TonMiroSystems ← back to the website
Legal document · Annex 1 to the Terms of Service · courtesy translation

Data Processing Agreement

Version 1.1 · effective from 9 October 2026 · pursuant to Article 28 GDPR

Processor: Lexine Gawek i Kielar sp. j., ul. Witkowicka 82, 31-242 Kraków, Poland

PL EN SK CZ

Courtesy translation only. This English text is a technical translation provided for information purposes. The legally binding version of this document is the Polish version available at tonmiro.com/prawne/powierzenie-danych.html. In the event of any discrepancy, the Polish version prevails.
Why this document exists. When entering the data of employees, drivers or contractors into the system, the plant (customer) remains their controller, and we process the data on its behalf. The GDPR requires such a relationship to be governed by an agreement with specific content (Article 28(3)). This agreement is concluded automatically together with the Agreement for use of the system — no separate document needs to be signed, although at the customer's request we will prepare a version for signature.

§ 1. Parties and conclusion of the agreement

  1. Controller — the Customer within the meaning of the Terms of Service of the tonmiro.com website and the TonMiro Systems service ("Terms"), i.e. an entrepreneur who has concluded an Agreement for use of the System with the Processor.
  2. Processor — Lexine Gawek i Kielar spółka jawna with its registered office in Kraków, ul. Witkowicka 82, 31-242 Kraków, Poland, KRS 0000335571, NIP 7010197031, operating the TonMiro Systems service.
  3. This agreement ("Data Processing Agreement") is concluded upon conclusion of the Agreement for use of the System and forms an integral part of it. Capitalised terms not defined here have the meaning given in the Terms. "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council.
  4. In the event of a conflict between the Data Processing Agreement and the Terms or the Agreement for use of the System, the Data Processing Agreement prevails with respect to the protection of personal data.

§ 2. Subject matter, nature and purpose of processing

  1. The Controller entrusts the Processor with the processing of personal data to the extent and for the purpose necessary to provide the System access service, its implementation, maintenance, technical support, backups and migration of data from the Controller's existing sources.
  2. Nature of processing: processing in an IT system made available over the Internet (SaaS), including in particular collection, recording, organisation, storage, viewing, modification, export, backup and deletion of data — to the extent resulting from the functions of the System and the Controller's instructions.
  3. Purpose of processing: keeping records and analysing the operation of the Controller's plant (weighing and dispatch, machines and vehicles, refuelling, oils, filters, measurements, production hours, documents, servicing), in accordance with the functions of the System described in the Terms and on the Website.
  4. The Processor may — on the basis of this documented instruction of the Controller and to the extent provided for in the Terms — anonymise and aggregate the entrusted data solely in order to create datasets from which, using reasonably available means, neither the Controller, its plant nor any natural person can be identified. The anonymisation itself is a processing operation carried out on the Controller's instruction; only once it has been effectively carried out may the resulting information be used for the Processor's own purposes set out in the Terms.
  5. The Processor does not process the entrusted data for its own purposes, subject to the anonymised and aggregated data referred to in section 4 and in § 12(6) of the Terms — such data is not personal data.

§ 3. Types of data and categories of data subjects

  1. Categories of data subjects:
    • employees and associates of the Controller (operators, mechanics, managers, office staff, drivers);
    • drivers and employees of the Controller's contractors (aggregate buyers, hauliers, fuel suppliers, service providers);
    • natural persons conducting business activity who are contractors of the Controller;
    • persons named in documents entered into the System (e.g. on weighbridge tickets, invoices, protocols, photographs of documents).
  2. Types of data: name and surname, position or role, login and password hash, business e-mail and telephone, company name and details, vehicle registration numbers, data from weighbridge tickets and dispatches (driver, haulier, recipient), refuelling data (who, when, how much), repair and inspection records, history of actions in the System (logs), content of documents and photographs entered by the Controller. Infrastructure security logs (IP address, time and result of login) are kept by the Processor for its own purpose of protecting the System, as the controller of that data — on the terms described in the Privacy Policy; they are not covered by this entrustment.
  3. The Controller does not entrust special categories of data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR). If the Controller intends to enter such data into the System (e.g. medical certificates, information on the health of operators), it must first agree this with the Processor in writing.
  4. If the Processor finds that data referred to in section 3 has been entered into the System without prior agreement, it informs the Controller and — to the extent technically possible — restricts access to that data until it receives an instruction from the Controller to delete it, continue processing it or change the scope of the entrustment.
  5. The Controller may at any time specify the scope of the entrusted data in documentary form; this does not require an amendment to the Data Processing Agreement.

