Data Processing Agreement (DPA)

This data processing agreement (the “DPA”) is an annex to the Terms of Service and is accepted together with them when the account is created. The parties are: the Shop (data controller) and the Operator named in the Terms of Service (data processor, “MetronQ”). Capitalized terms have the meaning given in the Terms of Service.

1. Subject matter and duration

MetronQ processes, on the Shop's behalf, the personal data of end customers to the extent necessary to provide the Service (handling quotes and orders). The processing lasts for the duration of the service agreement (holding an account).

2. Nature, purpose and instructions

Processing covers recording, storage, display in the Shop's panel and sending e-mail notifications. The sole purpose is handling quotes and orders. MetronQ processes the data only on the Shop's documented instructions - using the Service's features constitutes such an instruction.

3. Categories of data subjects and data

• Data subjects: the Shop's end customers using the quoting tool and placing orders.
• Data categories: name, e-mail address, phone, company name, delivery address (street, postcode, city), order notes.
• The Service is not intended for special categories of data (Art. 9 GDPR) and the Shop undertakes not to enter them.

4. MetronQ's obligations

• Processing only for the purpose and to the extent defined in this DPA.
• Access limited to authorized persons bound by confidentiality.
• Technical and organizational measures: encryption in transit (TLS), encryption of Input Files at rest (AES-256, key held solely by MetronQ), encryption of the entrusted contact data inside the database (AES-256, with the key held outside the database), servers in the European Union, access control, backups.
• Assisting the Shop with data-subject rights (access, rectification, deletion, restriction) to a reasonable extent and within a reasonable time.
• Notifying the Shop of personal data breaches without undue delay after becoming aware of them.
• No use of the entrusted data for MetronQ's own purposes, in particular marketing.

5. Sub-processing

The Shop gives general authorization for the use of sub-processors. Current list: Hetzner Online GmbH (hosting and data storage, EU servers) and OVH (Zimbra - the mail service that notification e-mails are sent through; EU servers). MetronQ will give advance notice of intended changes, allowing the Shop to object.

Data location and Shops outside the EEA. Entrusted data stays on servers in the European Union also where the Shop is established outside the European Economic Area; MetronQ does not transfer it to a third country. If the Shop - as the controller - accesses it from a third country or passes it on, that transfer is made for the Shop, and the Shop provides the Chapter V GDPR basis for it and meets the information duties towards its own end customers.

6. Data deletion

• When the agreement ends (account deletion), end-customer data is deleted together with the Shop's other data.
• CAD files follow the separate retention described in the Terms of Service (up to 90 days).
• Database backups are taken daily, encrypted before they leave the server and kept in a rotation covering the most recent copies; older ones are overwritten. The ability to restore them is tested periodically.

7. Audits

MetronQ makes available to the Shop the information necessary to demonstrate compliance with Art. 28 GDPR and allows audits (including written inquiries) at a mutually agreed time, in a way that does not compromise the security of other customers' data.

8. Final provisions

Matters not regulated here are governed by the Terms of Service and the GDPR. This DPA is governed by Polish law. Data matters contact: contact@metronq.com.