← Home

Data Processing Agreement — Librent

Version: 1.0.2-2026-11-01 · Effective date: 1 November 2026

Translation notice. This English translation is provided for information only and is pending legal review. The Polish version is the binding version and prevails in the event of any discrepancy.

This Data Processing Agreement (hereinafter the "Agreement") is concluded in electronic form (Art. 28(9) GDPR) between:

  1. the User — the entity conducting business on whose behalf an Organisation was created in the Librent service, represented by the person accepting the Agreement (hereinafter the "Controller"), and
  2. DydlakCloud Dawid Dydliński, conducting business in the form of Indywidualna działalność gospodarcza (CEIDG), NIP (Tax ID) 6423227346, REGON (Statistical No.) 387752266, with its registered address at ul. Zebrzydowicka 12 lok. 5, 44-200 Rybnik, the operator of the Librent service (hereinafter the "Processor").

The Agreement implements Art. 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter the "GDPR") and supplements the Terms of Service. Capitalised terms not defined in the Agreement have the meaning given to them in the Terms of Service.

§ 1. Conclusion of the Agreement and authority

  1. The Agreement forms part of the agreement for the provision of services concluded under the Terms of Service and binds the parties from the moment the Terms of Service are accepted. The owner of the Organisation confirms it in the Service by accepting the Agreement and providing the Controller's details (name, address, email address for personal data matters).
  2. The person accepting the Agreement represents that they are authorised to conclude it on behalf of the Controller. The Processor records the date of acceptance, the version of the Agreement and the Account from which it was accepted.
  3. The Agreement is concluded separately for each Organisation. Members of the Organisation invited by the Controller act in its name and on its behalf and are not parties to the Agreement.

§ 2. Subject matter, nature and purpose of processing

  1. The Controller entrusts the Processor with the processing of personal data entered into the Service within the Organisation — by the Controller itself and the members of its Organisation, or directly by the Controller's clients through the public features of the Service (hereinafter the "Data").
  2. Purpose of processing: providing the services of the Service to the Controller, in particular managing equipment, clients, bookings, deposits and payments, generating and signing documents, sending notifications, operating the public booking form and widget, communicating with clients (including via WhatsApp and the AI assistant, if the Controller enables them) and the calendar.
  3. Nature of processing: collection, recording, organisation, structuring, storage, encryption, adaptation, retrieval, consultation, use, disclosure by transmission (including email and WhatsApp messages to persons indicated by the Controller), making backups, erasure and destruction.
  4. Categories of data subjects: clients and prospective clients of the Controller (including contact persons of business clients), persons corresponding with the Controller through the features of the Service, members of the Organisation and persons invited to the Organisation.
  5. Types of Data:
    • identification data: first name, last name, company name, NIP or other tax identification number, series and number of the identity document;
    • contact data: email address, telephone number, address (street, postal code, city, country), language of communication;
    • booking and billing data: rented equipment, dates, prices, deposits, statuses, notes;
    • the content of generated and signed documents (agreements, handover reports), together with the date and method of signing;
    • the content of correspondence conducted through the Service (including WhatsApp messages and conversations with the AI assistant) and the sender's telephone number;
    • data of members of the Organisation: first name, last name, email address, role, history of actions in the Organisation.
  6. The Agreement does not cover special categories of data (Art. 9 GDPR) or data relating to criminal convictions (Art. 10 GDPR). The Controller undertakes not to enter such data into the Service.
  7. The scope of Data in each case depends on the fields and features the Controller uses. The Controller is responsible for ensuring that the Data collected is adequate and limited to what is necessary (Art. 5(1)(c) GDPR), including for the decision to collect the identity document number.

§ 3. Documented instructions

  1. The Processor processes the Data only on documented instructions from the Controller, including with regard to transfers of Data to a third country, unless required to do so by Union law or Polish law — in such a case, it informs the Controller of that legal requirement before processing, unless that law prohibits this.
  2. The following constitute documented instructions: this Agreement, the Terms of Service, the configuration of the Organisation (including enabling features such as the public booking form, WhatsApp, the AI assistant, email notifications and calendar export) and actions performed in the Service by the Controller and the members of its Organisation. The Controller sends other instructions to [email protected].
  3. The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions.
  4. The Processor does not use the Data for its own purposes; in particular, it does not sell it or use it for marketing or to train artificial intelligence models. The Processor may process aggregated or anonymised data that is not personal data in order to maintain and develop the Service.

§ 4. Confidentiality and access to Data

  1. The Processor allows access to the Data only to persons who are authorised by it and have committed themselves to confidentiality or are under a statutory obligation of confidentiality. This obligation continues after the cooperation ends.
  2. Persons acting on behalf of the Processor have access to the Data only to the extent necessary to maintain and secure the Service, fix failures, carry out the Controller's instructions or handle technical support requests, or where required by law.

§ 5. Security of processing

  1. The Processor applies the technical and organisational measures referred to in Art. 32 GDPR, described in Annex 1. These measures may be changed, provided that this does not reduce the overall level of protection of the Data.
  2. The Controller is responsible for security on its side, in particular for granting and revoking access for members of the Organisation, the confidentiality of login details, enabling two-factor authentication, the security of devices and of Data downloaded from the Service (e.g. generated documents, calendar export).

