Dokument

Auftragsverarbeitungsvertrag

Gültig ab 13 October 2026

Version prelaunch-2026-10-13-v1

This agreement sets out the rules on which the Yuteki operator processes personal data on behalf of the organisation using a workspace. The document is a version prepared before the public launch and may be updated before the start; every version has a mark and a date.

1. Parties and roles

The processor is Michał Piłat, an entrepreneur entered in CEIDG, NIP 9222839601, REGON 542359454. Place of business: Jatutów 90, 22-400 Jatutów, Polska. Address for service: Rabindranatha Tagore 5A/54, 93-503 Łódź, Polska. Contact: biuro@yuteki.eu. In this agreement we call them the operator.

The controller is the organisation, for example an agency, that created a workspace in Yuteki and enters personal data into it, including data of its employees, collaborators, clients and their contact persons. In this agreement we call it the customer. The workspace owner and the persons the customer has granted administrative permissions act on behalf of the customer.

The agreement covers the content of the workspace: tasks, projects, messages, comments, files, CRM contacts, working time, settlements, proposals and reports. It does not cover data the operator processes for its own purposes as a controller: user accounts, settlements with the customer for paid modules, the waiting list and the security of the service. That data is described in the Privacy policy. Where the customer itself processes data on behalf of another controller, the operator is a further processor of that data under this agreement.

2. Conclusion and duration

This agreement forms part of the Terms of service. The customer concludes it with the operator when the workspace is created. It remains in force for as long as the service is provided for the customer's workspace and, after that, until the data is handled in line with section 10.

3. Subject matter, nature and purpose of processing

The subject matter of processing is the personal data entered into the customer's workspace. The operator provides an application for organising work, projects, communication, files, working time, settlements, proposals and reports and, once the customer turns it on, an AI assistant. Processing includes recording, storage, organisation, retrieval, display to authorised persons, alteration, export, sending notifications, making backups and erasure, to the extent of the functions the customer uses.

The sole purpose of processing is providing the Yuteki service to the customer in line with the Terms of service and this agreement.

4. Documented instructions of the customer

The operator processes data only on documented instructions from the customer. The instructions are the Terms of service, this agreement and the settings and actions performed in the application by persons authorised by the customer: inviting persons, assigning roles and permissions, sharing links, exports, deleting content and turning on the AI assistant. The customer may send other instructions to the operator's contact address.

The operator does not process data for other purposes unless required to do so by Union or Polish law; in that case it informs the customer of that legal requirement before processing, unless that law prohibits it. If, in the operator's opinion, an instruction of the customer infringes data protection law, the operator informs the customer without delay.

The customer is responsible for having a legal basis for processing the data it enters into the workspace and for informing the data subjects. The application is not intended for processing special categories of data, including health data; the customer should not enter them.

5. Confidentiality

The operator gives access to data only to persons who have committed themselves to confidentiality or are under a statutory obligation of confidentiality. Their access is limited to what is needed for maintenance, support and security of the service. The operator makes no assurance that authorised persons can never see any data, but it does not browse the customer's content without such a need.

6. Security of processing

The operator applies the technical and organisational measures described in Annex B. No description of security measures is a guarantee of complete security. The customer is responsible for the measures on its side, in particular for granting permissions, protecting passwords and tokens and controlling shared links.

7. Sub-processors

The customer gives the operator general authorisation to engage the sub-processors listed in Annex C. The operator imposes on them data protection obligations equivalent to this agreement and is liable to the customer for their performance as for its own.

The operator informs the customer of any intended addition or replacement of a sub-processor at least 14 days in advance, by email to the workspace owner or in the application. Within that period the customer may object at the operator's contact address. If the parties do not agree on a solution, the customer may stop using the service in line with the Terms of service before the change takes effect.

Data is transferred outside the European Economic Area only on the basis of the mechanisms provided for in Chapter V GDPR, indicated in Annex C.

8. Assistance with data subject rights and the customer's obligations

The application lets the customer search, correct, export within the available scope and delete workspace content on its own. If a data subject sends a request concerning workspace content to the operator, the operator forwards it to the customer without delay and does not handle it on its own unless the customer instructs it to. Where needed, the operator assists the customer with the data and tools at its disposal.

The operator provides the customer with the information needed for a data protection impact assessment, prior consultation with the supervisory authority and demonstrating the security of processing, to the extent it has such information.

