Data Processing Agreement (DPA)

This Data Processing Agreement (the "DPA") is entered into between Selvyo sp. z o.o., a limited liability company incorporated under the laws of the Republic of Poland, having its registered office at ul. Złota 75A, lok. 7, 00-819 Warsaw, Poland, registered in the National Court Register (KRS) under No. 0001258400, NIP 5273231126, REGON 545420071 (the "Processor" or "Selvyo"), and the legal entity identified during the account registration process and party to the API Terms of Service (the "Controller" or "Client").

This DPA forms an integral part of, and is incorporated by reference into, the Selvyo.io API Terms of Service (the "Principal Agreement"). In the event of any conflict between this DPA and the Principal Agreement with respect to the processing of Personal Data, this DPA shall prevail.

This DPA reflects the Parties' commitment to the protection of Personal Data and is intended to satisfy the requirements of Article 28 of the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") and equivalent obligations under applicable Data Protection Laws.

1. Definitions and Interpretation

1.1 Capitalized terms not defined in this DPA shall have the meanings ascribed to them in the Principal Agreement.

1.2 The following terms shall have the meanings set out below:

"Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "processing", and "Supervisory Authority" shall have the meanings ascribed to them in Article 4 GDPR.

"Data Protection Laws" means: (a) the GDPR; (b) the Polish Act of 10 May 2018 on the Protection of Personal Data and any implementing or amending legislation; (c) Directive 2002/58/EC (ePrivacy Directive) and its national implementations; and (d) any other applicable laws, regulations, and binding guidance of competent Supervisory Authorities relating to the processing of Personal Data.

"EU SCCs" means the Standard Contractual Clauses for the transfer of Personal Data to third countries pursuant to GDPR, as approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

"Restricted Transfer" means a transfer of Personal Data from the European Economic Area ("EEA") to a country outside the EEA that is not the subject of an adequacy decision adopted under Article 45 GDPR.

"Services" has the meaning given in the Principal Agreement.

"Sub-processor" means any third party engaged by the Processor (or by an authorized Sub-processor of the Processor) to process Personal Data on behalf of the Controller in connection with the provision of the Services.

"Standard Contractual Clauses" or "SCCs" means the EU SCCs as incorporated into this DPA at Annex IV (Module 2: Controller-to-Processor).

2. Subject Matter, Scope, and Roles

2.1 Subject matter. The subject matter of this DPA is the processing of Personal Data by the Processor on behalf of the Controller in connection with the provision of the Services under the Principal Agreement, including the food-image and text-query inference performed by the Selvyo API and SDK.

2.2 Roles. The Parties acknowledge and agree that, for the purposes of this DPA and the Services:

1. the Controller determines the purposes and means of processing of End User Personal Data; and
2. the Processor processes Personal Data on behalf of the Controller solely in accordance with the Controller's documented instructions, as set out in the Principal Agreement, this DPA, and the Controller's permitted configuration of the Services.

2.3 Scope. The categories of Data Subjects, the types of Personal Data, the nature and purpose of the processing, and the duration of the processing are set out in Annex I.

2.4 Controller's responsibilities. The Controller represents and warrants that:

1. it has obtained and shall maintain, throughout the term of this DPA, all required legal bases under Article 6 GDPR (and, where applicable, Article 9 GDPR) for the processing of End User Personal Data via the Services;
2. it has provided End Users with all required information under Articles 13 and 14 GDPR, including disclosure of Selvyo as a Processor;
3. its instructions to the Processor (including the use of the Services) comply with Data Protection Laws; and
4. it shall not transmit to the Services any Personal Data that is unlawful, infringing, or outside the scope described in Annex I.

3. Duration and Termination

3.1 This DPA takes effect on the Effective Date of the Principal Agreement and remains in force for the duration of the Principal Agreement.

3.2 Upon expiry or termination of the Principal Agreement, this DPA shall continue to apply to any Personal Data retained by the Processor until such Personal Data has been returned or deleted in accordance with Section 14.

3.3 Provisions intended by their nature to survive termination (including Sections 6, 11, 14, 15, 17) shall survive.

4. Client Instructions and Compliance

4.1 Documented instructions. The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do so by Union or Member State law to which the Processor is subject. In the latter case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

4.2 The Controller's initial instructions are those set out in (i) this DPA, (ii) the Principal Agreement, (iii) the Documentation, and (iv) the Controller's use and configuration of the Services. Additional instructions must be agreed in writing (including by email).

