Legal

Data Processing Agreement

The terms on which Faunak, as processor, processes third-party data entered by kennels and users, including the list of sub-processors and the security measures.

This Data Processing Agreement applies from 3 November 2026.

This Data Processing Agreement forms part of the Faunak Terms of Service. Capitalised terms not defined below have the meaning given to them in the Terms of Service.

§ 1. Parties and conclusion of the agreement

The parties to the Data Processing Agreement are:
1. Controller - the entity that determines the purposes and means of processing the Entrusted Data, namely:
  1. for data entered within a Kennel - the entity running the Kennel: the User who set it up or the Business on whose behalf it was set up (§ 7(4) of the Terms of Service),
  2. for third-party data entered by a User within their Account (e.g. details of vets, clinics and laboratories entered for a dog) - that User;
2. Processor - the Service Provider, namely Ernest Sadowski, running a sole proprietorship under the business name Ernest Sadowski, NIP (tax identification number) 8393217403, REGON (statistical number) 386486957, address for service: ul. Giserska 11/176, 02-495 Warszawa, Poland, e-mail for matters relating to the Data Processing Agreement: hello@faunak.com.
The Data Processing Agreement is concluded in electronic form (Article 28(9) of the GDPR) upon acceptance of the Terms of Service and, in respect of a Kennel, upon its creation. It does not require a separate signature.
In dealings with the Processor, the Kennel Owner acts on behalf of a Controller running a Kennel. Instructions and statements of the Kennel Owner are deemed to be instructions and statements of the Controller. The Processor sends the notifications provided for in the Data Processing Agreement to the e-mail address of the Kennel Owner's Account and, in the case referred to in paragraph 1(1)(2), to the e-mail address of the User's Account.
A Controller that runs a Kennel with the participation of other Users (Kennel Admins and Kennel Members) is responsible for ensuring that they use the Platform in accordance with its instructions. The actions of these people in the Kennel are deemed to be actions taken on behalf of the Controller.
If the Controller's processing of data is purely personal or household in nature and is not subject to the GDPR, the Processor nevertheless applies the rules and safeguards set out in the Data Processing Agreement to those data.

§ 2. Definitions

GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
Entrusted Data - personal data of third parties that the Controller or people acting on its behalf enter on the Platform, or that are generated on the Platform as a result of using its features, to the extent described in § 4.
Sub-processor - an entity to which the Processor entrusts the processing of Entrusted Data in order to provide the Services.
Breach - a personal data breach within the meaning of Article 4(12) of the GDPR concerning Entrusted Data.
EEA - the European Economic Area.

§ 3. Subject matter, duration, nature and purpose of processing

The Controller entrusts the Processor with the processing of Entrusted Data on the terms set out in the Data Processing Agreement, in accordance with Article 28 of the GDPR.
The subject matter of the processing is storing the Entrusted Data and making available to the Controller the Platform features used to maintain them.
The nature of the processing comprises: collection through Platform forms, recording, storage (including in backups), organisation, retrieval, consultation, alteration, display to people authorised by the Controller, transmission of e-mail messages sent on the Controller's instructions, export at the Controller's request and erasure.
The sole purpose of the processing is to provide the Services to the Controller in accordance with the Terms of Service, including hosting, maintenance, security and troubleshooting of the Platform and the provision of technical support.
The Processor does not process Entrusted Data for its own purposes, in particular for marketing or analytics, for profiling, for compiling directories or databases or for selling them.
The Data Processing Agreement applies for as long as the Account or Kennel within which the Entrusted Data are processed exists, and thereafter for the period needed to delete them in accordance with § 14.
The processing is carried out within the Fees payable under the Terms of Service and, for free Services, free of charge.

