General Terms of Agreement (Terms of Service)

Trial period

20 days free

Card at registration

Not required

Cancellation

At any time

Data export

Free of charge

Withdrawal (consumers)

14 days

Contact

kontakt@bakepilot.pl

§ 1. General provisions

The Service Provider is Patryk Kowalski, conducting business under the name KamikStudio Patryk Kowalski, entered in the Central Register and Information on Economic Activity (Centralna Ewidencja i Informacja o Działalności Gospodarczej, CEIDG) maintained by the minister responsible for the economy:

• Place of residence and address entered in CEIDG: ul. Rodzinna 1/39, 62-800 Kalisz, Poland
• Office address, for correspondence and complaints: ul. Fabryczna 1, 62-800 Kalisz, Poland
• NIP (Polish tax identification number): 6182187584
• REGON (Polish statistical number): 387776597
• E-mail: kontakt@bakepilot.pl
• Phone: +48 519 109 063 (also WhatsApp)
• Bank account: PL71 1090 1128 0000 0001 4736 3396 (Santander Bank Polska S.A., SWIFT: WBKPPLPP)

Please send postal correspondence, complaints and statements to the office address.

These Terms are terms and conditions within the meaning of Article 8 of the Act of 18 July 2002 on the Provision of Electronic Services (ustawa o świadczeniu usług drogą elektroniczną) and constitute General Terms of Agreement within the meaning of Article 384 of the Polish Civil Code (Kodeks cywilny). The Polish version of the Terms is binding.

The single point of contact of the Service Provider for the authorities of the Member States of the European Union, the European Commission and the European Board for Digital Services (Article 11 of Regulation (EU) 2022/2065, the “Digital Services Act”) and for Customers and other persons using BakePilot services (Article 12 of that Regulation) is the e-mail address kontakt@bakepilot.pl. Contact is also possible by phone at the number given above, on business days from 9:00 to 17:00 (Polish time); the conversation is handled by a human, not a machine. The point of contact can be reached in Polish and English. Information on the obligations under the Digital Services Act is collected on the page bakepilot.com/dsa.

Messages sent automatically from noreply@mail.bakepilot.pl are not used for correspondence. A reply to such a message is delivered to kontakt@bakepilot.pl.

§ 2. Definitions

• Application - the BakePilot SaaS system available at app.bakepilot.pl and as a mobile application for Android (Google Play); the mobile application provides the same Service and is subject to these Terms.
• Consumer - a natural person performing a legal transaction with the Service Provider that is not directly related to their business or professional activity (Article 22¹ of the Civil Code), in particular a person who creates an Account with the “I don't have a company” option and does not conduct business activity.
• Account - the Organization's account in the Application, secured with an e-mail address and a password.
• License Key - a unique identifier of the Account confirming an active subscription.
• Trial Period - free, full access to the Application for 20 days from registration, without having to provide payment details.
• Subscription Period - the period for which access has been purchased: one month or one year.
• Fee - the remuneration due to the Service Provider for a given Subscription Period.
• Organization - the entity (pastry shop, bakery) represented by the Customer in the Application.
• Plan - a subscription variant: Podstawowy (Starter), Profesjonalny (Professional) or Mistrzowski (Master).
• Entrepreneur with Consumer Rights - a natural person concluding an Agreement directly related to their business activity, where the content of the Agreement shows that it is not of a professional nature for that person (Article 7aa of the Consumer Rights Act (ustawa o prawach konsumenta)).
• Agreement - the agreement for the provision of the Service concluded on the terms of these Terms.
• Customer - a natural person, legal person or organizational unit using the Application.
• Owner - the person indicated in the Account as its owner (as a rule, the person who created the Account), who alone manages the Account in matters of the Agreement: the subscription, the export of all data and the deletion of the Account.

§ 3. Technical requirements and rules of use

To use the Application you need: an Internet connection, an up-to-date browser (Chrome/Firefox/Safari/Edge) or the BakePilot mobile application on an Android device, an active e-mail address and cookies and JavaScript enabled.

It is prohibited to: provide unlawful content, reverse engineer the Application, resell access to third parties, and download data in bulk using bots and scrapers. The Customer is responsible for keeping their login details confidential and undertakes to provide true data necessary to issue invoices.

