Spacebring data processing addendum

Last Modified: October 22, 2026

This Data Processing Agreement (“DPA”) is entered into between the customer entity that has entered into the Agreement (“Controller”) and Spacebring Sp. z o.o. with a place of business at ul. Polanki 76, Gdańsk 80-302, Poland, KRS: 0000772992, NIP: PL5842781756, REGON: 38263506000000 (“Processor”).

Controller and Processor are referred to individually as “Party” and collectively as “Parties”.

 

I. Background and Objective

By entering into the Agreement (including by creating an account, starting a Trial Subscription, placing an Order through our checkout, clicking to accept the Terms, paying an invoice, or otherwise accessing or using the Services), the Parties have entered into a contractual relationship to which this DPA is supplemental. Within the scope of its assignment, Processor will/may gain access to and process personal data for which Controller is the data controller. This means that Processor is a data processor for Controller, or another company affiliated with Controller, in accordance with the applicable data protection legislation (“Data Protection Legislation”).

The objective of the DPA is to comply with the requirements in the Data Protection Legislation for a written agreement between Controller and Processor.

 

II. Definitions

The terms used in the DPA shall have the same meaning as assigned to them below and in the Data Protection Legislation, which inter alia imply that:

“Personal data” means any information that, directly or indirectly, can identify a living natural person;

“Processing” means any operation or set of operations performed with regard to personal data, whether or not performed by automated means, for example collection, recording, organisation, storage, adaptation or alteration, retrieval, gathering, use, disclosure by transmission, dissemination or otherwise making information available, alignment or combination, blocking, erasure or destruction;

“Data controller” means anyone who alone or jointly with others determines the purposes and means of the processing of personal data;

“Data processor” means anyone who processes personal data on behalf of the data controller;

“Sub-processor” means a sub-contractor that is engaged by Processor. The sub-processor processes personal data on behalf of Controller in accordance with the sub-processor’s obligation to provide its services to Processor;

“Standard Contractual Clauses” means the standard contractual clauses adopted by the European Commission pursuant to Commission Implementing Decision (EU) 2021/914 (as may be amended, replaced, or superseded), and where applicable the UK Addendum / UK IDTA and Swiss addendum for transfers subject to UK or Swiss law.

“Data Protection Legislation” means applicable data protection legislation. As from 25 May 2018, Regulation (EU) 2016/679 of the European Parliament of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; the “GDPR”) and such national legislation implementing the GDPR is the applicable data protection legislation.

All capitalized terms not defined herein shall have the meaning set forth in the Agreement.

 

III. Undertaking and Instruction

Processor undertakes to process the personal data that it has access to under the Agreement on behalf of Controller, for the purpose of fulfilling the Agreement and during the term of the Agreement. Processor further undertakes:

1. To process the personal data in accordance with the Data Protection Legislation and the Agreement. Processor may, however, process information required by laws of the European Union or national legislation in a member state to which Processor is subject, but shall inform Controller of such requirement prior to processing, provided that Processor is not prohibited to give such information with reference to important grounds of public interest; and
2. Not to use or utilize personal data transferred to or transferred by Processor, collected to or collected by Processor, produced to or produced by Processor or any other way processed personal data under this DPA in its business, other than in cases permitted by this DPA; and
3. To keep the personal data confidential and not to disclose the personal data to any third parties other than in cases permitted by this DPA, or in any other way use the personal data in contradiction with the Agreement and the DPA. Processor shall also ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; and
4. To assist Controller, taking into account the nature of the processing, by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of Controller's obligation to respond to and to fulfil requests from data subjects exercising their rights laid down in Chapter III of the GDPR; and
5. To assist Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (implement security measures, manage personal data breaches, conduct data privacy impact assessments and participate in prior consultations with the supervisory authority) taking into account the nature of the processing and the information available to Processor.

Through mechanisms defined in Agreement, Controller may grant Processor temporary access to personal data for the sole purpose of fulfilling its obligations under Agreement.

Controller's documented instructions are this DPA, the Agreement, and Controller's use and Configuration of the Services, including its settings for Agent and Agents and the Connected Services it connects. Processor processes personal data on those instructions.

