DATA PROCESSING AGREEMENT FOR BUSINESS USE OF BROWSEWIZ

Effective date: 8 November 2026

1. Parties and Scope

1. This Data Processing Agreement (the DPA) is concluded between the User, as controller, and Tomasz Posłuszny, conducting business activity as DevPeer Tomasz Posłuszny, Kłobucka 8B/249, 02-699 Warsaw, Poland, Tax number: 5213730587, email: contact@browsewiz.com (the Administrator), as processor, under Article 28 GDPR.
2. The DPA is part of the Terms of Use (section X, paragraph 2) for business use. The User accepts it by accepting the Terms; no signature is needed. For a User whose account was created before the DPA was published, the DPA applies as section XI, paragraph 3 of the Terms provides; until then, the Administrator already meets its obligations under section 6, paragraphs 1, 2 and 4, and sections 8 to 14, within the limits of section 16, paragraphs 1 to 3, and section 6, paragraph 3, the User's obligations and sections 16 and 17 apply from that date.
3. The DPA applies to business use only. For private use, the Administrator is the controller of the content the User has the App process, as the Privacy Policy describes (Section 2).
4. Terms such as personal data, processing, controller, processor and personal data breach have the meaning given to them in the GDPR. Other capitalised terms have the meaning given to them in the Terms and the Privacy Policy. Matters the DPA does not cover follow the Terms. Where the DPA and the Terms differ on the processing of personal data in business use, the DPA prevails.
5. Where the User uses the App for an organisation, "the User" in the DPA means that organisation, and the person using the account acts for it. That person confirms, by accepting the Terms, that they are authorised to conclude the DPA for the organisation. If they are not, the validity of the DPA for the organisation depends on its confirmation (Article 103 § 1 of the Polish Civil Code); the Administrator may set it a reasonable time to confirm (Article 103 § 2), and without confirmation the person is liable as Article 103 § 3 provides. Until then, the Administrator processes the content only as the DPA describes. The organisation may name, by email to contact@browsewiz.com, a contact address for notices and instructions under the DPA; notices then also go to that address. Where the person stops acting for the organisation, the organisation may ask by email, with proof that it is the controller of the content, for the content processed for it to be returned or deleted. Refunds under the DPA go to whoever paid the fee.
6. The sections of the Privacy Policy that the DPA refers to are part of the DPA as far as they concern business use. They describe the processing for the purposes of Article 28(3) GDPR; their statements about third parties' practices describe those parties' terms and are not the Administrator's undertaking; this does not limit section 10, paragraph 3, or the Administrator's own settings described there. A change to them that describes a new or changed App function applies to business use when the User uses that function, which is the User's instruction under section 6. A new sub-processor follows section 10. A change that sends content to a new kind of recipient, keeps it longer or backs up a new kind of content by default is a change to the DPA under section 15, as is any other change to them that reduces the User's rights or the Administrator's obligations. Where the DPA and the Privacy Policy differ on business use, the DPA prevails.

2. Business Use

1. Business use means the use of the App by or for:
   • a company, partnership, foundation, association, public body or other organisation,
   • a natural person acting in their trade, business or profession, including a sole trader, whether or not the use is of a professional nature for them within the meaning of section I.4 of the Terms.
2. This definition decides when the DPA applies. The parties' roles follow from the GDPR and the facts: in business use, the User decides why and how the content is processed, and the Administrator processes it for the User. The definition does not limit the rights that a sole trader has under Article 385⁵ of the Polish Civil Code or Article 7aa of the Polish Act on Consumer Rights.
3. The Administrator does not see whether content is processed for business use. Where it needs to know, as in section 6, paragraph 3 and Section 7, item 6 of the Privacy Policy, it asks the User.