4.3 The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes Data Protection Laws, without prejudice to the Processor's right to suspend or terminate processing of the instruction concerned.

4.4 Compliance with Data Protection Laws. Each Party shall comply with its respective obligations under Data Protection Laws in connection with the processing of Personal Data under this DPA.

5. Processor Obligations

The Processor shall:

1. process Personal Data only as necessary to provide the Services and in accordance with the Controller's documented instructions;
2. implement appropriate technical and organizational measures in accordance with Section 7 and Annex II;
3. ensure that persons authorized to process Personal Data are bound by confidentiality obligations or are under an appropriate statutory obligation of confidentiality (Section 6);
4. engage Sub-processors only in accordance with Section 8;
5. assist the Controller, taking into account the nature of the processing and the information available to it, in fulfilling the Controller's obligations under Articles 32–36 GDPR (security, breach notification, DPIA, prior consultation) (Sections 11–12);
6. assist the Controller, taking into account the nature of the processing, by appropriate technical and organizational measures, in fulfilling its obligation to respond to Data Subject requests under Chapter III GDPR (Section 10);
7. at the choice of the Controller, return or delete all Personal Data after the end of the provision of Services (Section 14); and
8. make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller (Section 13).

6. Confidentiality of Personnel

6.1 The Processor shall ensure that any person it authorizes to process Personal Data (including employees, contractors, and Sub-processor personnel) is subject to a written or statutory duty of confidentiality of substance no less protective than the obligations of confidentiality under this DPA, and survives termination of their engagement.

6.2 Access to Personal Data shall be limited to those personnel with a strict need-to-know in the course of providing the Services.

7. Security Measures

7.1 The Processor shall implement and maintain the technical and organizational measures set out in Annex II, designed to ensure a level of security appropriate to the risk, including, as appropriate:

1. the pseudonymization and encryption of Personal Data;
2. the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
3. the ability to restore the availability of and access to Personal Data in a timely manner in the event of a physical or technical incident; and
4. a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures.

7.2 The Processor may update the security measures from time to time, provided that the level of protection of Personal Data is not materially decreased. Material updates shall be reflected in Annex II.

7.3 The Processor maintains SOC 2 Type II and ISO/IEC 27001 certifications, and is pursuing HIPAA compliance attestation. Copies of the current attestation reports are available to the Controller under NDA on request.

8. Sub-processors

8.1 General authorization. The Controller grants the Processor general written authorization to engage Sub-processors for the purposes of providing the Services, subject to this Section 8. The Sub-processors engaged at the Effective Date are listed in Annex III.

8.2 Notice of changes. The Processor shall give the Controller at least thirty (30) days' prior written notice (which may be via the dashboard, email, or update to the sub-processor list at https://selvyo.io/subprocessors) of any intended addition or replacement of Sub-processors.

8.3 Objection right. The Controller may object in writing, on reasonable data-protection grounds, to any addition or replacement of a Sub-processor within fifteen (15) days of receipt of the notice. The Parties shall, in good faith, discuss the objection. If the Parties cannot agree on a resolution within thirty (30) days, the Controller may terminate the affected portion of the Services without penalty by written notice, and the Processor shall refund a pro-rata portion of any prepaid Fees for the period after termination.

8.4 Flow-down obligations. Where the Processor engages a Sub-processor, the Processor shall:

1. enter into a written agreement with the Sub-processor imposing data-protection obligations substantively no less protective than those set out in this DPA, including with respect to security, confidentiality, sub-processing, audit, and international transfers; and
2. remain fully liable to the Controller for the performance of the Sub-processor's obligations.

9. International Data Transfers

9.1 Primary processing region. Personal Data processed via the Services is primarily stored and processed in the EEA, specifically in AWS region eu-central-1 (Frankfurt, Germany).