§ 4. Obligations of the Processor

The Processor undertakes to:

  1. process data only on documented instructions from the Controller — the Terms, the Agreement for use of the System, this Data Processing Agreement and instructions given by the Controller by e-mail or through the functions of the System are deemed instructions; this also applies to transfers of data to a third country, unless required by Union or Member State law — in which case the Processor informs the Controller before processing begins, unless the law prohibits this;
  2. immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions;
  3. ensure that persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality, and are trained in data protection;
  4. allow only persons holding an authorisation to process data, and only to the extent necessary to perform their duties;
  5. implement and maintain the technical and organisational measures described in § 5 and Annex B;
  6. respect the conditions for engaging another processor (§ 6);
  7. assist the Controller in fulfilling its obligations towards data subjects and its obligations under Articles 32–36 GDPR (§ 7);
  8. after the end of the provision of services, delete or return the data in accordance with § 11;
  9. make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and allow for audits (§ 9);
  10. maintain a record of categories of processing activities carried out on behalf of the Controller (Article 30(2) GDPR).

§ 5. Security measures

  1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of natural persons, the Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk (Article 32 GDPR).
  2. The measures include in particular: encryption of transmission (TLS), storage of passwords only as cryptographic hashes, role-based access control, logging of access and changes, daily incremental and weekly full backups stored off the production server, a disaster recovery procedure, restriction of administrative access to authorised persons using cryptographic keys, software updates, and testing of changes before deployment to production. A detailed list is provided in Annex B.
  3. The Processor may change the security measures, provided that this does not lower the level of data protection.

§ 6. Sub-processing

  1. The Controller gives general authorisation for the Processor to engage other processors (sub-processors) listed in Annex A.
  2. The Processor informs the Controller by e-mail of any intended addition or replacement of a sub-processor at least 14 days in advance. The Controller may object within that period, giving reasons. In the event of an objection the parties enter into discussions; if no agreement is reached, the Controller may terminate the Agreement for use of the System with effect from the date the new sub-processor is engaged, and the Processor refunds pro rata any fees paid in advance.
  3. The Processor imposes on each sub-processor — by way of a contract — the same data protection obligations as arise from this Data Processing Agreement, and remains fully liable to the Controller for the performance of the sub-processor's obligations.
  4. The current list of sub-processors is published in Annex A at tonmiro.com/prawne/powierzenie-danych.html.

§ 7. Assistance to the Controller

  1. If a data subject contacts the Processor with a request to exercise rights under Articles 15–22 GDPR concerning the entrusted data, the Processor forwards the request to the Controller within 3 Business Days and does not respond independently unless the Controller asks it to.
  2. The Processor assists the Controller in fulfilling data subjects' requests — in particular by making available, rectifying, exporting or deleting data in the System — within a time that allows the Controller to meet the deadlines in Article 12 GDPR, and no later than 7 Business Days after receiving the instruction. Assistance within the ordinary scope of the System's functions is free of charge; extraordinary requests requiring work beyond the System's functions (e.g. repeated or highly labour-intensive ones) may be charged according to the Price List after prior agreement, within the limits of justified and documented costs. No fee is charged if the need for additional work results from an error or a breach of obligations on the part of the Processor.
  3. The Processor supports the Controller in carrying out a data protection impact assessment (Article 35 GDPR) and prior consultation with the supervisory authority (Article 36 GDPR) by providing information about the System and the security measures applied.

§ 8. Personal data breaches

  1. The Processor notifies the Controller of a personal data breach concerning the entrusted data without undue delay and no later than 24 hours after becoming aware of it, to the e-mail address of the Controller's contact person.
  2. The notification contains at least: a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and contact details. If all information cannot be provided at once, the Processor provides it in phases.
  3. The Processor documents breaches, cooperates with the Controller in notifying the supervisory authority and data subjects, and does not inform third parties of the breach without agreement with the Controller, unless required by law.

§ 9. Right of audit

  1. The Controller has the right to verify compliance of the processing with the Data Processing Agreement — by written enquiries, questionnaires or an audit conducted by the Controller or an authorised auditor who is not a competitor of the Processor.
  2. An on-site audit is announced at least 14 days in advance, no more than once a year (the frequency and notice limits do not apply where the audit follows a personal data breach, results from a request of the supervisory authority, or the Controller has justified and documented grounds to suspect a material breach of the Data Processing Agreement or the GDPR), on Business Days, in a manner that does not disrupt the Processor's business and does not compromise the confidentiality of other customers' data. The cost of the audit is borne by the Controller, unless the audit reveals a material breach of the Data Processing Agreement.
  3. The Processor answers written enquiries within 14 days and remedies identified deficiencies within a period agreed with the Controller.

§ 10. Obligations of the Controller

  1. The Controller declares that it is the controller of the entrusted data and has a legal basis for processing and entrusting it, in particular that it has fulfilled its information obligations towards employees and contractors (Articles 13–14 GDPR).
  2. The Controller undertakes to enter into the System only data necessary for the purposes referred to in § 2 and not to enter data referred to in § 3(3) without prior agreement.
  3. The Controller is responsible for managing the accounts of its Users, including assigning roles corresponding to the scope of their duties and blocking the accounts of persons who have lost their authorisation.
  4. The Controller designates a contact person for data protection matters and informs of any change.