§ 4. Types of data and categories of data subjects

The Entrusted Data may include the following types of data:
1. Kennel contacts - first name, last name, e-mail address, telephone number, addresses (street, city, postcode, region, country, address notes), social media profiles, notes about the contact and an internal "blacklist" flag,
2. waiting list - the linked contact, preferences (e.g. sex of the puppy, parents), the status of the application (e.g. new, verified, deposit paid) and notes,
3. reservations - the linked contact, the puppy, the status, dates and the reason for cancelling the reservation, stored as the Kennel's sales history,
4. vets, clinics and laboratories - names of people or organisations entered with dogs' preventive care and health tests,
5. other third-party data that the Controller enters in the text fields of the Platform, e.g. in notes.
Categories of data subjects: buyers and prospective buyers of puppies, people on the waiting list, other Kennel contacts, veterinary surgeons and representatives of clinics and laboratories, and other people whose data the Controller enters in text fields.
Entrusted Data do not include data that the Service Provider processes as controller in accordance with the Privacy Policy, in particular Users' Account data (including Kennel members and people assigned a role for a dog, together with that role), data relating to invitations to a Kennel and to a dog (the invited person's e-mail address, the role and the status of the invitation), payment data and invoices, and data on security and use of the Platform.
The processing is not intended to include special categories of personal data (Article 9 of the GDPR) or data relating to criminal convictions and offences (Article 10 of the GDPR). The Controller does not enter such data on the Platform and, in particular, does not record information about people's health in notes. Data on dogs' health are not personal data.
The Controller is responsible for ensuring that the "blacklist" flag and the notes about contacts contain only information that is true, necessary and processed lawfully.

§ 5. Obligations and representations of the Controller

The Controller represents that it has a legal basis for processing the Entrusted Data and for entrusting them to the Processor.
The Controller fulfils the information obligations under Articles 13 and 14 of the GDPR towards data subjects, including informing them that it uses the Faunak Platform as a tool for maintaining data.
The Controller handles data subjects' rights and responds to their requests, with the Processor's assistance under § 11.
The Controller uses the visibility settings and the roles in the Kennel in a way that ensures that Entrusted Data are accessible only to people who should have access to them.

§ 6. Documented instructions

The Processor processes Entrusted Data only on documented instructions from the Controller, including with regard to transfers of data to a third country, unless required to do so by European Union or Member State law to which the Processor is subject. In such a case, the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
The Controller's documented instructions are:
1. the Terms of Service and the Data Processing Agreement,
2. the use of Platform features by the Controller and people acting on its behalf, including entering, editing, sharing, sending invitations and deleting data, and the visibility and role settings,
3. additional instructions sent by the Controller by e-mail to hello@faunak.com, if they are consistent with the Terms of Service and can be carried out within the Platform.
The Processor informs the Controller without delay if, in its opinion, an instruction infringes the GDPR or other data protection provisions. Until the matter is clarified, the Processor may suspend the execution of such an instruction.

§ 7. Confidentiality

The Processor allows access to Entrusted Data only to people who have been authorised by it and have committed themselves to confidentiality or are under a statutory obligation of confidentiality. This obligation continues after these people's cooperation with the Processor ends.
The Processor and the people authorised by it have access to Entrusted Data only to the extent necessary to provide the Services, in particular to handle a request or complaint, fix a failure, ensure security, handle a content notice under § 17 of the Terms of Service or comply with a legal obligation.

§ 8. Security of processing

The Processor applies technical and organisational measures ensuring a level of security appropriate to the risk, as referred to in Article 32 of the GDPR. The measures are described in Annex 2.
The Processor reviews the security measures regularly, at least once a year, and may change them, provided that the change does not reduce the overall level of protection of the Entrusted Data. The current description of the measures is published in the Data Processing Agreement.
The Processor maintains a record of categories of processing activities carried out on behalf of Controllers where required by Article 30(2) of the GDPR.

§ 9. Sub-processors

The Controller gives the Processor general authorisation to engage Sub-processors. The list of Sub-processors using Entrusted Data on the date the Data Processing Agreement is concluded is set out in Annex 1, and the Controller accepts the entities listed there.
The Processor selects only entities that provide sufficient guarantees to implement appropriate technical and organisational measures and concludes agreements with them imposing data protection obligations at least equivalent to those in the Data Processing Agreement.
The Processor informs the Controller by e-mail at least 14 days in advance of any intended addition or replacement of a Sub-processor. The notification states the name of the entity, the scope of services, the categories of data, the place of processing and the basis for any transfer outside the EEA. Publishing an updated list without sending a notification is not sufficient.
The Controller may object to the change by e-mail to hello@faunak.com within 14 days of receiving the notification, giving reasons. Failure to object within that period means acceptance of the change.
Upon receiving an objection, the parties seek a solution in good faith, e.g. by clarifying concerns or applying additional safeguards. If the objection cannot be resolved, the Controller may, before the change is made, terminate the Subscription Agreement and the Data Processing Agreement with immediate effect, and the Processor refunds a proportionate part of the Fees paid in advance for the unused period. A Controller using free Services may in that case delete the Account or Kennel. After termination of the Data Processing Agreement, the Entrusted Data are returned or deleted under § 14.
If the replacement of a Sub-processor is urgently necessary for reasons of data security or continuity of the Services (e.g. the existing supplier suddenly discontinuing its services), the Processor may make the change earlier and informs the Controller of it without delay. The Controller then has the rights under paragraphs 4 and 5, counted from the day the notification is received.
The Processor remains liable to the Controller for the performance of the data protection obligations of a Sub-processor as for its own actions (Article 28(4) of the GDPR).