§ 4. Conclusion of the Agreement and registration

The Agreement is concluded upon registration of the Account and acceptance of the Terms. Registration requires an e-mail address, a password, a phone number and the name of the Organization. An entrepreneur provides a NIP. A person who does not conduct business activity selects the “I don't have a company” option; such an Account is verified by the Service Provider before access is granted. After registration the Customer receives a 20-day Trial Period - full access without having to provide a payment card. The Trial Period does not automatically turn into a paid Subscription.

After the Trial Period ends, using the Application requires purchasing a Subscription. The Subscription is concluded for a Subscription Period and renews automatically unless the Customer terminates it. As a rule, one NIP corresponds to one Account; the Service Provider may agree to more Accounts for one NIP.

§ 5. Fees and settlements

Plan prices are given as net amounts, to which 23% VAT is added. For Consumers and Entrepreneurs with Consumer Rights, the gross price (including VAT) given in § 6 is binding. The Fee is charged in advance for the selected Subscription Period through the payment operator Stripe. The Service Provider does not store payment card data. An annual subscription comes with a 20% discount compared to the monthly price.

The Service Provider issues a VAT invoice for each Subscription Period, delivered electronically (e-mail). For entities registered as VAT payers, the invoice is sent to the National e-Invoicing System (Krajowy System e-Faktur, KSeF). The KSeF number is shown on the invoice and in the e-mail confirming the purchase.

§ 6. Subscription Plans

Available Plans (net prices, gross prices including 23% VAT in brackets):

• Podstawowy (Starter) - 98 PLN/month (120.54 PLN gross) or 936 PLN/year (1,151.28 PLN gross): orders (with export/import), products (with PDF menu and allergens), retail customers, calendar, order Kanban, ingredients (basic), notes.
• Profesjonalny (Professional) - 189 PLN/month (232.47 PLN gross) or 1,812 PLN/year (2,228.76 PLN gross): everything in Podstawowy + B2B orders, deliveries with route optimization, B2B customers and CRM, recipe calculator, full ingredient database (price history, nutritional values, suppliers), sales reports, inventory (stock levels and usage), task Kanban, price quotes, analytics.
• Mistrzowski (Master) - 319 PLN/month (392.37 PLN gross) or 3,060 PLN/year (3,763.80 PLN gross): everything in Profesjonalny + cake configurator, automatic allergens from the recipe, advanced inventory (FIFO/FEFO expiry dates, stocktaking, purchase planner), production list, agreements and contracts, HACCP (GHP/GMP, temperature log, forms), invoices with KSeF integration, priority support, dedicated training.

A detailed description of the modules available in each Plan is published in the price list on the bakepilot.pl website. The Service Provider reserves the right to change the Price List with 30 days' notice - the change does not affect Subscription Periods already paid for. A Plan upgrade is possible at any time; a downgrade takes effect from the beginning of the next Subscription Period.

§ 7. License Key

Upon registration the Customer receives a unique License Key assigned to the Account and the Organization, confirming an active subscription. The Key is visible in the Account settings. It may not be transferred or shared with third parties. After the subscription expires, access to paid features is suspended; the Key is reactivated when the subscription is renewed.

§ 8. Termination and end of the Agreement

The Customer may terminate the Agreement at any time with effect at the end of the current Subscription Period - in the Account settings (the “Manage subscription” section) or by e-mail to kontakt@bakepilot.pl. Termination does not entitle the Customer to a refund of a proportional part of the Fee (subject to the right of withdrawal - § 11 - and § 6(3) of Annex No. 1).

The Service Provider may terminate the Agreement with immediate effect in the event of a gross breach of the Terms, after an unsuccessful request to cease the breach, if such a request is possible.

After the Trial Period ends without a purchase, or after the Subscription expires, the Account switches to restricted mode: the Application's features are unavailable, but the Owner still has access to Settings, including ordering a full data export (§ 12) and deleting the Account. The Organization's data remains in the Application for 6 months from the moment the Account switches to restricted mode. After that time the Service Provider deletes the Account, the Organization and its data in the same way as when the Owner deletes the Account, and the Agreement expires. The Service Provider informs the Owner of the planned deletion by e-mail at least 30 days and again 7 days in advance. Purchasing a Subscription before that date restores full access and stops the deletion. The Owner may also delete the Account earlier or request deletion by e-mail to kontakt@bakepilot.pl. For Accounts that were in restricted mode before 2 November 2026, the 6-month period is counted from 2 November 2026.