 

IV. Consent for Collecting Personal Data

Controller stipulates that all relations between Controller and its end users resulting from the performance of the Agreement are regulated by a lease contract or by other similar documents between Controller and its end users, that inter alia regulates collection and processing of all required consents for processing personal data.

 

V. Processing Activities

Controller may submit personal data to the Services, the extent of which is determined and controlled by Controller and which may include, but is not limited to, personal data relating to the following categories of data subject:

• Authorized Users;
• employees of Controller;
• consultants of Controller;
• contractors of Controller;
• agents of Controller; and/or
• third parties with which Controller conducts business.

The personal data transferred concern the following categories of data:

• full names;
• contact information (including, but not limited to email addresses, phone numbers);
• information about software and hardware used to access Services;
• other personal data, which data subjects may choose to submit through Services, the extent of which is determined and controlled by Controller in compliance with applicable Data Protection Law.

The Services are not intended for processing Special Categories of Personal Data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR). Controller will not provide such data to Processor unless the Parties have expressly agreed in writing and Processor has implemented appropriate safeguards.

The personal data transferred will be processed in accordance with the Agreement and may be subject to the following processing activities:

• storage and other processing necessary to provide, maintain, and update the Services provided to Controller;
• to provide customer and technical support to Controller;
• review by Processor's personnel of Agent chats and Agent runs that Users or Controller rate, or that are queued for quality, safety or abuse review, including through Langfuse, to operate, secure and improve the Services;
• product analytics, error monitoring and session replay of a sample of sessions, including through PostHog, to maintain, secure and improve the Services;
• in aggregate and anonymized form for improvement of Services; and
• disclosures in accordance with the Agreement, as compelled by law.

 

VI. Information Security

Processor implements all appropriate technical and organisational measures necessary in order to ensure a level of security, as required pursuant to Article 32 GDPR and other applicable Data Protection Legislation necessary in order for Processor to comply with the security requirements set out in the Agreement.

Processor may update its technical and organizational measures from time to time, provided that such updates will not materially diminish the overall security of the Services. Processor will provide notice where a change materially reduces security (if any), or where required by applicable law.

In the event of data breach or any potential violation of information security, Processor shall notify Controller without delay after becoming aware of the infringement of information security of personal data or any other violation of Data Protection Legislation or this DPA. As a part of the notification, Processor must inform Controller without delay and in writing all the necessary information about the disturbance and the related measures, especially:

1. A description of the nature of the infringement of information security, including the information of registered groups and estimated amount of registered persons affected by the infringement along with the information required by Data Protection Legislation;
2. Necessary information regarding the statutory obligations and fulfillment of the contractual obligations of Controller. These obligations shall be based on, inter alia, Data Protection Legislation, agreements made with third parties and/or a request, a guidance and/or a ruling made by the supervisory authority or a tribunal;
3. Necessary information for preventing similar infringements of the information security and information required for the notifications made for the registered persons and possible third parties.

 

VII. Audit

1. Upon written request, Processor will provide Controller with information reasonably necessary to demonstrate Processor’s compliance with this DPA. Where available, Processor may satisfy this obligation by providing summaries of its security program and/or relevant third-party audit reports (e.g., PCI DSS) or similar documentation.
2. Controller may conduct an audit of Processor’s compliance with this DPA no more than once per twelve (12) months (Planned audit), unless (a) required by a competent supervisory authority, or (b) following a reasonable suspicion of Personal Data Breach affecting Personal Data that Processor has access to under the Agreement on behalf of Controller, (c) in the event of any material changes to the Processor's data security measures, systems, or processes that could reasonably impact the security of the Controller's personal data (Ad hoc or incidental audit).
3. Planned audit must be: (i) scheduled at least thirty (30) days in advance; (ii) conducted during normal business hours; (iii) subject to confidentiality obligations; and (iv) performed in a manner that does not unreasonably interfere with Processor’s business operations, security, or other customers. Ad hoc or incidental audits may be conducted with reasonable prior notice appropriate to the circumstances (but no less than seventy-two (72) hours), subject to the other conditions in this clause.
4. Controller will bear all costs of any audit and will reimburse Processor for reasonable time and expenses incurred in supporting the audit, except where the audit identifies material non-compliance by Processor.
5. Processor may object to any auditor that is not independent or is a direct competitor of Processor, and the Parties will work in good faith to select an alternative auditor.

