Data Processing Agreement
v1.0 · 2026
1. Parties
Controller — the Founder who uploads materials containing personal data (e.g. team members, customers in a deck). Processor — Fundacja "Konstelacja.org", ul. Morska 30B/5, 84-240 Reda, Polska, KRS 0000974966, NIP 5882481701, REGON 522216641, e-mail: ada@ada-margo.com. The agreement is concluded when the Founder accepts the Terms and uploads a project.
2. Subject and duration
Processing of personal data contained in decks and project data, for hosting, display to verified investors and access logging, for the duration of the project's publication plus deletion time.
3. Categories
Identification and contact data, professional data and images of team members, and any personal data the Founder includes. No special categories unless the Founder lawfully includes them.
4. Processor obligations
Process only on documented instructions; ensure confidentiality of authorised persons; apply Art. 32 measures (encryption in transit, private storage, row-level security, 60-second signed links, watermarks, access logs); assist with data subject requests and Art. 32–36 obligations; notify personal data breaches without undue delay, no later than 36 hours.
5. Sub-processors
The Controller gives general authorisation for: Lovable / Supabase and Cloudflare (hosting, database, storage), Stripe (payments), AI model providers via Lovable AI Gateway (teaser-level data only). The Processor will inform about changes, giving the right to object.
6. Audits
The Processor makes available information necessary to demonstrate compliance and allows audits with 14 days' notice, at most once a year unless a breach occurred.
7. End of processing
After the project is removed, the Processor deletes the data within 30 days, except signed NDAs and access logs retained for legal claims.
8. Final provisions
Polish law and the GDPR apply. Version 1.0, effective 4 October 2026.