Data Processing Agreement (DPA) — Annex 1 to the Terms of Use

Version 1.0 — 3 November 2026. This agreement (umowa powierzenia przetwarzania danych osobowych, Article 28 GDPR) is concluded between the Company holding a PolyMatch account (the "Client") and [First name SURNAME], [registered address], Poland, NIP [NIP] ("PolyMatch"). It is accepted together with the Terms of Use by a person authorised to bind the Client; a dated copy in the Client's name can be downloaded from My company.

1. Subject matter and scope

1.1 This agreement governs the processing by PolyMatch, on behalf of the Client, of personal data of third parties contained in the content that the Client uploads or enters on the Platform ("Client Data"): contact details of its subcontractors, customers or partners, persons named in its documents, messages, projects or offers.

1.2 The following is not Client Data and is processed by PolyMatch as an independent controller, in accordance with the Privacy Policy: the accounts of the Client's Users, the identification and listing data of the Company, the technical data of Grades, Projects in their technical dimension, Leads, Matches and rankings, billing, security and activity logs, consents. The Client and PolyMatch are each independent controllers of the data exchanged between Companies after an Unlock.

1.3 Description of the processing: nature — hosting, storage, display to the Client and its Users, transmission to the Companies that the Client puts itself in contact with through the Platform, automatic translation of messages, backup; purpose — providing the services described in the Terms; duration — the term of the contract; categories of data subjects — business contacts of the Client's subcontractors, customers and partners, persons mentioned by its Users; categories of data — professional identity, function, business contact details, content of messages and documents; no special categories of data (Article 9 GDPR) are expected and the Client undertakes not to upload any.

2. Client's instructions

2.1 PolyMatch processes Client Data only on the Client's documented instructions. The instructions are: the Terms of Use, this agreement and the actions that the Client and its Users perform in the Platform (upload, sharing, sending, deletion).

2.2 If PolyMatch considers that an instruction infringes the GDPR or other data protection provisions, it informs the Client without delay. PolyMatch may process Client Data without instruction where Union or Member State law requires it; it then informs the Client, unless prohibited by law.

3. Client's obligations

The Client warrants that it has a legal basis for the Client Data, that it has informed the data subjects, that its instructions are lawful and that it limits Client Data to what is necessary. It alone answers requests from data subjects and authorities concerning Client Data, with PolyMatch's assistance under Article 6.

4. PolyMatch's obligations

4.1 Confidentiality: persons authorised to process Client Data are bound to confidentiality by contract or by law; access is limited to what is necessary for operation and support.

4.2 Security: PolyMatch implements the technical and organisational measures of Annex A and adapts them to the evolution of risks, without lowering their overall level.

4.3 Records and cooperation: PolyMatch keeps the record of categories of processing activities carried out for the Client and cooperates, on request, with the supervisory authority.

5. Sub-processors

5.1 The Client gives a general authorisation for the use of the sub-processors listed in Annex B, which reproduces the list published in the Privacy Policy.

5.2 PolyMatch informs the Client by e-mail of any addition or replacement at least thirty days before it takes effect. The Client may object in writing, on legitimate data protection grounds, within that period; failing agreement, the Client may terminate the contract before the change takes effect, without penalty.

5.3 PolyMatch imposes on each sub-processor, by contract, data protection obligations equivalent to its own and remains liable towards the Client for their performance.

6. Assistance and data subject rights

6.1 Taking into account the nature of the processing, PolyMatch assists the Client in responding to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, objection). The Client has, within the Platform, the means to consult, correct and delete Client Data; PolyMatch intervenes on written request for what the Platform does not allow, within ten working days.

6.2 If a data subject contacts PolyMatch directly about Client Data, PolyMatch forwards the request to the Client without answering on the merits, unless legally required.

6.3 PolyMatch assists the Client, to the extent of the information available to it, in complying with its obligations regarding security, breach notification and impact assessment (Articles 32 to 36 GDPR).

7. Data breaches

PolyMatch notifies the Client of any personal data breach affecting Client Data without undue delay and at the latest forty-eight hours after becoming aware of it, by e-mail to the Client's Administrators. The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and the point of contact; information not yet available is provided as soon as it is.

8. Transfers outside the European Union

Client Data is hosted in the European Union. Any transfer to a third country by a sub-processor relies on an adequacy decision or on the European Commission's standard contractual clauses, with appropriate supplementary measures; Annex B indicates the safeguard applicable to each sub-processor.

9. Audit

9.1 PolyMatch makes available to the Client the information necessary to demonstrate compliance with this agreement: description of the security measures, list of sub-processors, answers to a written questionnaire once a year.

9.2 An on-site audit, or an audit by an independent third party, is possible once a year, or after a data breach or at the request of an authority, on thirty days' written notice, during business hours, without disrupting operations or giving access to other clients' data, at the Client's expense. Findings are confidential.

10. End of processing

10.1 At the end of the contract, PolyMatch deletes Client Data within thirty days, unless a legal retention obligation applies, in which case the data is kept isolated until that obligation expires. The Client exports its data itself before the end of the contract through the Platform's functions.

10.2 Client Data already transmitted, on the Client's instruction, to another Company through an Unlock, an Offer or document sharing remains with that Company, which is its controller. The continued listing of Grades after the end of the contract (Article 12.5 of the Terms) concerns technical and company data, which is not Client Data.

11. Liability and term

11.1 Each party's liability under this agreement is subject to the limitations of Article 13 of the Terms of Use, except where mandatory provisions of the GDPR provide otherwise.

11.2 This agreement applies for the whole term of the contract and until Client Data is deleted. It is governed by Polish law; in case of conflict with the Terms on a matter relating to personal data, this agreement prevails.

Annex A — Technical and organisational measures

• Hosting of data and files in the European Union (Ireland), with a provider certified ISO 27001 and SOC 2.
• Encryption of communications (TLS 1.2 or higher) and of data at rest.
• Segregation of data per Company and per role, enforced at database level (row-level access control); no direct browser access to sensitive tables; sensitive functions executable only by the server.
• Authentication by hashed password, protection against compromised passwords, session expiry after 7 days of inactivity, anti-bot check on registration, login and password reset, rate limiting.
• Access to files through time-limited signed links; register of documents shared between Companies.
• Technical secrets kept in a dedicated vault, never in the code; named and logged administrator access.
• Encrypted backups, copy of files with a second provider; restoration procedure.
• Logging of actions and errors; alert when a contractual communication fails to be sent.
• Development with automated tests, review and security guards before each release; security audit before launch and after each major change.
• Sub-processors bound by a data processing agreement; verification of their certifications and transfer safeguards.
• Breach management procedure: detection, containment, analysis, notification (Article 7), corrective measures.

Annex B — Sub-processors

List accessible to Clients in My company (Contract documents). Any change follows the procedure of Article 5.