9. Personal data breaches

The operator notifies the customer of a personal data breach found in the customer's workspace without undue delay and no later than 48 hours after becoming aware of it, by email to the workspace owner. The notification contains the available information on the nature of the breach, the categories and approximate number of persons and records concerned, the likely consequences and the measures taken or proposed. Information that cannot be given at once is provided in phases. Notifying the supervisory authority and the data subjects is the customer's responsibility as the controller.

10. End of processing

While using the service, the customer may export data with the exports available in the application and delete content. Some deletion functions in the application hide a record instead of physically deleting it at once. The available exports have their own scope and are not a complete archive of all workspace data.

The standard termination of a workspace starts a 90-day recovery mode. During that time the workspace owner may use the permitted reads and existing exports and resume the workspace. After that period the workspace awaits further handling of deletion. In the current version all data is not physically deleted automatically; the customer may contact the operator about it.

Application logs, security logs, change history and backups have a separate life cycle described in the Privacy policy. The operator may retain data where Union or Polish law requires it.

11. Information and audits

On a request sent to the contact address, the operator makes available the information needed to demonstrate compliance with this agreement. The operator allows the customer or an auditor mandated by it to carry out audits, including inspections, at a time and in a scope agreed in advance. An audit may not cover the data of other customers or compromise the security of the service, and the auditor is bound by confidentiality.

12. Final provisions

Matters not regulated here are governed by the Terms of service and the GDPR. The operator changes this agreement in the procedure provided for changes to the Terms of service.

Annex A - categories of data subjects and data

Users of the customer's workspace, its employees and collaborators: name, email address, profile picture, roles and permissions, task assignments, schedules, working time, absences, rates and settlements.
The customer's clients and their contact persons, including those without a Yuteki account: contact and company details, addresses, company identifiers, CRM notes, proposals and settlements.
Authors and persons described in content: messages, comments, task descriptions, checklists, file names and contents, and metadata such as dates and authors of changes.
Recipients of shared links and proposals: data given with a decision on a proposal and the related metadata.
Persons concerned by content analysed by the AI assistant, if the customer turns it on: selected task content, quality criteria and excerpts of permitted conversations, including messages of client users, and the results of the analysis. The scope is described in the AI notice.

Annex B - technical and organisational measures

Access control: sign-in with a password stored as a hash, optional two-factor authentication with TOTP codes, required email address confirmation, roles and permissions granted by the customer, and separation of the data of individual workspaces.
Protection of sessions and tokens: changing or resetting a password ends the user's other sessions and revokes MCP tokens; MCP tokens have a limited scope and can be revoked.
Encryption: the content of chat messages is stored in the database encrypted with the application key.
Transmission: connections to the service use HTTPS (TLS) provided by the server configuration; over an HTTPS connection the application sends the HSTS header.
Protection against abuse: limits on sign-in attempts and other requests, automatic blocking after repeated security events and protection of public forms by Cloudflare Turnstile.
Event logging: security logs kept for 90 days and the change history of workspaces kept for 365 days, in the default configuration of the service.
Sharing: links to files and proposals contain a random token and may have an expiry date, and links to files also a password; public links do not work while a workspace is in recovery mode.
Backups: a database backup is made before every deployment of a new version of the application.
Organisation: access of the operator's staff limited to the needs of maintenance, support and security and covered by a duty of confidentiality.

Annex C - sub-processors

OVH SAS, 2 rue Kellermann, 59100 Roubaix, France: hosting of the application, databases, files and backups, and email delivery. Processing in the European Economic Area.
Anthropic: the AI assistant (Claude API), only when the customer turns the assistant on in its workspace. Data may be processed outside the EEA; transfer mechanisms, including standard contractual clauses, are provided for in Anthropic's data processing addendum. Details are in the AI notice.
Cloudflare, Inc. (USA): protection of public forms by Cloudflare Turnstile. It receives the verification token and browser connection metadata, without workspace content. Transfer basis: the European Commission's adequacy decision on the EU-US Data Privacy Framework and, as a fallback, standard contractual clauses.
imoje, the payment service of ING Bank Śląski S.A. (Poland): payments for modules. It receives the organisation's name and email address, the amount and the order identifier, without workspace content.
Push service operators relevant to the user's browser: delivery of push notifications, only when the user turns them on. The content of a notification is sent encrypted.