This Data Processing Agreement ("the DPA") is agreed between Digital Soft Distribution Sp. z o.o., ul. Hoża 86/410, 00-682 Warszawa, Poland, VAT PL7011079724, KRS 0000960920 ("Lizensa"), and the business customer, reseller or processor that opens an account with Lizensa ("the Controller"). It forms part of the terms on which Lizensa supplies software licences and related services.
Where a Controller has its own data processing terms, those terms take precedence over this DPA and this DPA takes precedence over any conflicting clause of Lizensa's general terms.
1. Roles, subject matter and duration
The Controller appoints Lizensa as a processor, and Lizensa accepts that appointment, for the processing described in section 2.
- Subject matter: operation of the Lizensa B2B wholesale storefront, the customer account and its sub-licences.
- Duration: for the term of the account, and until the return or deletion described in section 9 is complete.
- Nature and purpose: order and licence fulfilment, invoicing and accounting, account and access administration, customer support, fraud prevention, and the security of the platform.
2. Categories of data and data subjects
The processing covers:
- Data subjects: the Controller's own staff, customers, end users and resellers whose details the Controller enters into an account or an order;
- Categories of personal data: name, business e-mail, telephone, billing and delivery address, VAT ID, order and licence data, payment metadata, invoice and accounting records, account and login records, support correspondence, and the consent and analytics data described in the privacy policy.
No special categories of personal data (Art. 9 GDPR) are processed on the Controller's behalf.
3. Documented instructions
Lizensa processes personal data only on the Controller's documented instructions, including with regard to international transfers, unless required to do so by EU or Member State law — in which case Lizensa informs the Controller before processing unless that law prohibits it.
The instructions are the account agreement, the order form, the configuration the Controller selects in the back office, and any written instruction sent to privacy@lizensa.com.
4. Confidentiality
Every person Lizensa authorises to process personal data is bound by a confidentiality obligation and accesses only the data necessary for their role.
5. Security of processing
Lizensa implements the technical and organisational measures required by Art. 32 GDPR, as described in section 9 of the privacy policy — TLS 1.3 in transit, AES-256 encryption at rest, access control with two-factor authentication for staff, audit logs of every privileged action, and regular backups. Hosting and CDN processing takes place in the European Union.
6. Sub-processors
The Controller gives general written authorisation for Lizensa to use sub-processors, and Lizensa maintains the current list of recipient categories in section 3 of the privacy policy.
- Lizensa gives at least 30 days' notice before adding or replacing a sub-processor.
- The Controller may object in writing to a new sub-processor within that period; where the objection cannot be resolved, the Controller may terminate the affected account without penalty.
- Lizensa imposes on every sub-processor, by contract, data protection obligations that are no less protective than those in this DPA.
7. International transfers
Lizensa transfers personal data outside the European Economic Area only under the safeguards listed in section 4 of the privacy policy — an adequacy decision, the EU-US Data Privacy Framework, the European Commission's Standard Contractual Clauses, or supplementary technical measures. Where a transfer relies on the Standard Contractual Clauses, the clauses are concluded together with the sub-processor concerned.
8. Assistance to the Controller
Taking into account the nature of the processing, Lizensa assists the Controller by appropriate technical and organisational measures, insofar as possible, in responding to data-subject requests under Arts. 12–22, in carrying out a data protection impact assessment under Art. 35, in consulting the supervisory authority under Art. 36, and in notifying and documenting a personal data breach under Art. 33.
Data-subject requests received by Lizensa on the Controller's behalf are forwarded to the Controller without undue delay.
9. Audit and inspection
Lizensa makes available to the Controller all information reasonably necessary to demonstrate compliance with Art. 28 GDPR and allows audits, including inspections, by the Controller or an auditor the Controller mandates, subject to:
- at least 14 days' prior written notice;
- at most one audit per year on the same subject matter;
- reasonable confidentiality and operational constraints;
- costs borne by the Controller, unless the audit identifies a material breach by Lizensa.
10. Return and deletion
On termination of the account, Lizensa returns or deletes the personal data processed on the Controller's behalf within 30 days, unless EU or Member State law requires it to be retained. Lizensa will delete or anonymise the data of a data subject on request in accordance with Art. 17 GDPR, subject to the statutory retention duties that apply to invoices and accounting records.
11. Liability
Lizensa's liability under this DPA is limited to the fees the Controller paid for the services in the 12 months before the event giving rise to the claim. This limitation does not apply where it is prohibited by law, nor to liability for intent or gross negligence.
12. Contacts
Contractual notices and data-protection matters concerning this DPA:
- Processor: Digital Soft Distribution Sp. z o.o., ul. Hoża 86/410, 00-682 Warszawa, PL · privacy@lizensa.com · support@lizensa.com
- Supervisory authority: your national data-protection authority
This DPA is governed by Regulation (EU) 2016/679 and the laws of Poland, without prejudice to the mandatory rules protecting the Controller's data subjects in their country of residence.
