Data Processing Agreement

Version of 12.10.2026

This agreement (the "Agreement") is a data processing agreement within the meaning of Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR"). It forms an integral part of the Terms for Organizers and is concluded together with their acceptance in the Panel. In case of discrepancies, the Polish version prevails.

Parties

  • Controller — the Organizer on whose behalf the Agreement was accepted in the BailaCon Panel (the Organizer's details as entered in the Panel).
  • Processor — Percatech Arkadiusz Okoń, ul. Żarnowiecka 12, 43-100 Tychy, Poland, tax ID (NIP): 9542578680, REGON: 365784102, email: arkadiusz.okon@gmail.com.

§1. Subject Matter

  1. The Controller entrusts the Processor with the processing of personal data to the extent and for the purpose necessary to provide the BailaCon Platform services described in the Terms for Organizers.
  2. The Processor processes the data only on documented instructions from the Controller. Instructions are the Terms, this Agreement and the actions performed by the Controller and its Staff in the Platform (e.g. entering, changing, sharing or deleting data), as well as other instructions given electronically.

§2. Nature, Purpose and Duration

  1. Nature: collection, recording, storage, organization, structuring, consultation, use, making available to the Controller's Staff, transmission to operators indicated by the Controller, generation of documents and notifications, and erasure.
  2. Purpose: enabling the Controller to run competitions, events and a dance school using the Platform, including registrations, attendance records, passes, payments, communication with Participants and safety in classes.
  3. Duration: for the term of the Terms for Organizers and thereafter until the data is returned or deleted in accordance with §9.

§3. Types of Data and Categories of Data Subjects

  1. Participants (students, competition and event participants, persons registered by third parties): name, email address, phone number, profile photo, registration and enrollment data, attendance history (including QR check-ins), passes and their use, payment information (without payment card data), partner card number (e.g. Multisport), results, scores and progress, messages exchanged with the Controller, reviews and surveys, Staff notes and safety reports.
  2. Controller's Staff (instructors, reception, judges, other collaborators): name, email address, role and permissions, class and schedule assignments, history of actions in the Panel.
  3. The Platform is not intended for processing special categories of data (Article 9 GDPR). If the Controller enters such data, it is responsible for having a legal basis for processing it.

§4. Processor's Obligations

The Processor undertakes to:

  1. process the data only on documented instructions from the Controller, including with regard to transfers to a third country, unless required to do so by Union or Polish law — in which case it informs the Controller before processing, unless the law prohibits this;
  2. allow only authorized persons who have committed themselves to confidentiality to process the data;
  3. apply the technical and organizational security measures referred to in Article 32 GDPR, in particular: encryption of data in transit (TLS), encryption of the database at rest, user authentication and role-based access control, separation of data of individual Organizers, regular backups, logging of access to safety reports and ongoing software updates;
  4. respect the conditions for engaging sub-processors referred to in §5;
  5. assist the Controller, as far as possible, by appropriate technical and organizational measures, in responding to data subject requests (Articles 15–22 GDPR) — a request addressed directly to the Processor is forwarded to the Controller without delay;
  6. assist the Controller in complying with the obligations under Articles 32–36 GDPR, taking into account the nature of processing and the information available;
  7. notify the Controller of a personal data breach without undue delay and no later than 36 hours after becoming aware of it, together with the information required by Article 33(3) GDPR to the extent available;
  8. make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and allow audits in accordance with §7;
  9. immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

§5. Sub-processors

  1. The Controller gives general authorization for the Processor to engage sub-processors. The current list forms Annex 1.
  2. The Processor informs the Controller by email or in the Panel of any intended addition or replacement of a sub-processor at least 14 days in advance. The Controller may object within that period; if the parties do not reach an agreement, the Controller may terminate the agreement with effect on the date of the change.
  3. The Processor imposes on sub-processors data protection obligations equivalent to those in this Agreement and remains liable to the Controller for their performance.
  4. Payment operators, sports card operators and other entities with which the Controller concludes its own agreements are not sub-processors — the Processor transmits data to them on the Controller's instructions.

§6. Transfers Outside the EEA

Data is stored in data centres within the European Economic Area. Transfers to a third country take place only to the extent indicated in Annex 1 and subject to the safeguards provided for in Chapter V GDPR (a European Commission adequacy decision or standard contractual clauses).

§7. Audits

  1. The Controller has the right to verify compliance with this Agreement. In the first instance, the Processor provides written answers to the Controller's questions within 14 days.
  2. If the answers are insufficient, the Controller may conduct an audit or commission an auditor bound by confidentiality — with at least 14 days' notice, on business days, no more than once a year (unless the audit relates to a personal data breach). The costs of the audit are borne by the Controller.

§8. Controller's Obligations

  1. The Controller declares that it has a legal basis for processing the data entrusted to the Processor and fulfils its information obligations towards data subjects.
  2. The Controller is responsible for the accuracy and scope of the data entered into the Platform by itself and its Staff.

§9. End of Processing

  1. After the services end, the Controller may within 30 days request a copy of the entrusted data in a commonly used electronic format.
  2. After that period, the Processor deletes the entrusted data within 90 days, unless Union or Polish law requires further storage. Data in backups is deleted as part of their rotation cycle.
  3. Deletion does not cover the data of BailaCon app user accounts, which the Processor processes as a separate controller.

§10. Liability and Final Provisions

  1. The parties' liability towards data subjects is governed by Article 82 GDPR. Between the parties, the limitations of liability in the Terms for Organizers apply to the extent permitted by law.
  2. In matters of personal data protection, this Agreement prevails over the Terms for Organizers.
  3. This Agreement remains in force for the term of the Terms for Organizers and is governed by Polish law.

Annex 1 — Sub-processors

  • Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft Azure) — application and database hosting (Poland Central region, Poland); file storage and diagnostic logs (West Europe region, Netherlands); email delivery (Azure Communication Services, Europe); checking whether a profile photo shows a face — without identifying the person (Azure AI Face, West Europe); machine translation of content (Azure AI Translator, West Europe).
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, together with Google LLC (USA) (Google Firebase) — user authentication (Firebase Authentication) and push notifications (Firebase Cloud Messaging). Transfers to the USA based on the European Commission decision on the EU-US Data Privacy Framework and standard contractual clauses.
  • Anthropic, PBC (San Francisco, USA) — only when the Controller uses the optional AI features (style descriptions, schedule proposals): schedule data and instructors' names are transmitted. Transfers to the USA based on standard contractual clauses.