3. Subject, Duration, Nature and Purpose of the Processing

1. Subject: the content the User has the App process for business use, listed in Section 4, item 7 of the Privacy Policy: messages; pages, files, images and screenshots attached to them; text the browser agent reads or types on pages; the names and sizes of the files the browser agent downloads; Google Sheets and Google Calendar data the tools read or write; voice recordings and text read aloud. It includes the backup of that content (Privacy Policy, Section 7), the User's other backed-up items (prompts, scheduled tasks, monitors, settings, custom models, custom tools and MCP servers, including data kept from earlier versions of the App), and the email alerts made from that content (Privacy Policy, Section 4, item 10). It does not include data that the User's browser sends directly to a provider the User chose, such as a model used with the User's own API key, a custom model, a custom tool or an MCP server, or that BrowseWiz gives to a program the User connects on their computer (Privacy Policy, Section 6, item 3, and Section 10, item 6). That provider or program processes it under the User's own agreement with it.
2. Nature: passing the content through the Administrator's server to the AI providers that generate answers, chat titles, transcriptions and speech, that check the browser agent's planned actions for safety and that judge whether a scheduled task run did its task; storing the backup in the Administrator's cloud storage and restoring it on the User's devices; sending the email alerts the User turns on; deleting the content.
3. Purpose: providing the App's functions to the User, as described in Sections 7, 10 and 11 of the Privacy Policy.
4. Duration: for as long as the User uses the App for business use, and after that until the content is deleted as described in section 12. The DPA ends when the account is deleted, or when the User tells the Administrator by email that it no longer uses the App for business use; it continues to apply to content processed for business use until that content is deleted.

4. Types of Personal Data and Categories of Data Subjects

1. Types of personal data: whatever personal data the content contains, in particular names, contact details, identifiers, data about work and business relations, correspondence, and other data shown on the pages, in the files, spreadsheets and calendars the User has the App process. Where the User puts them in the content, it may also contain special categories of personal data and data on criminal convictions and offences, which the User may put in only where it has a condition under Article 9 or 10 GDPR (section 5, paragraph 1) and within section IV.1 of the Terms.
2. Categories of data subjects: the User; the User's staff and collaborators; the User's clients, leads, suppliers and other contacts; and other people whose data appears in the content.

5. The User's Obligations and Rights

1. The User, as controller:
   • has a legal basis under the GDPR for the processing of the content it has the App process, and a condition under Article 9 or 10 GDPR for special categories of personal data and data on criminal convictions and offences,
   • informs data subjects of the processing where the GDPR requires it,
   • gives only instructions that comply with the law,
   • handles the requests of data subjects concerning the content within the time limits in Article 12(3) GDPR,
   • has a legal basis for the content that reaches the Administrator as a controller for the purposes in section 7, and informs data subjects of it where the GDPR requires it. The User decides whether to share conversations when rating a response (Options → Settings → Privacy) and may object to the use of its records of approved actions described in Section 3, item 11 of the Privacy Policy.
2. The User has the right to give instructions (section 6), to receive the information and assistance described in sections 11 and 14, to object to new sub-processors (section 10), and to have the content returned or deleted (section 12).

6. Instructions

1. The Administrator processes the content only on the User's documented instructions, including with regard to transfers of personal data to a third country or an international organisation, unless EU or Member State law to which the Administrator is subject requires otherwise; in that case, the Administrator informs the User of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

2. The User's instructions are its use of the App and its switches and settings: the messages it sends and the tasks it gives, the tools, models, scheduled tasks and page monitors it turns on, the backup switches in Options → Settings → Backup & Sync, the email alerts it turns on, and the deletion of items, data or the account. By using the App for business use, the User also instructs the Administrator to send content to the AI providers in Annex 2 under their terms, including their keeping of requests for abuse monitoring as Section 10, item 5 of the Privacy Policy describes. Further instructions can be sent by email to contact@browsewiz.com. They must be within the App's functions. If the Administrator cannot follow one, it tells the User without undue delay, and the User may stop the affected processing or end the contract for the App with immediate effect, with a refund of the fee for the rest of the current billing period.

3. By accepting the DPA, the User also instructs the Administrator to handle requests and notices from people whose data is in the User's content as Section 7, item 6 of the Privacy Policy describes:

   • to search the content for the details given and have a person read what is found, and to tell the User, within 5 working days of receiving the request or the further information it asked for, which content contains them and what is asked, except where Section 7, item 6 of the Privacy Policy allows it not to tell the User before deciding;

   • when the User says the content was processed for business use, to give the User the requester's contact details where needed, and not where the requester asks it not to and the request can be handled without them, and, after checking the requester's identity, to give the requester the name and contact email of the User, or of the organisation it acts for, as the controller;

   • to decide a notice of illegal content as hosting provider under Articles 16 and 17 of the Digital Services Act, and to delete the content it finds illegal;

   • to delete content that the Administrator finds, after a review by a person, breaches section IV.1 of the Terms, with a statement of reasons under Article 17 of the Digital Services Act;

   • to act on a request under the GDPR only on the User's instruction, except that:

