Data Processing Agreement

1. Scope and parties

This Data Processing Agreement ("DPA") applies when a business customer ("Customer") uses Requestarium Cloud and, in doing so, gives us personal data to process on its behalf. Customer is the controller. The processor is Mykola Kuropatkin, ul. Domaniewska 17/19 lok. 133, 02-672 Warszawa, Poland, NIP 9512570691, REGON 525596466, trading as Requestarium ("we").

This DPA is part of the Terms of Service and takes effect when Customer accepts them; no signature is needed. If you need a countersigned copy, email [email protected]. If this DPA and the Terms conflict on personal data, this DPA wins.

This DPA does not apply to self-hosted installations: there, Customer runs the software itself and we do not process its data.

2. Details of the processing

• Subject and purpose: providing Requestarium Cloud under the Terms: storing, syncing, sharing, and running Customer's API collections, environments, and run history, and managing users and access.
• Duration: for as long as Customer uses Requestarium Cloud, plus the deletion periods in section 8.
• Data subjects: Customer's users (employees, contractors), and any people whose data Customer chooses to put into collections, environments, or responses.
• Personal data: user names, email addresses, organization and team membership, sign-in and audit records, IP addresses in logs, and any personal data Customer stores in workspace content.
• Special categories: none intended. Customer should not store special categories of data (Art. 9 GDPR) in the Service.

3. Our obligations

• We process personal data only on Customer's documented instructions. The Terms, this DPA, and Customer's use of the Service and its settings are those instructions. We tell Customer if we think an instruction breaks data protection law.
• Everyone we authorize to process the data is bound by confidentiality.
• We do not sell the data, and we do not use workspace content for our own purposes, such as training AI models or advertising.
• If the law requires us to disclose the data, we tell Customer first, unless the law forbids it.

4. Security measures

We keep appropriate technical and organizational measures under Art. 32 GDPR. They are described on our Security page and include encryption in transit, AES-256-GCM encryption of secrets at rest, hosting in the EU, restricted administrative access, continuous encrypted backups, and optional two-factor authentication. We may improve these measures over time, but we will not lower the overall level of protection.

5. Subprocessors

Customer gives general authorization for us to use the subprocessors listed in section 10. We bind each of them by a written contract with data protection obligations at least as protective as this DPA, and we remain responsible for their work.

We announce a new or replaced subprocessor at least 30 days in advance by updating this page and emailing the owners of paid organizations. Customer may object on reasonable data protection grounds within that period. If we cannot address the objection, Customer may end the affected subscription and get a pro-rata refund of prepaid fees for the remaining term.

6. Helping Customer

• Data subject requests: users can see, export, correct, and delete their data in the app. If a data subject writes to us directly about Customer's data, we pass the request to Customer and do not answer it ourselves unless Customer asks us to.
• Other duties: we give reasonable help with Customer's security, breach notification, data protection impact assessments, and prior consultations (Art. 32–36 GDPR), based on the information available to us.

7. Personal data breaches

We notify Customer without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting Customer's data. The notice includes what we know about the nature of the breach, the data and people affected, the likely consequences, and the measures taken or proposed. We send further details as they become available.

8. Deletion at the end

Customer can export its collections at any time. When an organization or account is deleted, its data stays recoverable for 30 days and is then erased from the live systems; copies in backups expire within a further 14 days. We keep only what the law requires us to keep, such as billing records.

9. Information and audits

We make available the information needed to show compliance with Art. 28 GDPR, including written answers to Customer's security questionnaire. If that is not enough, Customer may audit our compliance once a year, with 30 days' written notice, during business hours, at its own cost, and under confidentiality. An auditor must not be our competitor. Regulators may audit as the law allows.

10. List of subprocessors

As of November 12, 2026, these companies process Customer's personal data on our behalf:

Not subprocessors: Paddle.com processes payments and invoices as our Merchant of Record and an independent controller. Google (when a user signs in with Google), Atlassian, GitHub, GitLab, and Bitbucket receive data only when Customer connects them, as services Customer chose, under their own terms. AI model providers receive prompts directly from the user's app with the user's own key.

11. Transfers, liability, and governing law

We store Customer's data in the European Union. Where a subprocessor processes it outside the EEA, the transfer is covered by an adequacy decision or the EU Standard Contractual Clauses.

Each party's liability under this DPA is subject to the limits in the Terms. This DPA is governed by Polish law, and the courts named in the Terms have jurisdiction.