1. Parties, priority and roles
This data processing agreement under Article 28 GDPR is between the business customer as controller (the “Customer”) and Martin Kučera, Družstevní 705/IV, 503 51 Chlumec nad Cidlinou, Czech Republic, Company ID 00959324, registered in the Trade Register maintained by the Municipality of Hradec Králové as processor (the “Processor”). By accepting the Terms, the Customer accepts it for the organisation identified at registration.
For customer personal data, this DPA prevails over conflicting general Terms. The Provider remains an independent controller of its own account, contract, payment, security and support data, which is outside this DPA.
2. Subject, nature, purpose and duration
Processing comprises receiving, transmitting, analysing and temporarily handling image content and instructions to generate, return, store and audit draft ALT text. It lasts for the service contract and the technical or statutory retention periods in the Privacy Policy, after which data is deleted or anonymised.
3. Data and data subjects
- Data: image content, image URL or technical reference, site and media metadata, customer instruction, generated and edited ALT text, language, technical state and pseudonymous request identifier.
- Data subjects: visitors and users of the Customer's site, people depicted in photographs, customers, employees, contractors or others whose data the Customer submits.
- Special-category data, biometric identifiers, criminal-offence data and children's data are not intended content. The Customer may submit them only with a valid legal basis, necessity and explicit instruction where the service is suitable.
4. Instructions and Customer duties
The Processor processes personal data only on documented Customer instructions in the contract, account configuration and authorised requests unless law requires processing; it will inform the Customer in advance unless prohibited. It will notify the Customer if an instruction appears to infringe GDPR.
The Customer is responsible for lawfulness, transparency, minimisation and accuracy, notices to individuals and service configuration. It will not require unlawful processing or processing outside the documented service purpose.
5. Confidentiality and security
The Processor limits access to persons bound by confidentiality and only as necessary. It maintains risk-appropriate measures including encrypted transit, access control, credential hashing, secure secret storage, audit logging, backups, updates, recovery and incident procedures.
6. Subprocessors
The Customer gives general written authorisation for the subprocessors below. The Processor imposes materially equivalent data-protection duties and remains responsible under GDPR.
- Websupport — private VPS and related hosting infrastructure; configured EU/EEA service location.
- OpenAI Ireland Limited and its approved subprocessors — AI analysis of images and generation of text; EEA and other locations protected under the OpenAI DPA.
7. Subprocessor changes and transfers
The Processor will give material notice of an intended new or replacement subprocessor with access to customer personal data at least 15 days in advance where reasonably possible. The Customer may object on substantiated data-protection grounds. If no reasonable solution is found, it may stop using the affected feature or terminate.
Transfers outside the EEA occur only under a valid GDPR mechanism, including an adequacy decision or standard contractual clauses, with supplementary measures appropriate to risk.
8. Assistance and data-subject requests
Taking account of processing, the Processor reasonably assists with data-subject requests, impact assessments, prior consultation, security and evidence of compliance. A request clearly concerning customer content is forwarded without undue delay and not answered substantively without instruction unless law requires. Additional work may be charged at cost by prior agreement.
9. Personal data breach
The Processor notifies the Customer of a confirmed customer-personal-data breach without undue delay after becoming aware. As available, it provides the nature, affected categories, likely consequences, measures and contact. Notification is not an admission of liability. The Customer remains responsible for regulatory and individual notifications where required.
10. Return, deletion and audits
At service end, the Processor provides a reasonable export of available outputs at the Customer's choice and deletes or anonymises customer personal data unless law requires retention. Rotating backups remain isolated until overwrite and are not returned to ordinary processing except disaster recovery.
The Processor provides information reasonably necessary to demonstrate Article 28 compliance. The Customer may request a documentation audit at most annually; an on-site audit requires a serious substantiated reason, prior coordination, protection of other customers and Customer cost unless material Processor breach is found.
11. Liability, changes and contact
Liability follows GDPR and the Terms' limitations where mandatory law permits. Material DPA changes are announced in advance and will not reduce protection for existing processing without legal reason. Instructions and incidents may be sent to info@alt-popisky.cz.