Data processing agreement

For business customers (controllers) who have personal data processed with Do4U. Agreement under Art. 28 GDPR between the customer and LW IT Solutions Company Lukas Wójcik (processor). Businesses conclude it in their dashboard. To download: print this page or save it as PDF.

1. Subject and duration

The processor processes the content the customer submits to the Do4U tools solely to carry out these tasks. The agreement applies for as long as Do4U is used.

2. Nature and purpose

Receiving, storing, automated processing by AI models on our own servers and returning the result. The content is not used for training.

3. Types of data and data subjects

All personal data contained in the customer's inputs (for example names, contact details, contents of requests, images). Data subjects are customers, prospects and employees of the customer and other persons whose data the customer enters.

4. Obligations of the processor

It processes the data only on documented instructions from the customer; using the tools and settings counts as an instruction. Persons with access are bound to confidentiality. It supports the customer with data subject requests and with obligations under Art. 32 to 36 GDPR, reports personal data breaches without undue delay and demonstrates compliance with this agreement on request; audits are possible by arrangement.

5. Deletion

Inputs and results are deleted automatically: after 7 days on Free, after 30 days with purchased credits, with “Don't save”, the input right after the task and the result after it has been displayed for the first time, at the latest one hour after the task. Uploaded images are deleted when the task is finished. Remaining data is deleted at the end of the contract.

6. Location and sub-processors

The content is processed exclusively on our own servers in Poland, EU; no sub-processors are used for this. Emails (for example confirmations and the reports of website watches) are sent through OVH SAS (OVHcloud), France, as sub-processor. Stripe Payments Europe, Limited, Ireland, which processes the payments for credits, is not a sub-processor: it receives no content of the tasks and is a separate controller for the payment processing (privacy policy, section 12.1). The processor announces changes in advance; the customer may object.

7. Technical and organisational measures

Encrypted transmission (TLS); access only for authorised persons, administration with two-factor login; the processing servers are not reachable from outside; logs contain metadata only; automatic deletion after fixed periods; regular backup of the entire server, kept for 7 days.