This Data Processing Agreement ("DPA") is part of the Terms of Service between the customer organisation ("Controller") and HNK CZ s.r.o., Company ID 10719008, Piletická 486, 503 41 Hradec Králové, Czech Republic ("Processor"). It applies whenever the Processor processes personal data on behalf of the Controller in the course of providing the aivisibility service (the "Service") and is concluded by accepting the Terms of Service. In case of conflict, this DPA prevails over the Terms with respect to the processing of personal data.
The Processor processes personal data on behalf of the Controller to the extent necessary to provide the Service as described in the Terms. This DPA lasts for the term of the Terms and until all personal data has been deleted or returned under Section 11.
| Nature and purpose | Hosting, storage, analysis and display of prompts, Engine answers and statistics; sending transactional e-mails; optional read-only retrieval of Google Search Console and Google Analytics 4 data of the properties the Controller selects. |
|---|---|
| Categories of data subjects | The Controller's users (members of the organisation); persons incidentally referred to in Engine answers, search queries or analytics data; the Controller's contacts for billing. |
| Categories of personal data | Identification and contact data of users (name, e-mail, Google account identifier); usage and audit data; search queries and aggregated web analytics metrics from connected Google properties; personal data that may appear in prompts or Engine answers. |
| Special categories | None intended. The Controller will not include special categories of data (Art. 9 GDPR) in prompts. |
The Processor processes personal data only on documented instructions of the Controller. The Controller's instructions are the Terms, this DPA and the Controller's use of the Service's features (creating projects, defining prompts, running measurements, connecting Google properties, inviting members). The Processor informs the Controller without undue delay if it considers an instruction to infringe data protection law. The Processor may process personal data to comply with a legal obligation to which it is subject, in which case it informs the Controller unless the law prohibits it.
The Processor ensures that persons authorised to process personal data are bound by confidentiality and have access only to the data needed for their tasks. Administrative access by the Processor's staff to a Controller's organisation ("impersonation" for support purposes) is recorded in the organisation's audit log visible to the Controller.
The Processor implements appropriate technical and organisational measures, in particular: hosting in the European Union (Amsterdam); encryption of data in transit (TLS 1.2+); encryption at rest of Google OAuth refresh tokens with a key stored separately from the database; signed session tokens and CSRF-protected sign-in flows; logical separation of customer organisations enforced in every data access; role-based access (owner / member) and an audit log of administrative actions; least-privilege access to production systems with multi-factor authentication; regular database backups; monitoring and automatic restart of services; prompt installation of security updates. Payment card data is processed exclusively by Stripe.
The Controller gives general authorisation to the Processor to engage the sub-processors listed below. The Processor informs the Controller of any intended addition or replacement at least 14 days in advance by e-mail to the organisation owners or by updating the Privacy Policy, giving the Controller the opportunity to object; if the Controller objects on reasonable data protection grounds and no solution is found, the Controller may terminate the Terms. The Processor imposes the obligations of this DPA on its sub-processors by contract and remains liable for their performance.
| Sub-processor | Service | Location |
|---|---|---|
| Railway Corp. | Application and database hosting | EU (Netherlands); USA entity |
| Stripe Payments Europe, Ltd. | Payments, tax, billing portal | Ireland; Stripe, Inc. USA |
| Fakturoid s.r.o. | Invoicing | Czech Republic |
| Resend, Inc. | Transactional e-mail | USA |
| Google LLC / Google Ireland Ltd. | Sign-in, Search Console and Analytics APIs, Gemini Engine | EU / USA |
| OpenAI, L.L.C. | ChatGPT Engine (prompt text only) | USA |
| Perplexity AI, Inc. | Perplexity Engine (prompt text only) | USA |
| Anthropic, PBC | Claude Engine (prompt text only) | USA |
Transfers to sub-processors outside the EEA rely on the EU-U.S. Data Privacy Framework where the sub-processor is certified, otherwise on the Standard Contractual Clauses adopted by the European Commission, supplemented where necessary. The Processor provides copies of the relevant safeguards on request.
The Processor assists the Controller, taking into account the nature of the processing, in responding to requests of data subjects (the Service lets the Controller access, export and delete data directly) and in meeting its obligations regarding security, breach notification, data protection impact assessments and prior consultation. The Processor forwards requests received directly from data subjects to the Controller without undue delay and does not answer them itself unless instructed.
The Processor notifies the Controller of a personal data breach affecting the Controller's data without undue delay and no later than 48 hours after becoming aware of it, by e-mail to the organisation owners, providing the information available at that time (nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken) and supplementing it as it becomes available.
The Processor makes available the information necessary to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by it, at most once a year unless required by a supervisory authority or following a breach, on at least 30 days' notice, during business hours, without disrupting the Processor's operations, and subject to confidentiality. The Processor may first provide existing documentation, third-party certifications and audit reports of its sub-processors.
During the term the Controller can export its data (CSV and PDF) and delete projects, measurements, Google connections, members, the organisation or the account at any time. After the end of the Terms the Processor deletes all personal data of the Controller within 30 days of the organisation's deletion, or, where the organisation is archived under the Terms, within 90 days of archiving, except for data the Processor must retain by law (in particular accounting records, 10 years), which remains protected by this DPA and is not further processed.
The liability of the parties under this DPA is subject to the limitations in the Terms of Service to the extent permitted by Article 82 GDPR and applicable law.
This DPA is governed by the laws of the Czech Republic. Where the Controller requires a signed copy of this DPA, the Processor provides one on request to aivisibility@niftyminds.cz. Should any provision be invalid, the remaining provisions remain in force and the invalid provision is replaced by one that comes closest to its purpose.