§ 1. Definitions 

1. Controller – a user of the Service who determines the purposes and means of processing personal data processed through websites, online stores or other features created or made available in the Service. 
2. Processor – WeNet Group S.A. with its registered office in Warsaw, ul. Postępu 14, 02-676 Warszawa, KRS 0000681163, NIP 7010046065. 
3. Service – the webwave.me website together with the features and services available in it. 
4. Data – personal data entrusted to the Processor by the Controller for processing on the terms set out in the Agreement. 
5. Agreement – this personal data processing agreement. 
6. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council. 

§ 2. Subject matter and duration of the Agreement 

1. The Agreement governs the rules under which the Processor processes personal data on behalf of the Controller in connection with the provision of services through the Service, in particular the creation and operation of websites and online stores. 
2. The Agreement is concluded in connection with the conclusion of an agreement for the provision of services through the Service and remains in force for as long as the Processor processes the Data on behalf of the Controller. 
3. Processing is carried out solely to the extent necessary to provide the services and in accordance with the Controller’s documented instructions, taking into account obligations arising from applicable law. 

§ 3. Scope and nature of processing 

1. The Data may concern in particular: 
   1. customers of online stores created by the Controller in the Service; 
   2. persons contacting the Controller via forms on the websites created; 
   3. other persons whose data the Controller processes using the features of the Service. 

2. The categories of data may include in particular identification and contact data, order and transaction data, the content of correspondence and other data entered by the Controller or by persons using the Controller’s website. 

3. The Data may include ordinary personal data, data of minors and special categories of personal data referred to in Article 9 GDPR, if the Controller decides to process such data through the Service and is authorised to do so. 

4. The nature of the processing operations includes in particular the collection, recording, storage, organisation, consultation, alteration, making available within the features of the service and erasure of data, to the extent necessary to provide the services. 

5. The Controller is responsible for determining the purposes and legal bases of processing, the lawfulness of obtaining the data and the fulfilment of information obligations towards data subjects. 

§ 4. Obligations of the Processor 

1. The Processor undertakes to: 
   1. process the Data only on documented instructions from the Controller, including with regard to transfers of data to a third country, unless required to do so by law; 
   2. ensure that persons authorised to process the Data have committed themselves to confidentiality; 
   3. apply the appropriate technical and organisational measures required under Article 32 GDPR; 
   4. assist the Controller, insofar as possible, in responding to requests from data subjects; 
   5. taking into account the nature of processing and the information available, assist the Controller in fulfilling its obligations relating to data security, notification of breaches, data protection impact assessments and prior consultation with the supervisory authority; 
   6. make available to the Controller the information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allow for audits on the terms set out in the Agreement; 
   7. inform the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions.
2. The Processor does not use the Data for its own purposes, in particular for its own marketing or for training artificial intelligence models, unless a separate legal basis and appropriate information on the data processing justify such use. 

§ 5. Security and personal data breaches 

1. The Processor applies technical and organisational measures appropriate to the risk and to the nature, scope and purposes of processing, in accordance with Article 32 GDPR. 
2. The Processor notifies the Controller of any identified breach of Data protection without undue delay after becoming aware of it, providing the information available at the given stage that is necessary for the Controller to fulfil its obligations. 
3. The Processor cooperates with the Controller in investigating breaches and taking measures to mitigate their effects. 

§ 6. Sub-processing 

1. The Controller grants the Processor general authorisation to engage sub-processors to the extent necessary to provide the services. 
2. The Processor ensures that sub-processors are bound to protect the data on terms no less stringent than those set out in the Agreement, to the extent required by the GDPR. 
3. The Processor is liable to the Controller for the performance of data protection obligations by sub-processors to the extent provided for by the GDPR. 

§ 7. Transfers of data outside the EEA 

1. The Processor does not transfer the Data outside the European Economic Area unless this is necessary to provide the service and takes place in accordance with Chapter V GDPR. 
2. In the event of such a transfer, the Processor ensures the use of an appropriate transfer mechanism and, where required, appropriate supplementary safeguards, and informs the Controller to the extent required by law. 

§ 8. Audit 

1. The Controller has the right to obtain the information necessary to demonstrate that the processing complies with the Agreement and Article 28 GDPR. 
2. As part of the right to audit, including inspections, the Controller may request information from the Processor regarding the processing of the Data by sending a request to the following address: contact@webwave.me. The Processor will respond to the request, including by providing the required information, within 30 days of its receipt. 

§ 9. Deletion or return of data 

1. Upon completion of the provision of services, the Processor, at the Controller’s choice, deletes or returns the Data and deletes existing copies thereof, unless European Union law or Polish law requires further storage of the data. 
2. Data may be deleted from backup copies in line with their overwrite cycle, provided that appropriate safeguards are applied and the data is not used for any other purposes. 
3. The Controller is responsible for downloading or securing any data it wishes to retain before access to the service ends, provided that the features of the Service allow this. 

§ 10. Liability and final provisions 

1. Each Party is responsible for fulfilling the obligations imposed on it under the GDPR and the Agreement. 
2. The Agreement does not transfer to the Processor the Controller’s responsibility for determining the purposes and legal bases of processing or for fulfilling the obligations that, by law, rest with the Controller. 
3. Matters not governed by the Agreement are subject to the GDPR and other applicable personal data protection legislation. 
4. In the event of any conflict between the provisions of the Agreement and the Terms and Conditions of the Service with regard to entrusting data processing, the provisions of the Agreement prevail. 
5. The Agreement may be updated to reflect changes in law, services or methods of data processing. Changes are made available in the Service in a manner that enables the Controller to read their content.