 

VIII. Engaging Sub-processors

Controller acknowledges and agrees that Processor may engage third-party Sub-processors for the performance of Processor's processing of personal data under the DPA. Processor shall be liable for the acts and omissions of its Sub-processors to the same extent Processor would be liable if performing the work of each Sub-processor directly under the terms of this DPA.

Controller grants Processor general written authorization to engage Sub-processors. A current list of Processor's Sub-processors is available in the 'Product sub-processors' table of the Privacy Policy.

Spacebring Intelligence is provided through Vercel AI Gateway, operated by Vercel Inc. ('Vercel'). Processor engages Vercel as its Sub-processor. Vercel routes Spacebring Intelligence requests to large language model providers that Vercel engages as its own sub-processors (the 'AI Providers'). The AI Providers are Anthropic, Google (on Vertex AI) and OpenAI. Processor has no direct contract with them. They are listed, with each one's location and transfer safeguard, in the 'Product sub-processors' table of the Privacy Policy. Vercel engages its own sub-processors, including the AI Providers, as listed in Vercel's published sub-processor list at https://security.vercel.com. Controller may review that list at any time. Processor gives notice when it routes Spacebring Intelligence requests to a new AI Provider, as set out below. Processor does not give notice of other changes to Vercel's own sub-processors.

Processor will notify Controller of any intended addition or replacement of a Sub-processor, or of an AI Provider to which Processor routes Spacebring Intelligence requests, at least fourteen (14) business days before it begins processing personal data. Notice is given by email to Controller's account owner and names the new Sub-processor, its location and its transfer safeguard. Using a new model or model version from an AI Provider already on the list is not a change.

Controller may object to a new Sub-processor or AI Provider in writing within fourteen (14) business days of Processor's notice, but only on reasonable grounds relating to data protection. If Controller objects:

• (a) Processor may, at its option, propose a reasonable alternative, or configure the Services so that the new Sub-processor or AI Provider does not process Controller's personal data. Where possible, Processor will do so within thirty (30) days.
• (b) If Processor does not do either, Controller's sole and exclusive remedy is to disable the affected feature for its account. For an AI Provider, that is Spacebring Intelligence. If Controller disables it, Processor will refund the unused paid Prepaid Balance under Section 11.9.11(d) of the Terms. Controller is not entitled to any other refund, credit or damages for this.
• (c) If the affected Sub-processor, such as Vercel, cannot be disabled for one feature, Controller's sole and exclusive remedy is to terminate the affected Services by written notice. Termination takes effect on the date Controller states in its notice, which may be no later than the end of the current Subscription Period. If the notice states no date, termination takes effect thirty (30) days after the notice. Processor will refund the unused paid Prepaid Balance under Section 11.9.11(d) of the Terms. No other fees are refunded, and Controller is not entitled to any credit or damages for this.

If an urgent replacement is needed for security, availability or legal reasons, Processor may engage it without prior notice. Processor will notify Controller promptly afterwards, and the objection right above then applies.

Processor engages each of its Sub-processors only on written terms that impose data protection obligations no less protective than this DPA. Vercel's data processing addendum requires Vercel to engage each of its sub-processors, including each AI Provider, under a written agreement with substantially similar data protection obligations, and keeps Vercel liable for them. Processor remains responsible to Controller for Vercel's obligations, including for the AI Providers, under Article 28(4) GDPR. Processor routes Spacebring Intelligence requests only to Anthropic, Google (on Vertex AI) and OpenAI, and to any AI Provider added under this Section VIII. Processor has configured Vercel AI Gateway so that requests go only to those AI Providers, with prompt training disallowed and zero data retention enabled, subject only to the limited retention some AI Providers keep for abuse and safety monitoring under their terms.

To the extent Processor or its Sub-processors process or transfer Personal Data outside the EEA, the UK, or Switzerland, Processor will ensure that such transfers are subject to appropriate safeguards under applicable Data Protection Legislation (such as the Standard Contractual Clauses and, where applicable, the UK Addendum/UK IDTA and Swiss addendum) and will provide information about such safeguards upon request.

