IntegrityPhase Data Processing Agreement
Version 1.7.0_2026-10-14 | English | Final
This framework DPA sets the terms for personal data processed by IntegrityPhase on behalf of an eligible company customer. It is accepted in every automatic onboarding by an Agent whose Delegation includes enter_dpa. It applies to actual entrusted processing within documented instructions; acceptance does not imply that a Payload contains personal data or permit additional categories.
1 Parties and scope
The company customer identified in onboarding is the Controller. Marcin Podskarbi, trading as Marcin Podskarbi Prototype 1/2 Lab, NIP 6222767998, REGON 545123210, Rolna 18A, 62-002 Suchy Las, Poland, is the Processor. Privacy contact: privacy@integrityphase.com. Capitalised service terms have the meanings in the accompanying English Terms. GDPR definitions apply to personal data, processing, controller, processor and personal data breach.
This DPA covers minimal personal data in permitted webhook_integrity.v1 Payloads and associated metadata processed on the Controller's behalf. It does not govern the Operator's separate controller purposes, including its own contractual, contact, security, payment, invoicing and claims data, which are described in the Privacy Notice.
2 Acceptance authority and duration
The Agent accepts the exact DPA version and hash within its Delegation, including enter_dpa, before creation of a Buyer Binding, even if no personal data is expected. The customer separately declares the expected data scope without supplying a Payload in onboarding. Missing, expired, revoked or inconsistent acceptance, scope or Delegation prevents admission; no manual exception is available.
Where declared authority applies, including the French model, the signer declares authority from the company. IntegrityPhase verifies the signature, key control and package restrictions but does not independently verify the issuer's identity or legal right to represent the company. It records authority_model=declared and issuer_authority_verified=false. Actual legal authority remains necessary; technical acceptance does not conclusively bind a company through an unauthorised person.
Evidence binds the company, Agent, Wallet, Delegation, signed statement and hash, public key or fingerprint, enter_dpa scope, validity, revocation, check outcomes, time, channel and DPA version and hash. Processing follows only documented instructions within that scope.
This DPA supports individual purchases and creates no subscription. Processing of each category ends when its purpose and permitted retention end or earlier when the agreement or a lawful instruction ends it. Protection duties continue until return or deletion and backup expiry. Retention of separate accounting data for the Operator's own duty does not extend entrusted processing.
3 Processing description and instructions
The subject and purpose are transient processing of minimal permitted webhook data to perform technical integrity checks and return a Proof. Processing may include receipt, format and schema validation, source and timestamp or nonce checks, hash comparison, identifier assignment, result generation, necessary status and audit metadata, error handling and deletion or return. The Proof does not establish event truth or legal effect.
Data subjects are the Controller's representatives, staff, contractors, business contacts, system users or others whose minimal work related data is lawfully necessary in the permitted event. Data may include necessary names, roles and work contacts, user, source, system and event identifiers, minimal process status, timestamps, nonce, request and Operation IDs, IP and user agent where necessary, and pseudonymous hashes or fingerprints.
No special category, medical, children's or criminal conviction data, credentials, raw API keys, passwords, private keys, seed phrases, payment signatures or data enabling disposal of funds may be included in the entrusted Payload. The Service does not include custody or holding customer or third party funds.
Instructions consist of the agreement, this DPA, the Delegation with enter_dpa, API documentation and a compliant request. An Agent or request cannot enlarge that scope. Data is not used for the Processor's marketing, profiling, model training or decisions with legal effects on individuals. If EU or applicable Member State law requires processing outside instructions, the Processor informs the Controller beforehand unless legally prohibited on important public interest grounds. The Processor promptly informs the Controller if it considers an instruction contrary to GDPR or other data protection law.
4 Admission and data minimisation
Before production use, the application must check current DPA acceptance, Delegation, scope, validity, revocation and the company, Agent, Wallet, source and Buyer Binding before reading the Payload, and recheck after receiving it. Body dependent signature verification occurs afterwards; headers alone do not authenticate a source. Earlier transmission through network infrastructure, the operating system and the HTTP intermediary terminating TLS is not prevented by this application control.
