Data Processing Agreement (DPA)

Version: 19.08.2026

This DPA applies as an annex to an agreement/Order where ROMAN TKACH acts as a processor under Art. 28 GDPR.

1. Parties

Controller: client identified in the main agreement/Order.
Processor: ROMAN TKACH, NIP 8311648339, REGON 542012740, ul. Jana Długosza 25, 98-220 Zduńska Wola, info@tkach-roman.com.

2. Subject and duration

Only data necessary for agreed web/support, analytics, ads, SEO, integration and technical services, during the service term plus the period needed for return/deletion.

3. Data subjects/data

Depending on the project: visitors, leads, customers, staff, subscribers, advertising audiences; online identifiers, IP, cookies/IDs, name, phone, email, form content, analytics/advertising data and other data in documented instructions.

4. Instructions

Processing only on documented instructions unless required by law. The Controller is responsible for lawful collection, notices, audiences/lists and instructions.

5. Confidentiality/security

Access is limited to authorised personnel. Risk-appropriate measures include TLS, MFA, least privilege, backups, updates, logging and incident procedures.

6. Sub-processors

General authorisation is granted for providers objectively needed for the project. Depending on the project these may include EKVIA Ltd (hosting/server infrastructure in Bulgaria), Google, Meta, Cloudflare, email/CRM and other documented providers.

7. Transfers

Outside the EEA only under a valid Chapter V GDPR mechanism.

8. Assistance/incidents

The Processor assists with data-subject rights and Arts. 32–36 GDPR and notifies the Controller of a breach without undue delay after becoming aware.

9. Return/deletion

At the end of services, data is returned or deleted at the Controller's choice unless law requires retention. Backups may be deleted through the normal cycle while access remains restricted.

10. Audit

Reasonable information is provided to demonstrate compliance, with appropriate notice and protection of other clients' data.

11. Law

GDPR and supplementary Polish law apply unless the main agreement lawfully provides otherwise.