Česky (závazné znění)

Data Processing Agreement

Annex to the Terms of Service · effective from 2026-10-06 · English translation; the Czech version prevails

This agreement under Art. 28 of Regulation (EU) 2016/679 (“GDPR”) is concluded between the Organisation using the Negotiq platform (the “Controller”) and SynQflows, s.r.o., ID No. 23685450, Příčná 1892/4, Nové Město, 110 00 Praha 1 (the “Processor”), and forms part of the Terms of Service. It is concluded by accepting the Terms of Service and lasts for the term of the Contract. Capitalised terms have the meaning given in the Terms of Service.

1. Subject matter and scope of processing

Subject matterprocessing of personal data that the Controller or its Users put on the Platform or that the Platform receives or sends on their instruction: User Content (Requests, specifications, attachments, price lists, colleagues' and contact persons' data), messages sent to the Intake Address, credentials for connected systems and data fetched from them, and data sent to the Controller's Webhooks
Nature and purposestorage, disclosure to authorised persons and negotiation counterparties, import and conversion of price lists, receipt and evaluation of e-mail messages, fetching data from connected systems, order export, sending notifications to Webhooks, backups and other technical processing needed to provide the Platform
Data subjectsthe Controller's employees and contractors; contact persons of its business partners; senders of messages to the Intake Address; persons whose data are contained in a price list fetched from a connected system
Data categoriesidentification and contact data (name, work e-mail, phone, position); e-mail message data (sender, recipient, subject, time of receipt, sender authentication results) and their attachments; credentials for connected systems; other data the Controller includes in content. The Controller does not upload special categories of data or data relating to criminal convictions
Durationfor the term of the Contract and until deletion under Article 8; messages received at the Intake Address 90 days from receipt; Webhook delivery records at most 90 days

2. Controller's instructions

  1. The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers to third countries. Instructions are given by the Terms of Service, this agreement and the Platform settings; by setting up an Integration (Intake Address, ERP connection, Webhook, API Key for a third-party agent) the Controller instructs processing to the extent the Integration requires. Further instructions are given by the Organisation Administrator in text form.
  2. If the Processor considers that an instruction infringes the GDPR or other data protection rules, it informs the Controller immediately and need not carry out the instruction until the Controller responds.
  3. If Union or Member State law requires the Processor to process the data, it informs the Controller in advance unless that law prohibits it (Art. 28(3)(a) GDPR).
  4. The Processor does not process the Controller's personal data for its own purposes. Anonymised and aggregated statistics (Article 11(2) of the Terms of Service) contain no personal data. Audit Chain entries, Receipts and AP2 Records are processed by the Processor as an independent controller under the Privacy Policy, not under this agreement.
  5. The Controller is responsible for the lawfulness of processing, for informing data subjects and for being entitled to put the personal data on the Platform and to grant access to connected systems.

3. Processor obligations

  1. The Processor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.
  2. The Processor implements the technical and organisational measures under Art. 32 GDPR set out in Annex 1. It may change them provided the overall level of security is not reduced.
  3. The Processor assists the Controller in responding to data subject requests, primarily through Platform tools (data export in JSON format, rectification, deletion of a User account or the Organisation). It forwards any request received directly from a data subject to the Controller without undue delay and does not respond to it on the merits itself.
  4. The Processor assists the Controller in complying with Arts. 32 to 36 GDPR (security, breach notification, impact assessment and prior consultation), taking into account the nature of processing and the information available to it.

4. Sub-processors

  1. The Controller gives the Processor general authorisation to engage sub-processors. Current list:
    Sub-processorActivityLocation, safeguards
    Railway Corporationapplication and database hosting, backupsUSA / EU; Standard Contractual Clauses (Module 3) or the EU-U.S. Data Privacy Framework
    Anthropic, PBCconverting unstructured price lists into tables (only when the feature is used)USA; Standard Contractual Clauses (Module 3); no model training on data
    e-mail intake provider (the specific provider will be added to this list before the feature is launched)receiving messages sent to Intake Addresses and passing them to the Platformto be stated together with the provider; transfers outside the EEA only with safeguards under Article 7
    e-mail service provider (SMTP)delivering invoices, reminders and service messages (recipient address and message content)EU
  2. The Processor informs the Controller of any intended addition or replacement of a sub-processor at least 14 days in advance on the Platform or by e-mail to the Organisation Administrator. Within that period the Controller may object on reasonable data protection grounds. The parties will try to find a solution; if they cannot, the Controller may terminate the Contract without penalty with effect before the sub-processor is engaged.
  3. The Processor imposes on sub-processors by contract the same data protection obligations as it has under this agreement, including sufficient guarantees to implement technical and organisational measures, and remains liable to the Controller for their performance (Art. 28(4) GDPR).
  4. Systems chosen by the Controller itself (connected ERP systems, product feeds, Webhook endpoints and third-party agents) are not sub-processors of the Processor; the Processor transmits data to them on the Controller's instruction.

5. Personal data breach

  1. The Processor notifies the Controller of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it, by e-mail to the Organisation Administrator and on the Platform.
  2. The notification contains the information under Art. 33(3) GDPR available to the Processor (nature of the breach, categories and approximate number of data subjects and records, contact point, likely consequences and measures taken or proposed); information not yet known is provided in phases.
  3. The Processor promptly takes measures to address the breach and mitigate its effects, cooperates with the Controller and documents the breach. A notification is not an admission of liability.

6. Information and audits

  1. The Processor makes available to the Controller the information necessary to demonstrate compliance with Art. 28 GDPR, primarily through the Security & Trust document and answers to a reasonable security questionnaire.
  2. If this information is not sufficient, the Processor allows an audit by the Controller or by an independent auditor bound by confidentiality who is not a competitor of the Processor, on at least 30 days' notice, at most once per calendar year (except in case of a breach or at the request of a supervisory authority), at the Controller's cost, without access to other customers' data and without compromising their security.
  3. The investigative powers of supervisory authorities are unaffected.

7. Transfers outside the EEA

  1. Transfers to third countries take place only with safeguards under Chapter V GDPR.
  2. Where the Processor transfers personal data to a sub-processor in a third country without an adequacy decision (or where the recipient is not certified under the EU-U.S. Data Privacy Framework), it concludes with it the Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914, Module 3 (processor to processor), assesses the legal environment of the recipient's country and adopts supplementary measures (in particular encryption in transit and at rest and data minimisation).
  3. The Controller hereby authorises such transfers. The Processor provides a copy of the safeguards on request; commercial terms may be redacted.

8. Deletion and return of data

  1. During the term of the Contract the Controller may export the Organisation's data in JSON format and delete data itself at any time.
  2. After the Contract ends, the Processor, at the Controller's choice, returns (export) or deletes the personal data within 30 days, including copies, unless the law requires further storage. Backups are overwritten in the regular cycle within 90 days at the latest; until then they are protected and not used.
  3. Messages received at the Intake Address are deleted automatically after 90 days. The Processor stops using credentials for a connected system immediately once the connection is removed and deletes them no later than under paragraph 2.
  4. This Article does not apply to the records under the second and third sentences of Article 2(4).

9. Liability, precedence and governing law

Liability follows Art. 82 GDPR and the Terms of Service, including their limitations to the extent permitted by law. In matters of personal data protection this agreement prevails over the Terms of Service. This agreement is governed by Czech law.

Annex 1 — Technical and organisational measures

A more detailed description is given in the Security & Trust document.