§ 11. Term and termination

  1. The Data Processing Agreement remains in force for the term of the Agreement for use of the System and for the period during which the Processor retains the entrusted data after its termination (§ 12(3) of the Terms — export, read-only access, backup rotation cycle).
  2. After termination of the Agreement for use of the System, the Processor, according to the Controller's choice made within 14 days of termination:
    1. returns the data in a readable format (XLSX/CSV, PDF, image files) and deletes it from the System, or
    2. deletes the data without returning it.
    In the absence of a choice, § 12(3) of the Terms applies (export, then deletion after the periods indicated there). The 14-day period concerns the choice between return of the data together with its deletion and deletion alone; it does not limit the Controller's right to choose read-only mode within the period specified in § 12(3)(b) of the Terms.
  3. If the Controller chooses the read-only mode provided for in § 12(3)(b) of the Terms, that period constitutes a further period of providing a limited processing service on the Controller's documented instruction, and this Data Processing Agreement remains in force to that extent. The Controller may end that mode at any time and choose return of the data together with its deletion, or deletion alone, in accordance with section 2.
  4. Deletion from backups takes place in their rotation cycle (at the latest within 12 months); until then backups are stored in encrypted form, isolated from the production environment, and are not used for any purpose other than disaster recovery. If a backup is restored in an emergency, the Processor re-applies to the restored data any earlier deletion instructions that had already been executed before the restoration.
  5. At the Controller's request the Processor confirms deletion of the data in writing or by e-mail.
  6. The Processor may retain data to the extent required by Union or Member State law — of which it informs the Controller.

§ 12. Liability

  1. The Processor is liable to the Controller for damage caused by processing only where it has not complied with obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to lawful instructions of the Controller (Article 82(2) GDPR).
  2. The Processor's liability to the Controller under the Data Processing Agreement is limited in accordance with § 17 of the Terms, except for damage caused intentionally and to the extent that limitation is not permitted under Article 82 GDPR. This limitation applies only to the mutual claims of the parties and does not limit the rights of data subjects, in particular the right to compensation under Article 82 GDPR, or the statutory rules on liability and recourse between those involved in the processing.
  3. If the supervisory authority imposes an administrative fine on one party for a breach attributable to the other party, the party at fault reimburses the other party — to the extent permitted by law and corresponding to the actual extent of its responsibility — the amount of the fine and the documented costs of the proceedings. This provision is without prejudice to the powers of the supervisory authority or to the mandatory liability rules under the GDPR.

§ 13. Final provisions

  1. Amendments to the Data Processing Agreement follow the procedure for amending the Terms (§ 21 of the Terms); amendments to Annex A — the procedure in § 6.
  2. Matters not regulated here are governed by the GDPR, the Polish Personal Data Protection Act and the Polish Civil Code.
  3. At the Controller's request the parties will sign the Data Processing Agreement in written form with content identical to this one, including the Controller's details and contact person.
  4. The Data Processing Agreement has been drawn up in Polish. Translations into other languages are for information purposes only; in the event of any discrepancy, the Polish version prevails.

Templates for the Controller

Ready-to-use forms that help the Controller fulfil its obligations under § 10 (one copy per person; fields left blank). Adapt each form to the law applicable to you before use; the Polish version is the reference text:

Who signs with whom. The authorisation is signed by the site as data controller and the authorised person — an employee, contractor or driver. The information notice is issued by the site, and the employee, contractor or driver signs to confirm they have read it. TonMiro Systems is not a party to either form — the relationship between the site and us is governed by the data processing agreement.

Annex A — list of sub-processors

EntityServiceProcessing locationBasis of transfer
cyber_Folks S.A. (cyberfolks.pl brand, formerly kei.pl), Poznań, Polandhosting of the System servers, backups and @tonmiro.com e-mailPolanddata processing agreement with the hosting provider

The System is managed exclusively by employees of the Processor and its permanent associates engaged under civil-law contracts. Natural persons acting under the direct authority of the Processor, on the basis of an individual authorisation to process data and a confidentiality undertaking (§ 4(3)–(4)), are not sub-processors within the meaning of Article 28(2) GDPR — regardless of the legal basis of their employment or cooperation. If, however, an associate acts as a separate entity providing a service and processes the entrusted data on behalf of the Processor outside its direct authority, that associate is classified as a sub-processor and included in the list above in accordance with § 6. The Processor's accounting office has no access to the entrusted data (it receives only the Controller's settlement data as a contractor).

Annex B — technical and organisational measures

Access control

Protection of transmission and storage

Business continuity

Software security

Organisation