Agreement between the Customer as Controller and Onit Soft sp. z o.o., ul. Fabryczna 20a, 31-553 Kraków, Poland, KRS 0001054906, NIP 6751787127 (the “Provider”), as Processor, under Article 28 GDPR. It forms an integral part of the agreement for the Sokar Logistics and Bobi services concluded under the Terms of Service and is accepted together with them by the Customer’s team owner.
The team owner accepts this agreement after declaring in the application that they act on behalf of the Controller and are authorised to represent it. The Provider records and retains the evidence of acceptance: the wording of that declaration, the name and e-mail address of the accepting person, the Controller’s details, the accepted version of this agreement, the date and time of acceptance and the IP address. The evidence forms part of the order confirmation available in the application; the Provider makes it available to the Controller on request - in particular to demonstrate accountability under Article 5(2) GDPR - and retains it for the term of the agreement and for 6 years after it ends.
/01 Subject matter and duration
The Controller entrusts the Processor with the processing of personal data for the purpose and to the extent necessary to provide the Sokar Logistics and Bobi services. The processing lasts for the term of the service agreement and, as regards return and deletion, until the steps in section 8 are completed.
/02 Nature and purpose of processing
- storing, organising and making data available to the Controller’s users,
- analysing content entered by users with language models in order to answer, prepare documents and carry out requested actions,
- conducting, on the Controller’s instructions, text (WhatsApp) and voice conversations with drivers and business partners, including recording and transcribing voice calls,
- issuing and sending documents (orders, invoices, KSeF) and operating the integrations the Controller has enabled.
/03 Types of data and categories of data subjects
| Data subjects | Types of data |
|---|---|
| The Controller’s employees and users | Name, e-mail, phone, role in the system, application activity log. |
| Own drivers and carriers’ drivers | Name, phone, vehicle registration number, position and estimated time of arrival, conversation content, voice recordings and transcripts. |
| Business partners and their employees | Identification and contact details, company details, data from transport and financial documents, correspondence history. |
| Special categories of data | Not entrusted. The Controller undertakes not to enter them into the services. |
/04 Obligations of the Processor
- Processes data only on the Controller’s documented instructions. The service agreement and the actions of the Controller’s users in the applications count as instructions.
- Ensures that personnel with access to data are bound by confidentiality.
- Applies the measures of Article 32 GDPR, at least: encryption in transit and at rest, role-based access control, multi-factor authentication for personnel, access logging, separation of customers’ data, daily backups and periodic restore tests.
- Assists the Controller in responding to data subjects’ requests. Requests forwarded by the Controller are handled within 5 working days, and the Controller can export, correct or delete data in the application itself.
- Assists the Controller with data protection impact assessments and consultations with the supervisory authority in matters concerning the services.
- Notifies the Controller of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, providing the information listed in Article 33(3) GDPR and supplementing it as facts are established.
- After the services end, handles the data in accordance with section 8.
- Makes available the information necessary to demonstrate compliance and allows audits: once a year, with 14 days’ notice, during working hours, at the Controller’s expense and without compromising the confidentiality of other customers. The parties first rely on reports, certificates and security questionnaires.
/05 Obligations of the Controller
- Ensures a legal basis for processing and for contacting the data subjects, including carriers’ drivers.
- Provides the required information to those data subjects, including about the automated nature of conversations with the assistant and the recording of voice calls.
- Grants user permissions and revokes them when an employee leaves.
/06 Sub-processing
The Controller gives general authorisation for the sub-processors listed below. The Processor informs the team owner by e-mail at least 14 days before adding or replacing a sub-processor. The Controller may object within that period and, failing agreement, terminate the service agreement with effect from the end of the billing period. The Processor imposes on sub-processors data protection obligations no less protective than those in this agreement and remains liable for their performance.
| Sub-processor | Service | Location | Transfer basis |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Infrastructure, databases, backups, files | EEA (EU region) | No transfer outside the EEA |
| Cloudflare, Inc. | Content delivery network, attack protection | EU / USA | DPF or standard contractual clauses |
| Anthropic PBC | Language model generating Bobi’s answers | USA | DPF or standard contractual clauses, data processing agreement |
| OpenAI, LLC | Language model and speech transcription | USA | DPF or standard contractual clauses, data processing agreement |
| Vapi, Inc. | Voice call handling for the assistant | USA | Standard contractual clauses, data processing agreement |
| ElevenLabs, Inc. | Speech synthesis | USA | Standard contractual clauses, data processing agreement |
| Twilio Inc. | Telephony and SMS | USA | DPF, data processing agreement |
| Meta Platforms Ireland Ltd. | WhatsApp Business API | EU / USA | DPF, data processing agreement |
/07 Transfers outside the EEA
Transfers take place only to the sub-processors in the table, on the basis of an adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses with a transfer impact assessment. Language model providers receive only the content necessary to handle a given request. The Processor uses settings that exclude the use of data for model training where the provider offers them and does not use the Controller’s data to train its own general-purpose models.
/08 End of processing
For 30 days after the agreement ends the Controller may export its data in CSV or JSON format from the application or on request. After that period the Processor deletes the data within 90 days and backups expire under a rotation of up to 35 days. Deletion is confirmed in writing on request. Data that the law requires to be retained, in particular billing data for the period required by tax law, is exempt.
/09 Liability and contact
Each party is liable for breaches of its own obligations under the GDPR and this agreement. The limitation of liability in the Terms of Service applies, except for administrative fines imposed on a party through the other party’s fault.
Contact in personal data protection matters: [email protected] or ul. Fabryczna 20a, 31-553 Kraków, Poland. The Controller names its contact person in the team’s billing details.