Before a valid DPA the application processes only necessary onboarding and gate information as a separate controller; it must not admit the business Payload for service execution. Changes exceeding the accepted configuration or instructions disable the affected binding pending revalidation and renewed acceptance where necessary.
Raw Payload is buffered only transiently for handling the request and is excluded from persistent admission configuration, databases, application logs and backups. The application releases references and clears byte buffers it controls after completion, refusal, timeout or error. Managed memory does not guarantee physical erasure of every string, process or system copy. Persistent records contain necessary identifiers, hashes and status. A hash may still be personal data.
5 Controller duties
The Controller provides a lawful basis and required notices, documents instructions, limits data to what is necessary, ensures its accuracy and lawful disclosure, maintains secure systems and current Delegations and protects keys and Wallets. It controls and revokes authority and updates the declared data scope before changing an integration. It must not submit prohibited data and must cooperate on minimisation and potential unlawful instructions. A new scope must pass the applicable checks before resumption.
6 Processor duties and security
The Processor processes only on documented instructions, ensures authorised persons are bound to confidentiality, implements security appropriate to risk, respects subprocessing and transfer rules and provides information needed to demonstrate compliance with GDPR Article 28. Taking account of the nature of processing and information available, it assists with data subject requests, breach response, security assessments, impact assessments and prior consultation under Articles 32 to 36.
Measures include authenticated and revocable access bound to the company, Delegation, Agent, Wallet and source; least privilege; TLS; protected secrets; separation of test and production; a private Operator dashboard; current DPA and authority controls; Payload minimisation; secret redaction; necessary audit and integrity checks; incident handling and controlled backups and restoration. Uncertain payments are isolated and reconciled without automatic settlement retry. Technical and accounting retention are separated.
Where backups contain entrusted data, they use a maximum 30 day rotating cycle, restricted access, integrity checks and restore testing. Deletion and restriction instructions are reapplied before normal processing after restoration. The Processor may update measures without reducing overall protection. It does not disclose entrusted data beyond this DPA, documented instructions or law.
7 Personal data breaches and rights
The Processor notifies the Controller without undue delay after becoming aware of a personal data breach, and no later than 48 hours; where the same incident is subject to a shorter applicable 24 hour eIDAS route, the first notice follows that shorter limit. This contractual outer limit does not delay the duty to act without undue delay.
The notice supplies available information on the nature of the breach, affected categories and approximate numbers, likely consequences, mitigation and contact. Missing details follow in stages without further undue delay. The Controller decides on authority and data subject notifications unless mandatory law provides otherwise. An internal alert or internal acknowledgement is not delivery of notice to the Controller.
The Processor forwards identifiable requests about entrusted data to the Controller and assists through appropriate technical and organisational measures. It does not independently answer on the Controller's behalf unless instructed or legally required.
8 Subprocessors and transfers
The Controller grants general written authorisation for the subprocessor listed below. The Processor imposes substantially equivalent data protection duties and remains responsible as required by GDPR for the subprocessor's performance.
Cloudflare, Inc., USA provides the HTTP intermediary and Tunnel, terminating TLS and transmitting Payload and associated entrusted data. Its infrastructure and subprocessors can be global; no exclusively EEA location has been agreed. The Operator's own database and backups remain local in Poland. For covered USA transfers, the applicable EU US DPF adequacy decision applies; otherwise the appropriate safeguards under section 6 of Cloudflare's DPA apply, including SCC module 3 where the Operator is the customer's processor. The current provider DPA and subprocessor list are available at cloudflare.com/cloudflare-customer-dpa and cloudflare.com/cloudflare-subprocessors.
At least seven days before adding or replacing a subprocessor, the Processor gives the Controller its name, service scope, location and transfer basis. The Controller may object on reasoned data protection grounds within seven days of receipt. The parties seek a solution; if none is possible the Controller may cease the service scope requiring that subprocessor.