9.2 Restricted Transfers. To the extent the provision of the Services involves a Restricted Transfer (including transfers to Selvyo's LLM Sub-Processor, OpenAI, when its EU-region endpoints are unavailable or operationally infeasible), the Parties agree that:

1. the EU SCCs (Module 2: Controller-to-Processor) set out in Annex IV are hereby incorporated into and form part of this DPA;
2. the Controller acts as the "data exporter" and the Processor (or, as applicable, the Sub-processor outside the EEA) acts as the "data importer";
3. the Annexes to the SCCs are completed by reference to Annex I (parties, processing description, frequency), Annex II (security measures), and Annex III (sub-processors) of this DPA; and
4. the competent Supervisory Authority is the President of the Personal Data Protection Office of the Republic of Poland (Prezes Urzędu Ochrony Danych Osobowych — UODO), and the governing law of the SCCs is the law of the Republic of Poland.

9.3 Transfer impact assessment. The Processor has conducted, and shall periodically update, a transfer impact assessment with respect to onward Restricted Transfers to its Sub-processors, taking into account the considerations set out in the EDPB Recommendations 01/2020 (and any successor guidance). Supplementary measures applied include, where appropriate: encryption in transit (TLS 1.2+) and at rest (AES-256); zero-retention configuration with the LLM Sub-Processor; contractual prohibitions on government-access disclosure beyond legally compelled minimums; and challenge of overbroad requests.

9.4 Onward transfers. The Processor shall not transfer Personal Data to a Sub-processor located outside the EEA unless (i) the destination country is the subject of an adequacy decision; or (ii) the transfer is governed by SCCs (or other valid transfer mechanism) flowed down to the Sub-processor.

9.5 Withdrawal of adequacy. If any transfer instrument relied upon under this Section 9 ceases to be valid, the Parties shall promptly cooperate, in good faith, to implement an alternative valid mechanism.

10. Assistance with Data Subject Rights

10.1 The Processor shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to requests from Data Subjects exercising their rights under Chapter III GDPR (including the rights of access, rectification, erasure, restriction of processing, data portability, objection, and rights related to automated decision-making).

10.2 If the Processor receives a request directly from a Data Subject relating to Personal Data processed under this DPA, the Processor shall, without undue delay:

1. inform the Data Subject that they should direct their request to the Controller;
2. not respond to the request other than as instructed by the Controller or required by Data Protection Laws; and
3. notify the Controller of the request.

10.3 The Controller shall reimburse the Processor for any reasonable costs incurred by the Processor in providing assistance under this Section 10 that exceed standard self-service Services features, except where required by Data Protection Laws to be provided at no charge.

11. Personal Data Breach Notification

11.1 Notification. Upon becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA, the Processor shall notify the Controller without undue delay and in any event within seventy-two (72) hours.

11.2 Content of notification. The notification shall, to the extent the information is available at the time of notification, contain:

1. a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects concerned, and the categories and approximate number of Personal Data records concerned;
2. the name and contact details of the Processor's Data Protection Officer (or other contact point);
3. a description of the likely consequences of the Personal Data Breach; and
4. a description of the measures taken or proposed to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

11.3 Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without further undue delay.

11.4 Assistance. The Processor shall, taking into account the nature of the processing and the information available to it, assist the Controller in fulfilling its obligations under Articles 33 and 34 GDPR (notification to the Supervisory Authority and communication to Data Subjects), including by providing reasonable cooperation, documentation, and information.

11.5 The Controller is solely responsible for determining whether a Personal Data Breach must be notified to a Supervisory Authority or communicated to Data Subjects, and for making any such notification or communication.

12. DPIA and Prior Consultation

The Processor shall, taking into account the nature of the processing and the information available to it, provide reasonable assistance to the Controller in connection with:

1. any data protection impact assessment ("DPIA") that the Controller is required to carry out under Article 35 GDPR; and
2. any prior consultation with a Supervisory Authority under Article 36 GDPR.

13. Audits and Inspections

13.1 Audit reports as primary evidence. The Processor shall make available to the Controller, on reasonable request and subject to confidentiality undertakings, copies of its most recent SOC 2 Type II report and ISO/IEC 27001 certificate and statement of applicability, which the Parties agree shall be the primary means of demonstrating the Processor's compliance with Article 28 GDPR.

