed in the Application or in its public functions.

The Application is not intended for the processing of special categories of personal data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR), and the Controller does not entrust such data. If the Processor finds that such data has been entered, it informs the Controller accordingly.

4. Obligations of the Controller

The Controller is responsible for having a legal basis for processing, for the accuracy of the data entered, for fulfilling the information obligations towards data subjects and for obtaining the consents required for sending messages through the Application.

The Controller decides whether, and in respect of whom, to use attendance recording with device location, and is responsible for the compliance of that processing with labour law, including informing employees and co-workers of its purpose and scope.

The Controller decides to which External Persons, and to what extent, it makes the public functions available, in particular that an architect invited to a project sees its rooms, floor plans and photographs irrespective of the “visible to the client” marking, and that a B2B partner provides the data of its clients after confirming in the Application that it has a basis for doing so; the Controller agrees the rules of that cooperation with the partner.

The Controller configures the Application, including User permissions, the retention period of the activity log, the requirement of two-factor authentication and the public functions, in a manner appropriate to the risk of its processing.

5. Instructions of the Controller

The Processor processes data only on documented instructions from the Controller. The instructions consist of: the Terms of Service and the DPA, the configuration of the Application made by the Controller and the actions of Users and External Persons in the Application, as well as instructions sent from the Account Administrator's e-mail address to support@mivarespace.com.

The Processor may process data without an instruction from the Controller only where required to do so by Union or Member State law; in such a case it informs the Controller of that legal requirement before processing begins, unless that law prohibits such information.

If, in the Processor's opinion, an instruction infringes the GDPR or other data protection provisions, the Processor immediately informs the Controller and may suspend its execution until the matter is clarified.

6. Confidentiality

The Processor grants access to the data only to authorised persons who need access in order to provide the service, technical support or remedy failures, and who have committed themselves to confidentiality or are under a statutory obligation of confidentiality.

Access by the Processor's personnel to the data of a specific Company Account takes place only to the extent necessary to handle a request of the Controller, remedy a failure or ensure security.

7. Security of processing

The Processor applies the technical and organisational measures referred to in Article 32 GDPR, appropriate to the risk. Their implementation status as at the effective date of the DPA:

• encryption of data in transit using the TLS protocol (status: implemented);
• passwords stored solely in hashed form using the Argon2id algorithm, password strength requirements and checking against commonly known passwords (status: implemented);
• two-factor authentication (TOTP) available to all Users, with the option for the Controller to require it; two-factor authentication for the Processor's administrative accounts (status: implemented);
• limiting of login attempts, account lockout after failed attempts and automatic expiry of inactive sessions (status: implemented);
• logical separation of the data of each Company Account at application and database level (status: implemented);
• public functions of the Application accessible only through links with a random key and an expiry date, the key being stored in the database solely in hashed form, with additional verification using data known to the authorised person, a limit on attempts and logging of each opening (status: implemented);
• removal of metadata, including location, from uploaded photographs (status: implemented);
• files stored in a private file store (Object Storage) in the European Union, encrypted by the Application before being sent to the store, kept separately for each customer account and made available only through the Application after authorisation, with the Application decrypting the file at the moment of download (status: implemented);
• scanning of every uploaded file with anti-virus software before it is stored (status: implemented);
• principle of least privilege for Users and the Processor's personnel, including a separate permission for costs and margins (status: implemented);
• event logging in the Application (activity log) (status: implemented);
• automatic backups: a database backup every hour, kept for 7 days, and a daily full backup of the database, kept for 3 days, and a continuous backup of files, in which a deleted file remains for no more than 30 days; backups are encrypted before being written, the key needed to read them is kept outside the server and outside the backup storage, and the backups themselves are stored in the European Union, in a separate Object Storage container, kept apart from the Application server and from the file store; periodic restore testing (status: implemented);
• installation of updates and security patches (status: implemented);
• security incident handling procedure (status: implemented);
• encryption of the database on the server's disk (status: not implemented, planned); until it is implemented, data in the database is protected by access control, the principle of least privilege and event logging; files and backups are encrypted as described in the points above.

The Processor does not claim ISO or SOC certification. The Processor may change the security measures, provided that the change does not reduce the overall level of protection.

8. Sub-processing

The Controller grants the Processor general authorisation to engage sub-processors for further processing of the data. As at the effective date of the DPA, the Processor uses the following sub-processors:

• Contabo GmbH (Germany, Munich): the server on which the Application and its database run, the file store and the backup store (Object Storage); data centres in the European Union; access to all categories of data within the scope of providing infrastructure services; files in the file store and backups are encrypted by the Processor before being written; no transfer outside the European Economic Area.
• OVH Sp. z o.o. (OVHcloud group): sending e-mail from the Application, as well as Mivare's domains and websites; data centres in the European Union; access to the data contained in e-mail messages sent from the Application, solely for their delivery; no transfer outside the European Economic Area.
• Mistral AI SAS (France, Paris): preparing summaries, answers and document drafts by means of the Mivi assistant, only in Company Accounts in which the Account Administrator has enabled it, and for Users who have enabled it; processing and storage in the European Union, without using the data to train models; queries and responses are stored for no more than 30 days solely for the purpose of detecting abuse, after which they are deleted; access to the data transferred in the query; no transfer of data outside the European Economic Area.