§ 10. Transfers of data outside the EEA

The Entrusted Data are stored in a database and file storage located in the European Union (Frankfurt am Main, Germany).
Some Sub-processors are established in the United States or may access data from countries outside the EEA, in particular when running the application and sending e-mail messages (Annex 1).
The Processor transfers Entrusted Data outside the EEA only in compliance with the conditions of Chapter V of the GDPR (Articles 44-49), in particular on the basis of a European Commission adequacy decision (including the EU-US Data Privacy Framework, for certified entities) or the standard contractual clauses adopted by the European Commission by Decision (EU) 2021/914.
If the decision on which a transfer is based is repealed or invalidated, the Processor promptly ensures another basis under Chapter V of the GDPR, in particular standard contractual clauses, or stops transferring data to the entity concerned.
At the Controller's request, the Processor provides information on the safeguards applied to transfers.

§ 11. Assistance with data subjects' rights

The Platform provides the Controller with tools that allow it to handle most data subject requests itself, in particular viewing, correcting and deleting Entrusted Data.
Until a data export feature is made available on the Platform, the Processor, at the Controller's request sent to support@faunak.com (§ 19(5) of the Terms of Service), provides the Controller with the Entrusted Data in a commonly used, machine-readable format, within a time that allows the Controller to meet the deadlines under the GDPR, and no later than within 14 days of receiving the request.
If a data subject makes a request directly to the Processor, the Processor does not respond to it on the merits but forwards it to the Controller without delay, and no later than within 5 Business Days, and informs that person that their request has been forwarded to the controller.
At the Controller's request, the Processor provides additional assistance if a request cannot be handled using the Platform's tools.

§ 12. Assistance with obligations under Articles 32-36 of the GDPR

Taking into account the nature of processing and the information available, the Processor assists the Controller in ensuring compliance with the obligations relating to security of processing, notification of Breaches to the supervisory authority and communication to data subjects, data protection impact assessments and prior consultation with the supervisory authority (Articles 32-36 of the GDPR).
The assistance consists in particular of providing the description of the processing and the security measures (Annex 2), answering the Controller's questions and providing information about a Breach in accordance with § 13.
The assistance is provided within the Fees. If a Controller that is a Business requests assistance going significantly beyond the scope described in the Data Processing Agreement, the parties may agree in advance on reimbursement of reasonable costs.

§ 13. Personal data breaches

The Processor notifies the Controller of a Breach without undue delay, and no later than within 48 hours of becoming aware of it, by e-mail to the address specified in § 1(3).
The notification contains, as far as the information is available:
1. a description of the nature of the Breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned,
2. the contact details of a person from whom more information can be obtained,
3. a description of the likely consequences of the Breach,
4. a description of the measures taken or proposed to address the Breach, including measures to mitigate its possible adverse effects.
If not all the information is available at the time of notification, the Processor provides it in phases without undue further delay.
The Processor promptly takes action to limit the effects of the Breach and prevent similar incidents, documents the Breach (circumstances, effects and remedial action) and makes this documentation available to the Controller.
The Controller notifies the Breach to the supervisory authority and communicates it to data subjects. The Processor does not do so on behalf of the Controller without the Controller's instruction, unless required by law.

§ 14. Deletion and return of data

The Controller may delete Entrusted Data at any time using the Platform's features.
After deletion of the Kennel or Account within which the Entrusted Data are processed, or after termination of the Data Processing Agreement, the Processor deletes the Entrusted Data from live systems no later than within 30 days and from backups - by overwriting them in rotation - within a further 30 days.
Before deleting the Kennel or Account, the Controller may request the return of the Entrusted Data in the form of an export under § 11(2). The choice between return and deletion is the Controller's; if the Controller does not request return before deleting the Kennel or Account, the data are deleted.
Paragraph 2 does not apply to data whose further storage is required by European Union or Member State law. Payment data and the Service Provider's invoices are not Entrusted Data; the Service Provider processes them as controller in accordance with the Privacy Policy.
At the Controller's request, the Processor confirms the deletion of the Entrusted Data by e-mail.
Contacts, waiting list entries and notes deleted by the Controller while using the Platform are permanently deleted from live systems 30 days after their deletion and from backups within a further 30 days. From a contact referred to by a reservation (the Kennel's sales history), all of the person's data are deleted and only the reservation record remains.
Dog profiles remain on the Platform as separate records that other Users also rely on (e.g. pedigrees, litter histories). Deleting a dog, a Kennel or an Account detaches the dog from the Kennel or Account. Entrusted Data concerning natural persons linked to the dog, including notes about the dog, are deleted in accordance with paragraphs 2 and 6.