     • if the User does not answer within 10 days of the Administrator's message although the Administrator sent a reminder after 5 days, the User instructs the Administrator, after checking the requester's identity, to give the requester a copy of their own personal data found, with the information Article 15 GDPR requires about the processing in the App, or, for a request for erasure or an objection, to delete the backed-up items that contain those details, leaving out of any copy content whose disclosure would adversely affect the rights and freedoms of others (Article 15(4) GDPR);
     • if the User says the content was processed for business use but has, by the later of the 25th day after the Administrator received the request and the 7th day after the Administrator's message to the User, told the Administrator neither that it has answered the requester nor that it has extended the time limit or refused the request under Article 12(3) or (4) GDPR, the User instructs the Administrator, after checking the requester's identity, to give the requester the controller's name and contact email and a copy of their own personal data found, with information about the processing in the App only, leaving out content whose disclosure would adversely affect the rights and freedoms of others (Article 15(4) GDPR).

     Both cases follow Section 7, item 6 of the Privacy Policy.

   The User may give a different instruction at any time before the Administrator acts on a request under the GDPR. A deletion removes the backed-up copies only, as Section 7, item 6 of the Privacy Policy describes.

4. The Administrator informs the User immediately if, in its opinion, an instruction infringes the GDPR or other EU or Member State data protection provisions.

7. Where the Administrator Remains the Controller

1. The Administrator remains the controller, and does not act on the User's instructions, for:
   • account, billing and statistics data (Privacy Policy, Section 3, items 1, 3 as regards account data, 4 and 10), on the bases given there: the contract (Article 6(1)(b) GDPR), legal obligations (Article 6(1)(c) GDPR), its legitimate interest in improving the App (Article 6(1)(f) GDPR) and, for statistics linked to the account, the User's consent (Article 6(1)(a) GDPR),
   • conversations and comments the User shares with a response rating (Privacy Policy, Section 3, item 6), on the basis of the consent of the person who shares them (Article 6(1)(a) GDPR) and, for other people's data in them, including the data of the User's clients and contacts, its legitimate interest in improving the App (Article 6(1)(f) GDPR),
   • the records of approved actions (Privacy Policy, Section 3, items 8 and 11, and Section 4, item 8), on the basis of its legitimate interest (Article 6(1)(f) GDPR),
   • the prevention of abuse and the investigation of a specific security incident or breach of the Terms (Privacy Policy, Section 3, item 9), on the basis of its legitimate interest (Article 6(1)(f) GDPR) and, where the law requires disclosure, a legal obligation (Article 6(1)(c) GDPR),
   • the record of requests and notices about the content and of the decisions on them, kept for 3 years (Privacy Policy, Section 3, item 12, and Section 5, item 7), on the bases given there; the record holds the request, the decision and a description of the content concerned, not a copy of it.
2. For these purposes the Administrator is a controller in its own right, not the User's processor.
3. AI providers may keep requests for their own abuse monitoring under their own terms, as described in Section 10, item 5 of the Privacy Policy (for Anthropic, up to 2 years for requests its safety systems flag). Where a provider does so as a controller, the content reaches it as a disclosure for which the User, as controller, needs its own legal basis (section 5, paragraph 1).

8. Confidentiality

1. The Administrator ensures that the persons it authorises to process the content have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
2. No person reads the content, except in the cases described in Section 1 of the Privacy Policy, including when the User asks the Administrator to read a conversation, and in the procedure in section 6, paragraph 3.

9. Security

1. The Administrator takes the measures required by Article 32 GDPR. Annex 1 lists the measures in place.

10. Sub-processors

1. The User gives the Administrator general authorisation to engage sub-processors. The sub-processors that receive content are listed in Annex 2.
2. The Administrator informs the User by email, at the address of the User's account, at least 30 days before a new sub-processor receives content. The User may object by email to contact@browsewiz.com within that time. If the objection is not resolved, the User may end the contract for the App with immediate effect, at no cost, and the Administrator refunds the fee for the rest of the current billing period from that day.
3. Each sub-processor is bound by data processing terms that impose on it the data protection obligations Article 28(4) GDPR requires, in particular sufficient guarantees of appropriate technical and organisational measures: in the Administrator's contract with it or, for TypeSafe and the companies OpenRouter passes requests to, in OpenRouter's contracts with them. The Administrator is liable to the User for a sub-processor's performance of its obligations as for its own, within the limits in section 16.
4. Transfers of personal data outside the European Economic Area rest on the grounds described in Section 6, item 5 of the Privacy Policy: the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise the standard contractual clauses adopted by the European Commission (Decision (EU) 2021/914) included in the recipient's data processing terms.