CDP processes the Operator's payment data without raw business Payload. Base and Safe provide settlement infrastructure. Proton handles correspondence and limited alerts without Payload. TaxCoach and its agreed Google Workspace workflow receive the Operator's accounting records without Payload. Their roles and transfers are described in the Privacy Notice; those purposes do not by themselves make them subprocessors of entrusted Payload. Extending their access to entrusted data requires a prior lawful basis and the change procedure above.
Entrusted data may not be transferred outside the EEA without a valid GDPR Chapter V basis. Copies of applicable safeguards and relevant annexes or explanations are available without charge from privacy@integrityphase.com, with proportionate redaction of others' protected information or trade secrets.
9 Audits and assistance
The Processor makes reasonably necessary compliance information available and allows and contributes to audits, including inspections, by the Controller or its mandated auditor as required by Article 28. Ordinary audits use reasonable advance notice and coordination during working hours without unnecessary service disruption. Advance notice is not required where a breach, authority instruction or material risk justifies urgency.
Questionnaires, reports and available evidence are used first where sufficient; an on site audit is available when needed. Arrangements protect other customers' data, secrets and security while preserving the legally required ability to verify compliance. The Controller pays ordinary audit costs unless a material breach by the Processor is found.
10 Retention return and deletion
The Controller's default instruction on completion of processing of each category is deletion. It may instead choose return before processing ends. Without awaiting a later instruction, the Processor deletes or returns active entrusted data and deletes remaining copies without undue delay, at most 30 days after that category's processing ends, unless EU or applicable Member State law requires storage. Shorter periods take priority. The 30 day limit is contractual, not a statutory storage period.
Raw Payload expires at completion, refusal, timeout or error handling as described in section 4 and is not kept for 30 days. Necessary technical metadata and the entrusted audit trail have a maximum 36 months from Operation completion while the entrusted purpose continues, subject to earlier termination and the deletion or return duty. Ordinary error and security logs have a 90 day limit; necessary records of a documented incident remain until closure and 36 months afterwards, subject to the end of entrusted processing. Data retained independently by the Operator for its own security duty is governed by the Privacy Notice.
Backups containing data due for deletion stay isolated from normal use and expire by overwrite or deletion within a maximum 30 day cycle. Restoration does not renew retention and must reapply the deletion register before normal processing. Minimal deletion markers do not contain the deleted content and cannot preserve its full verification; they are not automatically anonymous.
The Operator may separately retain only necessary data for a specific own purpose and lawful basis in the Privacy Notice, particularly invoices and settlement evidence. A possible claim or link to payment does not justify retaining the entire entrusted dataset. Deleting a technical result requires preservation of any independently necessary verified settlement record, not the full Payload or Proof by default. Historical artifacts are subject to the applicable retention rules.
11 Liability precedence and version
Liability follows GDPR, mandatory law and the Terms, without restricting rights or obligations that cannot lawfully be limited. For personal data processing conflicts, this DPA takes precedence over the Terms and API documentation. Polish law and the lawful B2B dispute arrangements in the Terms apply.
English is the common language of this DPA and the accompanying contractual and Agent interface package for the supported EU business territories. This version is prospective; earlier documents and acceptance records remain under their applicable rules. Production activation requires the release controls to confirm that the described processing safeguards are implemented. Updated on 14 October 2026. This exact DPA becomes part of the customer agreement on explicit acceptance within actual authority. Finalisation does not publish it, start processing, reopen sales or replace any earlier acceptance.
EU business customers and autonomous acceptance
The Controller may be a sole trader or another supported business without legal personality. The Agent must already be authorised to enter this DPA. Verification of a Wallet signature demonstrates key control, not independent confirmation of representation. The same DPA, source permissions and data restrictions apply across supported sales channels. Adding a payment channel does not by itself authorise access to entrusted Payloads or add a subprocessor. Any such change requires the applicable procedure in this DPA.