Data Processing Agreement (DPA)

• Controller: the customer company that signs up for GetUp and uploads its employee, client and supplier data (“Customer”). The Customer determines the purposes and means of the Personal Data it uploads.
• Processor: GetUp (“Provider”, “we”). Processes Personal Data only on the documented instructions of the Customer and as permitted by this DPA.

For Customer Account Data (signup, payment), GetUp acts as a Controller and handles that data under its Privacy Policy.

• Subject matter: hosting, processing and serving employee, client, invoice, shift, payroll, expense and similar operational data uploaded by the Customer.
• Duration: for as long as the Customer's GetUp subscription is active, plus the return/deletion window after termination.
• Nature: storage (Firestore + Cloud Storage), display, search, filtering, reporting, backup, transactional email, payment interface, KSeF integration.
• Purpose: letting the Customer run its multi-company operational, staff, financial and KSeF obligations.
• Categories of data subjects: Customer's employees, clients, business partners, suppliers.
• Categories of personal data: name, contact (email, phone), salary/payroll info, working hours, identifiers (NIP/REGON), address, invoice details, KSeF reference numbers.

GetUp processes Personal Data only:

• (a) on the documented instructions given under this DPA and the Main Agreement,
• (b) unless otherwise required by EU or Polish law,
• (c) to the extent technically necessary to provide the Service.

If we believe an instruction violates GDPR or applicable law, we will inform the Customer promptly (Art. 28(3)(h)).

The Customer grants prior general authorisation for the following sub-processors:

• Google / Firebase — database, authentication, storage
• Vercel — application hosting, CDN, analytics
• Stripe — payment processing, subscription management
• Resend — transactional email
• ImprovMX — inbound email forwarding (support@, quote@, privacy@)

When a new sub-processor is added or an existing one replaced, we notify the Customer by email at least 14 days in advance. If the Customer objects within that window, we will seek a reasonable resolution; if none is possible, the Customer may terminate without penalty.

We maintain a written contract with each sub-processor providing a protection level equivalent to Art. 28. The current sub-processor list is always available at /compliance.

GetUp applies at minimum the following measures:

• Encryption in transit: TLS 1.3 on all traffic
• Encryption at rest: AES-256 (Google Cloud), AES-GCM layer for password hashes
• Access control: role-based authorisation, HMAC-SHA256 signed session tokens, mandatory TOTP 2FA for admins
• Data isolation: Firestore Security Rules — per-company companyId match
• Network security: HTTPS-only, CSP, CORS, HMAC webhook signature verification
• Backup: daily backup + 7-day point-in-time recovery (Firebase)
• Region: Firebase europe-west3 (Frankfurt) — data within the EU
• Observability: activity log, subscription event log, daily retention cron
• Incident response: written breach playbook + incident register (Art. 33–34)
• Data minimisation: self-service erasure (Art. 17), cascade delete, retention cron

The current, detailed TOM list is always viewable by the Customer at /compliance.

Every GetUp staff member authorised to access Personal Data is under a written confidentiality obligation or bound by statutory confidentiality duties. Access is limited on a need-to-know basis.

GetUp reasonably assists the Customer with responding to data subject requests (access, rectification, erasure, portability, objection) through appropriate technical and organisational measures. Self-service tooling:

• Art. 20 — Portability: /api/account/export JSON dump of all company data
• Art. 17 — Erasure: self-service account deletion on the Subscription page
• Art. 16 — Rectification: in-app edit screens
• Other requests: privacy@getup.dev — answered within 30 days

On becoming aware of a Personal Data breach, GetUp notifies the affected Customer without undue delay and, where feasible, within 24 hours, by email. The notice contains:

• Nature of the breach, categories and approximate number of data subjects
• DPO / contact point: privacy@getup.dev
• Likely consequences
• Measures taken or proposed

Every breach, whether notified or not, is recorded in GetUp's internal incident register (Art. 33(5)).

The Customer has the right to review GetUp's compliance with this DPA once per year. In practice this is satisfied primarily through review of the RoPA, TOM and sub-processor list published at /compliance and, where available, sharing of independent audit reports (e.g. Firebase SOC 2, Stripe SOC 2). On-site audit requires at least 30 days' prior written notice; reasonable confidentiality and cost obligations may apply.

GetUp only transfers data outside the EU subject to appropriate safeguards:

• EU Standard Contractual Clauses (SCC) — 2021 version, Module 2 (Controller–Processor)
• EU-U.S. Data Privacy Framework (DPF) — for certified sub-processors
• Where necessary, a transfer impact assessment (TIA) plus additional technical safeguards

Core data (/companies, content) is stored in Firebase europe-west3 — in practice most data stays within the EU.

On termination the Customer may choose between:

• (a) Return: Customer may download a data dump via /api/account/export before termination.
• (b) Deletion: If the Customer chooses self-service deletion or gives no other instruction within 30 days of termination, GetUp cascade-deletes all Personal Data — except KSeF metadata and invoice records that must be retained by Polish tax law (5 years).

In the audit trail (subscriptionEvents) companyId is pseudonymised to "__deleted__" so the personal-data link is broken while the event record is preserved.

Matters outside this DPA are governed by the Main Agreement. In case of conflict this DPA prevails. Governing law: Polish law and directly applicable EU law (GDPR). Forum: courts of Kraków — without prejudice to mandatory consumer or small-business protections.

The current version of this DPA is 2026-04-19, published at getup.dev/dpa. Material changes are notified to the Customer by email at least 30 days in advance.

The version accepted by the Customer at signup is recorded on the Account (DPA version, timestamp, IP, user-agent) as an audit trail.