11. Assistance

1. Taking into account the nature of the processing, the Administrator assists the User by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects to exercise their rights under Chapter III GDPR. The App lets the User export its data ("Export my data"), delete items and backed-up data, and request the deletion of the account. The Administrator informs the User, without undue delay, of any request it receives from a data subject about the content, as section 6, paragraph 3 describes.
2. Taking into account the nature of the processing and the information available to it, the Administrator assists the User in ensuring compliance with Articles 32 to 36 GDPR: security, notification of personal data breaches, data protection impact assessments and prior consultation with the supervisory authority.

12. Duration of Storage and Deletion

1. The content is kept as follows:
   • Content sent to AI providers (Privacy Policy, Section 10): the Administrator's server passes it on to generate the answer and does not store it. According to each provider's terms at the effective date of the DPA, Anthropic deletes requests within 30 days, unless it needs them longer to enforce its usage policy (up to 2 years for requests its safety systems flag) or the law requires it; Google keeps Gemini requests to detect misuse for up to 55 days, as its Gemini API usage policies state; OpenAI may keep requests for up to 30 days to detect misuse; requests through OpenRouter, including those to TypeSafe, use OpenRouter's setting that excludes providers which, according to OpenRouter, keep the data they receive after answering or use it for training. The Administrator does not warrant third parties' compliance with their own terms beyond its liability under section 10, paragraph 3.
   • Backed-up content (Privacy Policy, Section 7, item 4): until the User deletes the item, turns backup off (which deletes the backed-up copies of that kind) or deletes the account. Backed-up chats are also deleted automatically 12 months after their last change (deletion may take a few days after that date), and only the User's 100 most recent chats are kept. Deleting a chat removes its backed-up copy; a copy stays on the User's devices and is backed up again if the User changes it, turns chat backup back on or signs in on a device that still holds it. When the User deletes an item other than a chat, a record of its identifier and deletion time is kept for 90 days.
   • Email alerts (Privacy Policy, Section 4, item 10): the Administrator's server uses them only to create the email and does not store their content.
   • Server logs (Privacy Policy, Section 5, item 5) do not contain the content and are kept for up to 30 days.
   • Records relevant to a complaint or claim are kept until it is resolved (Privacy Policy, Section 5, item 6), and records of requests and notices for 3 years (section 7).
2. When the DPA ends, the User chooses whether the content is returned or deleted. The User can download it with "Export my data" in the App's Options → Account, or ask the Administrator by email for a copy. The User can delete the backed-up content at any time by turning backup off in Options → Settings → Backup & Sync, which deletes the cloud copies. On a request by email, also while a subscription runs, the Administrator deletes the backed-up content within 30 days and confirms the deletion by email; after a request to delete the account, it deletes it as Section 8 of the Privacy Policy describes. This does not apply where EU or Member State law requires the storage of the personal data. Content processed for business use that the User keeps in the account after the DPA ends remains covered by the DPA until it is deleted (section 3, paragraph 4).

13. Personal Data Breaches

1. The Administrator notifies the User of a personal data breach affecting the content without undue delay and, where feasible, within 48 hours of becoming aware of it, by email to the address of the User's account. The notice describes, as far as is then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed, and a contact point. Information not yet available is provided in phases without undue further delay.

14. Audits and Inspections

1. The Administrator makes available to the User all information necessary to demonstrate compliance with Article 28 GDPR, and answers the User's reasonable written questions about the processing within a reasonable time.
2. The Administrator allows for and contributes to audits, including inspections, conducted by the User or another auditor the User mandates, bound by confidentiality and not a competitor of the Administrator. The User gives at least 30 days' notice of an audit, and an audit does not give access to other Users' data. An audit takes place first by written questions and documentation; an inspection takes place only where the User reasonably considers these insufficient to demonstrate compliance, during business hours. Such audits take place no more than once a year, unless a personal data breach or a supervisory authority requires otherwise. The User bears the costs of an audit, including the Administrator's reasonable costs, unless the audit reveals a material breach of the DPA by the Administrator.

15. Changes to the DPA

1. The Administrator informs the User of changes to the DPA by email, at least 30 days before they apply. A User who uses the App for business use may object to the changes and, before they apply, end the contract for the App with immediate effect, at no cost; the Administrator then refunds the fee for the rest of the current billing period from that day.

