Data processing agreement
Version 1.1, effective 12 October 2026
1. Parties and subject matter
This agreement is concluded between the customer using the ConsentGate service as the data controller (the "Controller") and CRE 8 Sp. z o.o., with its registered office in Warsaw, ul. Wiązana 6D lok. P1, 04-765 Warszawa, Poland, entered in the register of entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw under KRS number 0000321545, tax identification number (NIP) 9522064848, REGON 141710560, share capital PLN 50,000, as the data processor (the "Processor").
The Controller entrusts the Processor with processing personal data within the scope and for the purpose described in this agreement, under Article 28 of Regulation (EU) 2016/679 (GDPR).
The agreement applies for as long as the ConsentGate service is used and forms part of the contract for that service.
The agreement is concluded in electronic form, by acceptance in the panel. The Processor records who accepted it, in which version and when.
2. Scope of processing
Purpose: keeping a log of consent decisions made by visitors to the Controller's sites and displaying the consent window.
Categories of data subjects: visitors to the Controller's websites.
Types of data: a random consent ID, the time of the decision, the type of decision, the chosen categories, the window settings version, country, language and page path. The Processor stores no IP address and no browser data. The IP address is processed momentarily only to deliver the script.
Nature of processing: recording, storage, making available to the Controller in the panel and in exports, erasure.
The Processor does not process special categories of data under this agreement.
3. Obligations of the Processor
The Processor processes data only on documented instructions from the Controller. This agreement and the settings chosen by the Controller in the panel are such instructions.
The Processor ensures that persons authorised to process the data have committed themselves to confidentiality.
The Processor applies the technical and organisational measures described in section 9, in line with Article 32 GDPR.
The Processor assists the Controller in responding to requests from data subjects. The panel provides search and deletion of entries by consent ID and an export of the log.
If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay and does not answer it on its own.
The Processor assists the Controller in meeting the obligations under Articles 32 to 36 GDPR, to the extent that follows from the nature of the processing and the information available to it.
The Processor informs the Controller without delay if, in its opinion, an instruction infringes data protection law.
The Controller is responsible for the legal basis of the processing, for the information given to visitors of its sites and for the window settings it has chosen. The Controller confirms that its instructions are lawful.
4. Sub-processing
The Controller gives general authorisation for the Processor to use the sub-processors listed at consentgate.eu/en/subprocessors/.
The Processor informs the Controller by email at least 30 days before adding or changing a sub-processor. The Controller may object within that time. If the parties find no solution, the Controller may terminate the contract with effect on the date of the change.
The Processor imposes data protection obligations on sub-processors no less strict than those in this agreement and is liable to the Controller for their performance.
5. Transfers outside the EEA
The consent log is stored in a database restricted to the European Union jurisdiction.
Where a sub-processor is established outside the European Economic Area, the transfer takes place on the basis of an adequacy decision or the standard contractual clauses adopted by the European Commission.
6. Personal data breaches
The Processor notifies the Controller of a breach of the entrusted data without undue delay, no later than 48 hours after becoming aware of it.
The notification contains the information known at the time: the nature of the breach, the categories and approximate number of entries, the likely consequences, and the measures taken and planned.
7. Audit
The Processor makes available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR.
The Controller may carry out an audit once a year, after agreeing the date at least 30 days in advance, in a way that does not disrupt the service and without access to the data of other customers. The Controller bears the cost of the audit.
The Processor first answers the questions of the Controller in writing and provides documents. The limit of one audit a year does not apply to an inspection required by a supervisory authority or to an audit after a confirmed personal data breach.
8. Termination and return of data
During the term of the agreement and for 30 days after it ends, the Controller may download the consent log as a CSV file and the settings as a JSON file. The Processor charges no fee for this.
After that period the Processor deletes the entrusted data, unless the law requires it to be stored longer.
Copies that allow the database to be restored expire automatically within the window provided by the infrastructure provider and are not used for any other purpose in that time.
During the term of the agreement, log entries are removed automatically after the period set by the Controller's plan.
9. Security measures
Encryption of connections between the browser and the service.
Storage of the log in a database restricted to the European Union jurisdiction.
Data minimisation: no IP address and no browser data stored, a random consent ID.
Access to the panel only after login, with the data of each customer kept separate.
Automatic removal of entries after the retention period.
The ability to restore the database to a chosen point in time within the window provided by the infrastructure provider.
Immutable versions of the window settings, with the version number stored with every decision.
10. Liability and final provisions
Each party is liable for damage caused by processing that infringes the GDPR as set out in Article 82 GDPR. The limitations of liability in the service contract apply to the extent permitted by law.
Nothing limits the liability of the parties towards data subjects under Article 82 GDPR.
Matters not covered here are governed by Polish law and the GDPR. If this agreement conflicts with the service contract on data protection, this agreement prevails.