13.2 On-site audit. Where the audit reports under Section 13.1 are insufficient to demonstrate compliance, the Controller may, no more than once per calendar year, conduct an on-site audit of the Processor's premises and processing operations relevant to the provision of the Services, subject to the following:

1. the Controller shall give at least thirty (30) days' prior written notice;
2. the audit shall be conducted during normal business hours and in a manner that does not unreasonably interfere with the Processor's business operations;
3. the auditor shall be a reputable independent firm, not a competitor of the Processor, bound by written confidentiality obligations no less protective than those in the Principal Agreement;
4. the scope, methodology, and duration shall be reasonable and proportionate, and agreed in writing in advance;
5. the Controller shall bear all costs of the audit, except where the audit reveals material non-compliance by the Processor, in which case the Processor shall bear its own costs and reasonable third-party audit costs;
6. the audit shall not extend to (i) data, premises, systems, or information of other Selvyo clients, (ii) source code, model weights, training data, or trade secrets of the Processor, or (iii) information that, if disclosed, would breach the Processor's legal or contractual obligations to third parties; and
7. the Controller shall provide the Processor with a copy of the audit report and shall treat the report as Confidential Information of the Processor.

13.3 Supervisory Authority audits. In addition to Sections 13.1–13.2, the Processor shall cooperate with audits or inspections required by a competent Supervisory Authority.

13.4 Excessive instructions. Any audit instruction that, in the Processor's reasonable opinion, exceeds the requirements of Article 28 GDPR or risks the security or integrity of the Services or other clients' data may be refused, with reasons given in writing.

14. Return and Deletion of Personal Data

14.1 During the term. The Controller may, at any time during the term, export its account data and usage records via the dashboard.

14.2 On termination. Upon termination or expiry of the Principal Agreement, the Processor shall, at the Controller's choice (which must be exercised in writing within thirty (30) days of termination):

1. return to the Controller all Personal Data processed under this DPA, in a structured, commonly used, machine-readable format; or
2. delete all Personal Data, subject to Section 14.3.

14.3 If the Controller does not make an election within the thirty (30) day period, the Processor shall delete all Personal Data within a further thirty (30) days, except to the extent that:

1. retention is required by applicable Union or Member State law (in which case the Processor shall continue to ensure confidentiality and shall not actively process the data for any other purpose);
2. retention is necessary for the establishment, exercise, or defense of legal claims; or
3. the data has been irreversibly anonymized.

14.4 Routine deletion of inference inputs. Notwithstanding the foregoing, food images submitted to the API are deleted within twenty-four (24) hours of inference completion, and operational logs containing Personal Data are deleted or anonymized within thirty (30) days, in each case as a matter of ongoing processing under this DPA.

14.5 Certification. Upon written request, the Processor shall provide written confirmation of return or deletion under this Section 14.

15. Liability and Indemnification

15.1 The liability provisions of the Principal Agreement (including Section 13 of the API Terms of Service: Limitation of Liability) apply to claims arising under or in connection with this DPA, subject to any mandatory provisions of Data Protection Laws.

15.2 Without prejudice to Section 15.1, the limitations and exclusions of liability in the Principal Agreement shall not apply to a Party's liability for administrative fines imposed under Article 83 GDPR, or for damages awarded to Data Subjects under Article 82 GDPR, in each case attributable to that Party's own breach of its obligations.

15.3 Each Party shall be liable in accordance with Article 82 GDPR. As between the Parties, liability shall be allocated according to each Party's respective share of responsibility for the harm caused.

16. No-Training Commitment

16.1 The Processor shall not use Personal Data processed under this DPA (including food images, text queries, Output, and derived data) to train, retrain, fine-tune, evaluate, or otherwise improve any artificial-intelligence model, machine-learning system, or food/nutrition recognition technology, except:

1. with the Controller's prior explicit, written, opt-in consent, specifying the data, purpose, and retention period; or
2. on data that has been irreversibly anonymized in accordance with Recital 26 GDPR (such that no Data Subject is identifiable, directly or indirectly).

16.2 The Processor has contractually disabled the use of Personal Data for training by its LLM Sub-Processor (OpenAI) via the "zero-retention" / no-training API configuration.

16.3 This Section 16 constitutes a binding instruction of the Controller for the purposes of Article 28(3)(a) GDPR.

17. Miscellaneous

17.1 Conflict. In the event of any conflict between this DPA and the Principal Agreement, this DPA shall prevail with respect to the processing of Personal Data. In the event of any conflict between this DPA and the EU SCCs at Annex IV, the EU SCCs shall prevail.