 

IX. Order of Validity of Contract Documents

This DPA forms part of the Agreement. In the event of a conflict between this DPA and the Agreement, this DPA will control solely with respect to the Parties’ rights and obligations relating to the processing and protection of Personal Data. For all other matters, the Agreement will control.

Each Party's liability under or in connection with this DPA, including for Sub-processors and the AI Providers, is subject to the exclusions and limitations of liability in the Agreement, including Section 13 of the Terms. The rule above does not override them. Nothing in this DPA limits the rights of data subjects under Article 82 GDPR.

 

X. Term

This DPA is effective as of the date the Agreement becomes effective and remains in force for as long as Processor processes personal data on Controller’s behalf.

Upon termination or expiration of Controller’s subscription to Processor’s Services (including expiration of Trial Subscriptions without conversion to paid subscription), the Controller should decide whether to delete or return any personal data for which Controller is the data controller provided to the Processor under this agreement. If Controller does not provide Processor with instructions to return or delete Customer Data, the following default data retention and deletion procedure applies automatically:

(a) Day 0 – Initial notification: On the date of termination or expiration of Controller’s subscription, we send an automated notification to the Controller’s registered email address informing that all data associated with their Account, including all Users’ personal data, will be permanently and irrevocably deleted within 60 (sixty) calendar days from the date of termination. This notification includes:

• The exact date by which data will be deleted,
• Information about the possibility of recovering data during the 60-day period,
• Instructions on how to export data from the Services,
• Contact information for our support team (support@spacebring.com) for data recovery requests.

(b) Day 30 – Reminder notification: 30 (thirty) calendar days after termination of Controller’s subscription, we send a second automated reminder to the Controller’s registered email address informing that data will be permanently deleted in 30 (thirty) days. This reminder includes the same information as the initial notification and emphasizes the approaching deadline for data recovery.

(c) Day 60 – Automatic data deletion: 60 (sixty) calendar days after termination of Controller’s subscription, all data associated with the Controller’s Account is automatically and permanently deleted from our systems. This deletion is irreversible and includes:

• All Users’ personal data (names, email addresses, phone numbers, profile information, etc.),
• All business data (invoices issued by Controller to their clients, booking records, membership plans, room/desk/office details, payment information, etc.),
• All usage data and logs,
• Customer Data will be deleted from production systems and scheduled for deletion/overwriting from backups in accordance with Processor’s backup retention cycle.

After the 60-day period expires, Processor will have no obligation to restore Customer Data and may be unable to do so.

(d) Data recovery during the 60-day period: During the 60-day post-termination period, Controller may recover their data by:

• Contacting our support team at support@spacebring.com with a data recovery request. Our support team will provide instructions on how to export data or restore access to the Account.
• Re-subscribing to our Services. Upon re-subscription (and provided the data has not been deleted pursuant to Controller’s instructions), access to the Account and Customer Data is restored.

(e) Controller’s obligations: Controller is responsible for:

• Ensuring that they have exported all necessary data from the Services before the expiration of the 60-day post-termination period.

• Informing their Users about the termination of subscription and the upcoming deletion of data, in accordance with Controller’s own privacy policy and applicable data protection laws.

• Ensuring that they have an alternative means of storing and processing Users’ data after termination of Spacebring Services.

Spacebring is not responsible for any loss of data or business disruption resulting from Controller’s failure to export data before the expiration of the 60-day period.

For avoidance of doubt, this procedure applies to Personal Data for which Controller is the data controller provided to the Processor under this agreement, except to the extent Processor is required to retain certain information under applicable law (e.g., tax, accounting, fraud prevention, or security obligations). Any such retained data will be protected and access-restricted. Residual copies in backups will be deleted or overwritten in accordance with Processor’s backup retention cycle.

 

XI. Governing Law and Dispute Resolution

The DPA shall be governed by and construed in accordance with laws of the Republic of Poland. Disputes regarding interpretation and application of the DPA shall be settled in accordance with the provisions in the Agreement regarding dispute resolution.