Deleting the Account in Settings (the “Delete account and data” option, available to the Owner) takes effect immediately and is irreversible: it deletes the Account, the Organization and all of its data, including prepared export files. A Customer who is required by law to keep documents (e.g. invoices, employee working time records, HACCP documentation) should order a full data export and download the file before deleting the Account. Invoices sent to KSeF remain available in KSeF.

After the Account is deleted (by the Owner or after 6 months in restricted mode), the Service Provider retains only the Customer's registration and billing data: the Owner's first and last name, e-mail address, phone number, company name, NIP, address, the dates of conclusion and termination of the Agreement, and the history of Subscriptions and payments. The Service Provider keeps this data until the limitation period for claims under the Agreement expires, counted from its termination (Article 118 of the Civil Code: 3 years for claims related to business activity, 6 years in other cases, at the end of the calendar year), and invoices for the period required by tax law. The Service Provider does not retain the data entered by the Customer into the Application (customers, orders, recipes, employees and other data).

§ 9. Complaints - Consumers and Entrepreneurs with Consumer Rights

Complaints should be submitted by e-mail to kontakt@bakepilot.pl or by post to the office address (ul. Fabryczna 1, 62-800 Kalisz, Poland). A complaint should include contact details, a description of the non-conformity and the expected solution. The Service Provider handles the complaint within 14 days of receiving it and sends the reply by e-mail. If the complaint is accepted, the Service Provider will bring the Service into conformity with the Agreement or, if this is impossible, will offer a reduction of the Fee or termination of the Agreement with a refund.

§ 10. Complaints - Entrepreneurs

Entrepreneurs who are not Entrepreneurs with Consumer Rights submit complaints under the general rules of the Civil Code. The Service Provider handles them within 30 days. With respect to Entrepreneurs who are not Entrepreneurs with Consumer Rights, the provisions of the Civil Code on statutory warranty for defects are excluded to the extent permitted by law.

§ 11. Right of withdrawal from the Agreement (Consumers and Entrepreneurs with Consumer Rights)

1. A Consumer and an Entrepreneur with Consumer Rights may withdraw from an Agreement concluded at a distance within 14 days of the day it was concluded, i.e. from the day the Account was created, without giving a reason and without incurring costs, except for the costs referred to in item 4.
2. To meet the deadline, it is sufficient to send the statement of withdrawal before the deadline expires by e-mail to kontakt@bakepilot.pl or by post to the office address. You may use the model form in Annex No. 2, but this is not mandatory. The Service Provider promptly confirms receipt of the statement by e-mail.
3. The Trial Period is free, so withdrawing during it does not give rise to any costs.
4. An Account created with the “I don't have a company” option that purchases a paid Subscription before 14 days have passed since the Account was created makes, upon purchase, a statement that it expressly requests that the provision of the paid Service begin before the withdrawal period expires and acknowledges that it loses the right of withdrawal once the Service has been fully performed by the Service Provider. The Service Provider sends confirmation of this statement in the e-mail with the invoice for the Subscription. An Entrepreneur with Consumer Rights may make such a statement by e-mail to kontakt@bakepilot.pl. After making the request, the person withdrawing pays for the Service provided until the moment of withdrawal, in proportion to the Subscription price (Article 35 of the Consumer Rights Act). Without such a request, withdrawal within the deadline does not create an obligation to pay for the period of the paid Subscription.
5. The Service Provider refunds the payments received (less the amount referred to in item 4, if applicable) promptly, no later than within 14 days of receiving the statement of withdrawal, using the same means of payment as the Customer used, unless the Customer agrees to another method of refund that does not involve any costs for them.
6. Withdrawal from the Agreement does not automatically delete the Account. Before the Account is deleted, the Customer may order a full data export (§ 12).

§ 12. Customer content and data rights

The Customer retains full rights to the data entered into the Application (customers, orders, recipes, products and other data). The Service Provider processes this data solely to provide the Service. The Customer may export data free of charge:

• Full data export - the Owner orders it in Settings, in the “Data export” section (the “Order a full data export” button; unavailable on the demo account, and if an administrator password has been set, available after unlocking the modules with that password). One order per Organization within 24 hours. We prepare the export at night, from 1:00 Polish time. The ZIP archive contains a separate CSV file (UTF-8 encoding, semicolon separator) for each type of Organization data, a combined XLSX workbook with a separate sheet for each of them, a README file describing the contents, a manifest file and invoices in KSeF format (XML files). Once the export is ready, the Owner receives an e-mail with a signed download link valid for 24 hours; after that time the file is deleted, and a new export can be ordered if needed.
• Export of orders to a CSV file - instantly, in the same section of Settings.
• Lists in modules - in the Orders, Products, Customers, Ingredients, Invoices, Reports and Time tracking modules, lists can be downloaded as CSV or XLSX files.