§ 6. Further entrustment (sub-processors)

  1. The Controller gives general authorisation for further entrustment of the processing of Data to the entities listed in Annex 2 (hereinafter "Sub-processors").
  2. The Processor informs the Controller of any intended addition or replacement of a Sub-processor by email or by a notice in the Service at least 14 days before the change. Within this period, the Controller may raise a justified objection. If the parties do not agree on a solution, the Controller may terminate the Agreement and the Terms of Service with effect from the date of the change, without additional costs.
  3. The Processor concludes agreements with Sub-processors imposing on them data protection obligations at least equivalent to those in the Agreement and is liable to the Controller for their performance.
  4. Features that the Controller enables itself and that involve the use of third-party services under separate agreements concluded by the Controller (in particular the WhatsApp messenger linked to the Controller's telephone number or an external calendar subscribing to the calendar export) do not constitute further entrustment by the Processor. The Controller assesses for itself whether its use of such services complies with the GDPR.

§ 7. Transfers of Data outside the EEA

  1. The Service's database and file storage are located on servers in the European Economic Area (Poland). Data may be processed outside the EEA only by Sub-processors and to the extent set out in Annex 2.
  2. Data may be transferred to a third country only to a Sub-processor listed in Annex 2 and only using a mechanism under Chapter V GDPR, in particular an adequacy decision (including the EU–US Data Privacy Framework for certified recipients) or standard contractual clauses adopted by the European Commission.

§ 8. Assistance with the rights of data subjects

  1. Taking into account the nature of the processing, the Processor assists the Controller in fulfilling its obligation to respond to requests from data subjects (Art. 12–22 GDPR), primarily by providing features in the Service for viewing, correcting and deleting Data, and otherwise by carrying out requests sent to [email protected] (e.g. exporting a person's data or deleting their data from conversation history and the activity log).
  2. If a request from a data subject is received directly by the Processor, it forwards the request to the Controller without undue delay, and no later than within 7 days, and does not respond to it itself unless the Controller authorises it to do so.
  3. Where a request cannot be fulfilled using the features of the Service, the Processor, at the Controller's request, fulfils it within a period that allows the Controller to meet the deadline under Art. 12(3) GDPR.

§ 9. Personal data breaches

  1. The Processor notifies the Controller of a personal data breach concerning the Data without undue delay, and no later than within 36 hours of discovering it, to the email address of the owner of the Organisation.
  2. The notification contains, as far as available, the information listed in Art. 33(3) GDPR: the nature of the breach, the categories and approximate number of data subjects and records, contact details, the likely consequences and the measures taken or proposed. Information not available at the time of notification is provided in phases.
  3. The Processor promptly takes action to mitigate the effects of the breach, documents it and cooperates with the Controller in notifying the supervisory authority and communicating the breach to data subjects.
  4. Notification of a breach does not constitute an admission of liability by the Processor.

§ 10. Other assistance to the Controller

Taking into account the nature of processing and the information available, the Processor assists the Controller in fulfilling its obligations under Art. 32–36 GDPR, including with data protection impact assessments and prior consultations with the supervisory authority. Assistance going beyond providing information about the Service may be subject to separate remuneration agreed in advance.

§ 11. Audit and information

  1. The Processor makes available to the Controller the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, primarily in the form of written answers to questions and documentation.
  2. If the information provided is insufficient, the Controller may carry out an audit, including an inspection, itself or through an auditor bound by confidentiality who is not a competitor of the Processor. An audit takes place no more than once every 12 months — unless justified by an identified personal data breach or a request of the supervisory authority — with at least 14 days' prior notice, on working days and in a manner that does not disrupt the operation of the Service or compromise the data of other users.
  3. The costs of the audit are borne by the Controller, unless the audit reveals a material breach of the Agreement by the Processor.

§ 12. Duration and end of processing

  1. The Agreement remains in force for as long as the Service is used within the Organisation and expires when the Organisation is deleted or the Terms of Service are terminated with respect to the Controller.
  2. Before the Organisation is deleted, the Controller may request the return of the Data by sending a request to [email protected]. The Processor provides the Data within 30 days, in a commonly used electronic format (e.g. CSV or JSON, plus the document files).
  3. Within 30 days of the end of the Agreement, the Processor deletes the Data from production systems. Backups containing the Data are deleted as part of the rotation cycle, no later than 30 days after the Data is deleted from production systems; until then, they are protected and are not used for any purpose other than restoring the Service after a failure.
  4. The preceding sentence does not apply to Data whose storage is required by Union law or Polish law.

§ 13. Liability

  1. Each party is liable for damage caused to data subjects on the terms set out in Art. 82 GDPR.
  2. The Processor is not liable for the consequences of carrying out the Controller's instructions or for Data entered into the Service without a legal basis or in breach of the information obligation.
  3. In all other respects, the provisions of the Terms of Service apply to the liability of the parties, provided that limitations of liability do not apply to damage caused intentionally.

§ 14. Final provisions

  1. The Agreement is free of charge; remuneration for the services of the Service is set out in the Terms of Service.
  2. In the event of a conflict between the Agreement and the Terms of Service with regard to personal data protection, the Agreement prevails.
  3. Amendments to the Agreement are made under the procedure for amending the Terms of Service. Amendments resulting solely from an update of Annex 2 are made under the procedure in § 6(2).
  4. The Agreement is governed by Polish law. The Polish version is binding; translations are for information only.

Annex 1. Technical and organisational measures

Annex 2. List of Sub-processors