Data Processing Agreement (DPA)

This data processing agreement (the “DPA”) is an annex to the Terms of Service and is accepted together with them when the account is created. The parties are: the Shop (data controller) and the Operator named in the Terms of Service (data processor, “MetronQ”). Capitalized terms have the meaning given in the Terms of Service.

1. Subject matter and duration

MetronQ processes, on the Shop's behalf, the personal data of end customers to the extent necessary to provide the Service (handling quotes and orders). The processing lasts for the duration of the service agreement (holding an account).

2. Nature, purpose and instructions

Processing covers recording, storage, display in the Shop's panel and sending e-mail notifications. The sole purpose is handling quotes and orders. MetronQ processes the data only on the Shop's documented instructions - using the Service's features constitutes such an instruction.

3. Categories of data subjects and data

• Data subjects: the Shop's end customers using the quoting tool and placing orders.
• Data categories: name, e-mail address, phone, company name, delivery address (street, postcode, city), order notes.
• The Service is not intended for special categories of data (Art. 9 GDPR) and the Shop undertakes not to enter them.

4. MetronQ's obligations

• Processing only for the purpose and to the extent defined in this DPA.
• Access limited to authorized persons bound by confidentiality.
• Technical and organizational measures: encryption in transit (TLS) and at rest, servers in the European Union, access control, backups.
• Assisting the Shop with data-subject rights (access, rectification, deletion, restriction) to a reasonable extent and within a reasonable time.
• Notifying the Shop of personal data breaches without undue delay after becoming aware of them.
• No use of the entrusted data for MetronQ's own purposes, in particular marketing.

5. Sub-processing

The Shop gives general authorization for the use of sub-processors. Current list: Hetzner Online GmbH (hosting and data storage, EU servers) and the e-mail provider handling notification delivery. MetronQ will give advance notice of intended changes, allowing the Shop to object.

6. Data deletion

• When the agreement ends (account deletion), end-customer data is deleted together with the Shop's other data.
• CAD files follow the separate retention described in the Terms of Service (up to 90 days).
• Backups are overwritten cyclically as part of the standard rotation.

7. Audits

MetronQ makes available to the Shop the information necessary to demonstrate compliance with Art. 28 GDPR and allows audits (including written inquiries) at a mutually agreed time, in a way that does not compromise the security of other customers' data.

8. Final provisions

Matters not regulated here are governed by the Terms of Service and the GDPR. This DPA is governed by Polish law. Data matters contact: kontakt@metronq.pl.