16. Liability

1. Each party's total liability to the other under the DPA, including the Administrator's liability for its sub-processors, is limited to the greater of the fees the User paid for the App in the 12 months before the event that caused the damage and EUR 250. This limit also applies to the Administrator's liability for sub-processors under section 10, paragraph 3 and Article 28(4) GDPR, and, as far as the law allows, to the Administrator's liability to the User under Article 82(5) GDPR. Section VIII, paragraph 1 of the Terms does not apply to claims under the DPA; the Administrator's liability under the DPA and the Terms is together limited to the higher of the limit in this paragraph and the limit in section VIII, paragraph 1 of the Terms.
2. Neither party is liable to the other under the DPA for lost profits or indirect damage.
3. Paragraphs 1 and 2 do not apply to damage caused intentionally, or where the law does not allow such a limitation. They also do not apply to the User's liability for a breach of its duties as controller (section 5) or of section IV.1 of the Terms, including what the Administrator pays to data subjects because of such a breach (Article 82(5) GDPR), reasonable costs of defence and legal advice and, as far as the law allows, administrative fines imposed on the Administrator because of it. The User notifies the Administrator without undue delay of any claim or proceedings concerning the processing and lets it take part in the defence.
4. The DPA does not limit the rights of data subjects under Article 82 GDPR, or the rights of a sole trader under Article 385⁵ of the Polish Civil Code.

17. Governing Law and Courts

1. The DPA is governed by Polish law.
2. Disputes under the DPA with a User who is not a consumer, and to whom Article 385⁵ of the Polish Civil Code does not apply, are decided by the common court competent for the Administrator's place of business in Warsaw.
3. The DPA is published in Polish and English. The Polish version prevails.

Annex 1: Security Measures

This Annex describes the measures in place at the effective date of the DPA. The Administrator may change them, provided the overall level of security is not reduced.

1. Data in transit. The App connects to the Administrator's servers only over HTTPS, and the servers send requests to the AI providers over HTTPS.
2. Data at rest. The content is stored on Amazon Web Services (AWS) in the US East (N. Virginia) region. Amazon DynamoDB tables and Amazon S3 objects are encrypted at rest by AWS by default, with keys AWS manages. This is not end-to-end encryption: the Administrator's systems can read the content in order to provide the App.
3. Access control. Every request for a User's data through the App's API needs a sign-in token issued by Amazon Cognito, which handles passwords and sign-in. Backed-up chats are stored under the User's account identifier, and the server returns to a signed-in User only that account's own data. The Administrator's own access to the stored data, outside the App's API, goes through its AWS account and AWS's access controls.
4. Data kept on the device. API keys, the values of request headers marked as secret and MCP server authorization headers are never uploaded; they stay on the device where the User entered them.
5. Minimisation. The browser agent leaves out the values of fields the page marks as password, one-time-code or payment-card fields when it reads a page and in the records of approved actions. Requests through OpenRouter exclude providers which, according to OpenRouter, keep the data they receive after answering or use it for training.
6. Abuse limits. The server limits the number of requests per IP address, and per user for read-aloud and the browser agent's safety check.
7. Personnel. No person reads the content, except in the cases in section 8, paragraph 2.
8. Automatic deletion. Backed-up chats are deleted 12 months after their last change, records of approved actions 90 days after they are made, and server logs after up to 30 days.
9. Secure development. In the Administrator's standard development process, commits and pull requests are scanned for secrets; a critical vulnerability in a shipped dependency fails the build; dependency updates are proposed monthly and reviewed by a person; and new code in pull requests is checked by static analysis.
10. Infrastructure. The physical and infrastructure security of the data centres is provided by AWS, as described in AWS's compliance reports.

Annex 2: Sub-processors

The processors among the recipients in Section 6, item 4 of the Privacy Policy that receive content:

When the User chooses a model reached through OpenRouter, the choice is the User's instruction to use the companies that OpenRouter lists as hosting that model at https://openrouter.ai/providers, with their locations and data policies. OpenRouter chooses among them for each request, so section 10, paragraph 2 does not apply to them. OpenRouter binds the companies it passes requests to by written contract, as Section 6, item 5 of the Privacy Policy describes.

The sub-processors' data processing terms: AWS, Anthropic, Google, OpenAI, OpenRouter.

On request by email to contact@browsewiz.com, the Administrator gives the User each sub-processor's address and contact point for data protection, and the list of that sub-processor's own sub-processors or where it publishes it.

The Google Sheets and Google Calendar tools call Google from the User's browser, under the User's own Google account, so Google does not receive content from the Administrator for them.