17.2 Governing law and jurisdiction. This DPA is governed by the laws of the Republic of Poland. Disputes are subject to the exclusive jurisdiction of the competent courts in Warsaw, save that the governing law and jurisdiction of the EU SCCs at Annex IV are as stated therein.

17.3 Severability. If any provision of this DPA is held invalid, illegal, or unenforceable, the remaining provisions shall remain in full force and effect.

17.4 Amendments. Any amendment to this DPA shall be made in writing. The Processor may amend this DPA from time to time to reflect changes in Data Protection Laws, regulatory guidance, or operational requirements, by giving the Controller at least thirty (30) days' prior written notice. Where the amendment is materially adverse to the Controller, Section 16.4 of the Principal Agreement applies mutatis mutandis.

17.5 Notices. Notices under this DPA shall be given to:

1. Processor: sergiydf2025@gmail.com, with copy to sergiydf2025@gmail.com.
2. Controller: the administrator email address on file.

17.6 Data Protection Officer. The Processor has appointed a Data Protection Officer pursuant to Article 37 GDPR, contactable at sergiydf2025@gmail.com.

17.7 Counterparts and execution. This DPA may be accepted by click-through, account registration, or signed counterparts (including electronic signature). It is deemed executed at the time the Controller accepts the Principal Agreement.

Annex I — Description of Processing

A. List of Parties

Data Exporter (Controller): The Client identified during the account registration process for the Selvyo Services. Contact details: as recorded on the Client's account.

Data Importer (Processor): Selvyo sp. z o.o., ul. Złota 75A, lok. 7, 00-819 Warsaw, Poland. Contact: sergiydf2025@gmail.com. Activities: provision of B2B AI-powered Food Recognition API and Mobile SDK.

B. Description of Transfer / Processing

C. Competent Supervisory Authority

President of the Personal Data Protection Office of the Republic of Poland (Prezes Urzędu Ochrony Danych Osobowych — UODO)
ul. Stawki 2, 00-193 Warsaw, Poland
Website: https://uodo.gov.pl

Annex II — Technical and Organizational Measures

1. Pseudonymization and Encryption

• Encryption in transit: TLS 1.2 or higher with modern cipher suites (PFS) for all API and SDK communications; HSTS enforced; certificate pinning available for the SDK.
• Encryption at rest: AES-256 for all data stored in AWS managed services (S3, EBS, RDS) and backups; AWS KMS-managed keys, with annual key-rotation policy.
• Pseudonymization: End-User identifiers are pseudonymous on receipt. Internal analytics and aggregated metrics derived from Personal Data are de-identified or anonymized where feasible.

2. Ongoing Confidentiality, Integrity, Availability, Resilience

• Access control: RBAC with least-privilege defaults; SSO + MFA for all internal access; just-in-time elevation for production access; audit logging of all access events.
• Network controls: private VPC segmentation in AWS eu-central-1; security-group allowlisting; WAF and DDoS protection (AWS Shield); ingress restricted to TLS endpoints.
• Integrity: code-signed deployments; checksum verification of artefacts; tamper-evident audit trails (CloudTrail + immutable log sinks).
• Availability: multi-AZ deployment in eu-central-1; autoscaling; health checks and automatic instance replacement; documented Recovery Time Objective (RTO) ≤ 4 hours and Recovery Point Objective (RPO) ≤ 1 hour for production services.
• Resilience: regular backups (daily snapshots; 30-day retention); cross-AZ replication; disaster-recovery runbooks and annual DR exercises.

3. Ability to Restore Availability and Access

• Documented incident-response plan with defined severities and escalation paths.
• Backup-restoration testing at least annually.
• Off-region backup copies for catastrophic recovery (within EEA where applicable).

4. Processes for Regular Testing and Evaluation

• Independent assessments: annual SOC 2 Type II audit; ISO/IEC 27001 surveillance audits; HIPAA gap analysis (certification in progress).
• Penetration testing: at least annually, by qualified independent firms.
• Vulnerability management: continuous dependency scanning; CVE triage SLAs (critical: 24h, high: 7d, medium: 30d).
• Code security: static analysis (SAST), software composition analysis (SCA), and secret-scanning in CI; mandatory peer review for production changes.