§ 15. Information and audits

The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR.
The Controller exercises its right of inspection primarily by asking questions and requesting documents. The Processor answers questions sent to hello@faunak.com within 14 days and makes available the description of the security measures, information about Sub-processors and available reports or certificates of Sub-processors.
If the information under paragraph 2 is not sufficient to demonstrate that the processing complies with the Data Processing Agreement, the Controller or an independent auditor authorised by it may carry out an audit, including an inspection, on the following terms:
1. no more than once every 12 months, unless the audit is justified by a Breach or a request from a supervisory authority,
2. after notifying the Processor at least 30 days in advance, specifying the scope of the audit, and, in the case of an audit following a Breach, at least 7 days in advance,
3. on Business Days, during the Processor's working hours, in a way that does not unduly disrupt its business, and remotely where possible,
4. at the Controller's expense,
5. the auditor undertakes to keep confidential the information obtained during the audit and may not be a competitor of the Processor,
6. the audit does not include access to the data of the Processor's other customers or to the infrastructure of Sub-processors; in this respect, the Processor makes available the reports and certificates of those entities.
The Processor remedies any shortcomings identified in the audit within an agreed, reasonable time.

§ 16. Liability

The liability of the Controller and the Processor towards data subjects is governed by Article 82 of the GDPR. The Processor is liable for the damage caused by processing where it has not complied with obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to the lawful instructions of the Controller.
Towards a Controller that is a Business, the Processor's liability under the Data Processing Agreement is subject to the limitations set out in § 21(6)-(8) of the Terms of Service. These limitations do not apply to liability towards data subjects or to damage caused intentionally.
Towards a Controller that is a Consumer or a sole trader with consumer rights, the Processor is liable on general principles.

§ 17. Term and termination

The Data Processing Agreement applies for the period specified in § 3(6) and terminates automatically upon deletion of the Kennel or Account within which the Entrusted Data are processed, subject to the obligations under § 14.
The Data Processing Agreement may not be terminated separately while the Controller's Entrusted Data are processed on the Platform, except for termination under § 9(5).
The Controller may terminate the Data Processing Agreement together with the Subscription Agreement with immediate effect if the Processor seriously breaches the Data Processing Agreement or the GDPR and, despite being asked to do so, does not remedy the breach within a reasonable time. In that case, the Processor refunds a proportionate part of the Fees paid in advance for the unused period.

§ 18. Final provisions

In matters relating to the processing of Entrusted Data, the Data Processing Agreement takes precedence over the Terms of Service. In all other respects, the Terms of Service apply.
Changes to the Data Processing Agreement are made in the same way as changes to the Terms of Service (§ 25 of the Terms of Service). Changes to the list of Sub-processors are made under § 9.
Matters not governed by this agreement are subject to the GDPR, the Civil Code (Kodeks cywilny) and other provisions of Polish law. The governing law and the competent court are determined by § 26 of the Terms of Service.
This Data Processing Agreement applies from 3 November 2026.

