Data processing agreement

1. Parties and terms

The Controller is the organisation registered in RespondGrid as a unit (e.g. a volunteer fire brigade, a rescue group), on whose behalf the agreement is accepted by a person authorised to represent it and signed in as the unit's administrator (the "Controller").

The Processor is the owner of the RespondGrid service: Maksymilian.org Maksymilian Furtak, Konopnica 95c, 21-030 Motycz, tax number (NIP) 7133092677 (the "Processor"). Contact for data-protection matters: [email protected].

"GDPR" means Regulation (EU) 2016/679. The "Service" is the website respondgrid.com and the RespondGrid apps for Android and iPhone. "Data" means personal data entrusted to the Processor by the Controller in connection with use of the Service.

2. Subject matter, nature and purpose of the processing

The Controller entrusts the Processor with processing Data so that the Controller can keep in the Service: a register of members and associates, records of callouts and incidents, alerting, callout declarations and availability, qualifications and medical-examination deadlines, the unit's Board, an equipment list, and communication with members.

The processing includes in particular: storing Data and making it available to the organisation's members according to their roles, sending notifications and e-mails, making backups, archiving records, and deleting Data.

3. Types of data and categories of persons

Categories of persons: members, candidates and people outside the roster, administrators and editors, people listed on the board and the audit committee (data from the public KRS register).

• identification and contact data: name, e-mail address, telephone number, profile photo;
• data on the role in the organisation, functions and qualifications and their validity dates, including whether and until when a medical certificate is valid (the date only, without results or diagnoses), and scans of documents entered by the Controller;
• data on taking part in incidents and alarms: callout declarations, expected time of arrival, status, arrival time;
• a person's position — only during an alarm after declaring a callout and with their consent, deleted afterwards; an optional "in the area / outside" result without coordinates;
• technical data of devices: notification token, phone model, system and app versions; IP address and time of requests in server logs.

The Service is not meant for storing medical examination results or medical records. Where the Controller enters information about the validity of medical certificates, it is responsible for the legal basis of processing it. The Controller is also responsible for having a legal basis and for having met its information duties towards the people whose data it enters.

Scans of documents (a driving licence, certificates) can carry data the unit does not need, such as a personal identification number (PESEL), an ID card number or a home address. The Controller should upload only the documents, and only the data, needed for the purpose for which they are entered, and cover excess data before uploading (data minimisation, Art. 5(1)(c) GDPR).

4. Controller's instructions

The Processor processes Data only on the Controller's documented instructions; the instructions are this agreement and the actions taken by the Controller and the people it authorises in the panel and the apps (adding, editing, deleting, assigning roles). If the Processor considers an instruction to infringe data-protection law, it informs the Controller without delay.

5. Confidentiality

The Processor ensures that people authorised to process Data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.

6. Security measures

The Processor applies technical and organisational measures appropriate to the risk (Art. 32 GDPR), in particular:

• encryption of traffic (HTTPS) between the browser or the app and the server;
• role-based access control (member, editor, administrator): contact data, medical deadlines and availability results are visible only to the command, and members' personal data is not public;
• passwords stored only as hashes (a salted hash function), sessions based on random tokens;
• minimisation of location data: coordinates are collected only during an alarm and deleted when it ends, and availability by area sends the server only a yes/no result;
• daily database backups (30 daily copies and monthly copies for 12 months) and periodic checks that they can be restored;
• every user can delete their own account, and an administrator can detach or delete an entry.

7. Sub-processing

The Controller gives the Processor a general authorisation to use sub-processors. As of the version of this agreement they are:

• Oracle Cloud Infrastructure (Oracle Corporation) — region Frankfurt (UE) — hosting of the application server and the database
• Cloudflare, Inc. — content delivery and the secure tunnel to the server; storage of photos, document scans and backups (R2)
• Resend, Inc. — sending e-mail (invitations, deadline reminders, notices)
• Google (Firebase Cloud Messaging, Crashlytics, logowanie kontem Google) — notifications to Android phones, crash reports of the Android app, sign-in with a Google account
• Apple Inc. (Apple Push Notification service, logowanie przez Apple) — notifications to iPhones and sign-in with Apple
• Functional Software, Inc. (Sentry) — serwery w Unii Europejskiej — crash reports of the iPhone app (without incident content and without personal data)

The Processor concludes agreements with sub-processors imposing obligations equivalent to those of this agreement and remains responsible to the Controller for their performance. The Processor informs about an intended addition or change of a sub-processor at least 14 days in advance (a notice on the agreement page and a message to the unit's administrator); within that time the Controller may raise a justified objection. If the parties do not agree within 14 days of the objection, the Controller has the right to terminate the agreement for the use of the Service with immediate effect, without any cost, and to demand the return or deletion of the Data under point 12; the fee for the unused part of a subscription is refunded proportionally.

8. Transfers outside the European Economic Area

Data may be transferred outside the EEA (e.g. to Google, Apple and Cloudflare and, for supporting access to crash reports stored in the EU, to Sentry) only using the mechanisms of Chapter V GDPR: an adequacy decision (including the EU–US Data Privacy Framework) or standard contractual clauses.

9. Assistance to the Controller

The Processor, taking into account the nature of the processing, assists the Controller in responding to requests from data subjects (access, rectification, erasure, restriction, objection, portability) and in meeting the obligations of Arts 32–36 GDPR (security, breach notification, impact assessment, consultation with the authority). Many requests the Controller and individuals handle themselves in the panel and the app (correcting data, deleting an account, withdrawing consents).

10. Personal data breaches

The Processor notifies the Controller of a confirmed personal data breach without undue delay and no later than 48 hours (counted in calendar hours, weekends included) after confirming it, with the information needed to notify the supervisory authority (Art. 33 GDPR), as far as it has it.

11. Right of audit

The Processor makes available to the Controller the information necessary to demonstrate compliance with Art. 28 GDPR and allows audits, including inspections, by the Controller or an auditor it names, on written request, with at least 14 days' notice, during working hours and in a way that does not endanger the security of other customers' data.

12. Duration and end of the processing

The agreement lasts as long as the Controller uses the Service (including the trial period). After that, at the Controller's request, the Processor within 30 days returns the Data as an export or deletes it; the callout records and the roster remain at the Controller's disposal until then.

After the agreement ends the Processor deletes or returns the Data within 30 days, except that backups may remain in the system for their natural expiry cycle described in point 6 (no longer than 12 months), because a single item cannot technically be removed from a finished backup. During that time the backups are isolated, protected against further processing, not restored to the Service without the Controller's instruction, and overwritten on schedule. Deletion does not cover data the Processor must keep by law.

13. Liability

The Processor's liability to the Controller under this agreement, except for damage caused intentionally, is limited to the amount of the annual fee for the Service that the Controller pays or would pay under the current price list (also during the trial period or where part of the services is free of charge). The limitation does not affect the rights of data subjects, including their claims under Art. 82 GDPR, nor recourse claims between the Controller and the Processor under Art. 82(5) GDPR, to the extent the law does not allow them to be limited.

The terms of providing the Service, including the trial period and fees, are set by the terms of service (/terms); this agreement refers to them.

14. Conclusion and changes

The agreement is concluded in electronic form (Art. 28(9) GDPR) when the unit's administrator ticks the acceptance box in the panel. The person accepting declares being authorised to represent the Controller in this respect. The Processor records: the unit, the accepting person, the version of the text, and the time and IP address of acceptance.

The text is changed by publishing a new version and requires a new acceptance by the unit's administrator; the previous version applies until then. This version: 1.1 (2026-10-21).