5. User Identification and Authorization

• API Key + API Secret (Bearer Token) authentication; revocation and rotation supported.
• SDK license keys per platform.
• Administrator access protected by SSO with hardware-backed MFA.

6. Protection of Data During Transmission and Storage

• TLS 1.2+ everywhere; AES-256 at rest; encrypted backups.
• Image data held only transiently in memory or short-lived encrypted storage; deleted within 24 hours of inference.

7. Physical Security

• Production infrastructure hosted in AWS data centres (ISO 27001, SOC 2, PCI DSS certified).
• Selvyo corporate offices: badge access, visitor logging, clean-desk policy.

8. Event Logging

• Centralized logging with tamper-resistant storage (CloudTrail, application logs, security logs).
• Logs reviewed by SIEM with automated alerting for anomalous patterns.
• Log retention: 30 days for operational/Personal-Data-containing logs; 12 months for security/audit logs (without Personal Data).

9. Internal IT and Security Governance

• Information Security Management System (ISMS) aligned to ISO/IEC 27001.
• Documented policies on access control, change management, data classification, secure development (SDLC), supplier risk, and incident response.
• Annual security and privacy training for all personnel.

10. Certification and Assurance

• SOC 2 Type II (issued by independent auditor; annual cycle).
• ISO/IEC 27001 (certified; ongoing surveillance).
• HIPAA: technical and administrative-safeguard alignment underway; certification in progress.

11. Data Minimization and Quality

• Only data necessary to deliver the requested inference is processed.
• Food images deleted within 24 hours; no long-term retention of raw inputs.

12. Data Retention and Deletion

• Automated deletion pipelines enforce the retention periods set out in Annex I.
• Customer-initiated deletion via the dashboard or API supported.

13. Accountability

• Designated Data Protection Officer (sergiydf2025@gmail.com).
• Records of processing activities (Article 30 GDPR) maintained.
• Internal audit programme integrated with the ISMS.

14. Specific Measures for Sub-processor Engagement

• Pre-engagement due diligence (security questionnaire, certifications review).
• Written data-processing terms with flow-down obligations.
• Continuous monitoring of sub-processor status pages and security advisories.

Annex III — List of Sub-processors

The Processor may engage additional Sub-processors from time to time, subject to the notice and objection procedure set out in Section 8.

Annex IV — EU Standard Contractual Clauses (Module 2)

By executing this DPA, the Parties are deemed to have signed the EU SCCs (Module 2), and the EU SCCs are hereby incorporated by reference. The Parties further agree as follows:

1. Docking clause (Clause 7): applies and is opted in.
2. Option for Clause 9 (Use of sub-processors): OPTION 2 — GENERAL WRITTEN AUTHORIZATION. The time period for notice of changes shall be thirty (30) days as set out in Section 8 of this DPA.
3. Clause 11(a) (Independent dispute-resolution body): the optional language is not opted in. Data subjects may lodge a complaint with the Supervisory Authority pursuant to Clause 12 and Article 77 GDPR.
4. Clause 17 (Governing law): the EU SCCs are governed by the law of the Republic of Poland.
5. Clause 18(b) (Choice of forum and jurisdiction): the Parties submit disputes to the competent courts of the Republic of Poland having jurisdiction over the seat of Selvyo (Warsaw).
6. Annex I.A (List of Parties): as set out in Annex I.A of this DPA.
7. Annex I.B (Description of the transfer): as set out in Annex I.B of this DPA.
8. Annex I.C (Competent Supervisory Authority): as set out in Annex I.C of this DPA.
9. Annex II (Technical and organizational measures): as set out in Annex II of this DPA.
10. Annex III (List of Sub-processors): as set out in Annex III of this DPA.

The full text of the EU SCCs is available on the European Commission's website: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj. In the event of conflict between this DPA and the EU SCCs, the EU SCCs shall prevail with respect to the transfer to which they relate.

Signatures

This DPA is deemed accepted by the Controller upon acceptance of the Principal Agreement, click-through, account registration, or first use of API Credentials. Where the Parties wish to evidence execution by signed counterpart, the following block applies: