Data processing terms

1. Parties and scope

AMRAS sp. z o.o., ul. Starowiejska 38B, 55-080 Smolec, Poland; KRS 0001192617, NIP 8961656734; share capital PLN 5,000. Registry court: Sąd Rejonowy dla Wrocławia-Fabrycznej we Wrocławiu, IX Wydział Gospodarczy Krajowego Rejestru Sądowego.

The identified client is controller of entrusted data; AMRAS is processor. A client acting as processor must have authority to appoint a further processor. These terms exclude purposes for which AMRAS is an independent controller, described in the privacy notice.

Processing includes storage, organization, reading, pseudonymization, retrieval, drafting, editing, authorized sharing, export, return and deletion within the service. It lasts for service provision and necessary closure. Data can relate to staff, clients, parties, witnesses and representatives, including identifiers, contact details, case information, documents and metadata. Sensitive, conviction and professionally confidential data require the client to establish the additional legal conditions and suitability of safeguards before upload.

2. Instructions and confidentiality

Documented instructions arise from the agreement, settings and authorized actions. AMRAS acts only within them, including for international transfers, unless law requires otherwise; it informs the client before such processing unless legally prohibited. It flags instructions considered unlawful and may pause the disputed operation pending clarification. It does not use entrusted files for its own advertising, public library or training its own models.

Authorized personnel are bound to confidentiality and task-limited access. Safeguards include encrypted transit, encrypted files and mappings, session and permission checks, workspace separation and operation records without ordinary case-content logging. Information about implemented measures is available on justified request in a manner protecting security.

3. Assistance and incidents

Taking account of processing and available information, AMRAS assists with data-subject rights, security, breach notifications, impact assessments and regulator consultations. It refers requests about entrusted data to the responsible client. It notifies the client of a breach without undue delay, providing available details, possible effects, measures and contact information, followed by updates as findings develop.

4. Subprocessors

The client generally authorizes disclosed providers in their stated roles: Microsoft Azure, Cloudflare and Resend for email. OpenAI or Anthropic receives pseudonymized context only after the separate function is enabled. Contracting-entity, location and safeguard details are available from AMRAS. This is not authority to use arbitrary undisclosed recipients.

AMRAS provides advance notice of additions or replacements, allowing a justified data-protection objection. The parties seek a solution or terminate the affected service with appropriate settlement if none is available. Equivalent protection obligations apply to subprocessors, for whose performance AMRAS is responsible as required by law. International transfers require an appropriate basis and safeguards, irrespective of the server location.

5. Audit, return and deletion

AMRAS provides information demonstrating Article 28 compliance and allows and assists required client or authorized-auditor audits. Proportionate arrangements protect other clients and confidentiality without removing statutory audit rights. No unheld certification is claimed.

On termination, AMRAS returns or deletes data at the client's choice and deletes copies unless legally required to retain them. Scope and timing, including export, shared content and backups, are arranged without undue delay; exceptions require a documented basis and restricted access. Restoring backups must reapply effective deletion instructions. Fulfilment is confirmed on request. Confidentiality and data-subject rights continue after termination.