Annex 1 - list of sub-processors

Sub-processors of Entrusted Data

Entity	Scope of services	Categories of Entrusted Data	Place of processing	Basis for transfer outside the EEA
Vercel Inc., USA	hosting of the web application, server functions, scheduled jobs, technical logs	all categories in § 4 - to the extent transmitted through the application servers; technical logs	server functions in the EU (Frankfurt, region fra1); the edge network and logs also in other regions, including the USA	Commission decision on the Data Privacy Framework (Article 45 GDPR), the entity is certified, and standard contractual clauses 2021/914 (Article 46(2)(c) GDPR)
Supabase Pte. Ltd., Singapore (Amazon Web Services infrastructure)	PostgreSQL database, file storage (photos), backups	all categories in § 4	European Union - AWS region eu-central-1, Frankfurt am Main, Germany	data stored in the EU; standard contractual clauses 2021/914 for access from third countries (support and maintenance)
Plus Five Five, Inc. (Resend), USA	sending e-mail messages from the Platform	the recipient's e-mail address and the content of the message, to the extent they contain Entrusted Data (e.g. the e-mail address of a Kennel contact used on the Controller's instructions)	USA	Commission decision on the Data Privacy Framework (Article 45 GDPR), the entity is certified, and standard contractual clauses 2021/914 (Article 46(2)(c) GDPR)
Google Ireland Limited, Ireland, and Google LLC, USA (Google Workspace)	e-mail for hello@faunak.com and support@faunak.com	Entrusted Data only to the extent the Controller passes them on in correspondence (e.g. in a support request)	EU and USA	Commission decision on the Data Privacy Framework (Article 45 GDPR), the entity is certified, and standard contractual clauses 2021/914 (Article 46(2)(c) GDPR)

Our suppliers' lists of their own sub-processors: Vercel, Supabase, Resend, PostHog, Stripe.

Suppliers that do not process Entrusted Data

The following suppliers work with the Service Provider but do not receive Entrusted Data. Information about them is provided in the Privacy Policy.

Entity	Role	Notes
PostHog Inc., USA (EU cloud)	analytics and error monitoring	concerns only Users who have given consent and technical information about server errors; data on Kennel contacts, the waiting list and reservations are not sent to PostHog (events contain only technical identifiers and values from closed lists, e.g. the reason a reservation was cancelled)
Stripe Payments Europe, Limited, Ireland	processing of Subscription payments, taxes, invoices, Customer Portal	processes Customers' data as the Service Provider's payment provider and as an independent controller for fraud prevention and legal obligations; it is not a Sub-processor of Entrusted Data
Google Ireland Limited, Ireland, and Google LLC, USA (Google sign-in)	authentication of Users who choose to sign in with Google	concerns only the data of the User signing in; does not include Entrusted Data

Annex 2 - technical and organisational measures

Location and infrastructure

The database and file storage are maintained in the European Union (AWS eu-central-1, Frankfurt am Main) as part of the Supabase service.
The application is hosted on the Vercel infrastructure. The infrastructure providers ensure the physical security of the data centres.

Encryption

All communication between the User's device and the Platform and between the components of the Platform is encrypted using TLS (HTTPS).
Data in the database and in file storage are encrypted at rest by the infrastructure provider.
Users' passwords are stored only as a hash computed with an algorithm designed for passwords. The Service Provider does not know Users' passwords.
The Service Provider does not store payment card data; they are processed by Stripe.

Access control on the Platform

Access to an Account requires authentication (a password with a confirmed e-mail address, a passkey or Google sign-in). The User may enable two-factor authentication (TOTP with backup codes).
The User can see active sessions (IP address, browser) and end them.
The data of each Kennel are logically separated from the data of other Kennels; on every access, the application checks the User's membership of the Kennel and their role (Kennel Owner, Kennel Admin, Kennel Member).
Dog data are made available to other Users only to the extent of the visibility settings and the roles for the dog.
Limits are applied to the number of requests and login attempts from a single IP address, and registration from disposable e-mail domains is blocked.
Files (photos) are accessible at a URL without signing in to anyone who knows the address; the Controller should not include Entrusted Data in photos.

Service Provider access

Administrative access to the infrastructure and databases is held only by the Service Provider and by people authorised by it and bound by confidentiality, to the extent necessary to perform their tasks.
Administrative accounts with infrastructure providers are protected by strong passwords and two-factor authentication.
Signing in to a User's Account in support mode (impersonation) is possible only in the cases specified in § 6(8) of the Terms of Service.
Access keys and application secrets are stored in the hosting provider's environment variables, not in the source code.

Availability and backups

Database backups are made automatically by the database provider and stored in the European Union.
Backups are overwritten in rotation, which allows data to be deleted from them within the time limits in § 14.
The Service Provider monitors the operation of the Platform and server errors in order to detect failures quickly.

Development and maintenance

Changes to the application go through a version-controlled code repository and are deployed in a repeatable way.
Software dependencies are updated regularly, in particular when a vulnerability is discovered.
Production Entrusted Data are not used for testing and development.

Organisation

The Service Provider keeps records of Breaches and applies the Breach notification procedure described in § 13.
The security measures are reviewed at least once a year and after every significant Breach or change of Sub-processors.
Before entrusting data to a new supplier, the Service Provider checks its data protection guarantees, its data processing agreement and the basis for transfer.