The Mivi assistant is disabled by default. By enabling it for the Company Account, the Account Administrator acts on behalf of the Controller and gives the Controller's consent to the involvement of Mistral AI as a sub-processor with respect to that function; each User then enables or disables it for their own account. The Processor transfers to Mistral AI only the data needed to prepare a summary or answer for the User who has enabled the assistant (event log entries and extracts from records to which that User has access in the Application) and does not transfer passwords, authentication data, payment card data, PESEL numbers or identity document numbers. In the Mivi+ module, that scope also includes the content of the documents and records on which the User works with the assistant, as well as the history of the User's conversations with the assistant, which the Processor stores in the Application for 90 days unless the User deletes it earlier; the exclusions set out in the preceding sentence continue to apply. Disabling of the assistant by the Account Administrator or by the User immediately stops the transfer of data to that extent.

The Processor informs the Account Administrator by e-mail in advance of any intended addition or replacement of a sub-processor and publishes the current list in the DPA. The Controller may raise a reasoned objection within 14 days of receiving the information. If the parties do not agree on a solution, the Controller may terminate the Contract with effect from the day preceding the change and receives a refund of the fee for the unused period paid in advance.

The Processor imposes on each sub-processor data protection obligations no less protective than those arising from the DPA and remains liable to the Controller for the performance of the sub-processor's obligations.

The payment operator Stripe (Stripe Payments Europe, Limited) is not a processor: it handles only the Customer's payments for the service and has no access to the entrusted data. Nor is Google a sub-processor: the Google Maps service is opened by the User with the “Navigate” button, with the address or position of the project as the route destination, on Google's terms.

9. Transfers of data outside the European Economic Area

The Processor processes the entrusted data exclusively within the European Economic Area. A transfer of data to a third country or an international organisation requires prior notice to the Controller in accordance with the procedure in section 8 and the use of a mechanism compliant with Chapter V GDPR.

10. Assistance to the Controller

The Processor assists the Controller in fulfilling its obligation to respond to requests from data subjects. The Application enables the Controller to independently access, rectify, export and erase data and to anonymise a client's data. If a data subject's request reaches the Processor directly, the Processor forwards it to the Controller without undue delay and does not respond to it itself, unless authorised to do so by the Controller.

Taking into account the nature of processing and the information available, the Processor assists the Controller in fulfilling the obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultations, by providing the information it holds about the Application and the measures applied.

11. Personal data breach

The Processor notifies the Controller of a personal data breach without undue delay, and no later than 48 hours after becoming aware of it, to the Account Administrator's e-mail address.

The notification contains, to the extent the information is available: a description of the nature of the breach, including the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it, as well as the contact details of the person providing the information. The Processor provides any information not available at the time of notification in phases.

The Processor documents breaches and takes action to mitigate their effects. Notification of a breach to the supervisory authority and communication to the data subjects are the responsibility of the Controller; the Processor assists the Controller in doing so.

12. End of processing, return and deletion of data

The Controller may at any time download a copy of the data using the export function in the Application (a ZIP archive containing CSV files and attached files). After the end of the Contract, the Processor retains the data for 30 days to enable its export or resumption of the service and, at the Controller's request, delivers the export by electronic means during that time.

The Processor then deletes the entrusted data no later than 60 days after the end of the Contract. Copies of the data in backups are deleted in the rotation cycle, no later than 30 days after deletion of the data from the Application. At the Controller's request, the Processor confirms the deletion by electronic means.

The activity log is retained for the period set by the Controller, from 30 to 180 days. Copies of deleted records, kept for the purpose of restoring data deleted by mistake, are retained for no longer than 180 days and are deleted together with the deletion of the Company Account.

The Processor may retain the entrusted data for longer only where required by Union or Member State law, and only to the extent resulting from that obligation.

13. Information and audit

The Processor makes available to the Controller the information necessary to demonstrate compliance with the obligations under Article 28 GDPR, in particular answers to questions concerning the Application, the security measures and the sub-processors sent to hello@mivaregroup.com, within 14 days.

If the information provided is not sufficient, the Controller or an independent auditor bound by a duty of confidentiality may carry out an audit no more than once every 12 months, except for an audit following a personal data breach or at the request of a supervisory authority. An audit requires at least 30 days' prior notice, takes place on working days, may not disrupt the provision of the service or breach the confidentiality of other customers' data, and is carried out at the Controller's expense.

14. Liability and final provisions

The liability of the parties under the DPA is governed by Article 82 GDPR and the Terms of Service, provided that the limitations of liability do not apply where exclusion or limitation is not permitted by law.

Amendments to the DPA, including updates to the list of sub-processors, are made in accordance with the procedure provided for in the Terms of Service for amendments to documents, subject to section 8.

The DPA is governed by Polish law. It is made available in seven language versions; in the event of any discrepancy, the Polish version prevails. The current version is available at https://mivaregroup.com/en/legal/space/dpa/

The DPA is effective from 30 October 2026.