The export does not include passwords, PINs, KSeF keys and certificates, API keys or other access tokens, nor photo files and attachments (these are downloaded in the modules where they were added). The Service Provider does not sell or disclose the Customer's data to third parties, except for the processors listed in Annex No. 1 and the recipients described in the Privacy Policy.

§ 12a. Customer content, moderation and notices

1. The Service Provider stores the content entered by the Customer into the Application (customer data, orders, recipes, products, documents, attachments and other content) solely at the Customer's request and does not make it publicly available. The Service Provider does not review this content on its own initiative and does not use automated tools to assess its compliance with the law or the Terms.
2. It is prohibited to enter into the Application content that is unlawful, in particular content that infringes the rights of third parties (including copyright and personal data), serves to commit a crime or misleads as to the identity of the Customer.
3. Anyone may report to the Service Provider content stored in the Application that they consider illegal, using the form on the page bakepilot.com/report-content or by e-mail to the point of contact address referred to in § 1. The notice should contain: an explanation of why the content is illegal; an indication of where it is located (page address, organization name or another description that allows it to be found); the first and last name or name and e-mail address of the notifier (this is not required for notices concerning child sexual abuse); a statement that the notifier believes in good faith that the information in the notice is accurate and complete.
4. The Service Provider confirms receipt of the notice to the e-mail address provided, handles it without undue delay, no later than within 7 days, and informs the notifier of the decision and of the possibility of appeal. Notices are handled by a human, without the use of automated tools.
5. If the Service Provider considers content to be illegal or incompatible with the Terms, it may disable access to it, remove it and, in the case of serious or repeated violations, suspend the Account or terminate the Agreement on the terms of § 8. Before such a decision the Service Provider, if possible, contacts the Customer. The Service Provider sends the decision to the Customer by e-mail together with a statement of reasons, which indicates: what was done and for how long; the facts on which the decision was based and whether it resulted from a notice or from the Service Provider's own action; the legal basis or the provision of the Terms; how to appeal.
6. Decisions referred to in items 4 and 5 may be appealed within 6 months of receipt, by e-mail to the point of contact address. The appeal is handled by a person who did not make the original decision, where possible, within 14 days. Regardless of this, legal action is available and, once national provisions enter into force, a complaint to the Digital Services Coordinator.
7. If the Service Provider becomes aware of information giving rise to a suspicion of a criminal offence threatening the life or safety of persons, it promptly notifies the law enforcement authorities and provides them with the available information.

The rules for content published on the bakepilot.pl website are set out separately in the blog comment rules and the terms of the Edukacja course catalog (in Polish).

§ 13. Liability and service level

1. The Service Provider aims for Application availability of at least 99% per month, excluding announced maintenance work.
2. With respect to Entrepreneurs who are not Entrepreneurs with Consumer Rights, the Service Provider's liability is limited to actual damage and to the value of the Fees paid in the last 12 months, and the Service Provider is not liable for the effects of force majeure, errors resulting from improper use, interruptions on the side of infrastructure providers or errors of external systems (Fakturownia, KSeF, payment operator).
3. With respect to Consumers and Entrepreneurs with Consumer Rights, the Service Provider is liable on the terms provided by law; the limitations in item 2 do not apply.

§ 14. Intellectual property

The BakePilot Application, its code, interface, logos and trademarks are the property of the Service Provider and are protected by copyright. Upon conclusion of the Agreement, the Service Provider grants the Customer a non-exclusive license to use the Application within the scope of an active Subscription. The license expires upon termination of the Agreement. Any form of reverse engineering or copying of the Application without the written consent of the Service Provider is prohibited.

§ 15. Personal data and data processing

1. The rules for processing data for which the Service Provider is the controller (Account and User data, payments, correspondence, website forms) are described in the Privacy Policy.
2. With respect to the data that the Customer enters into the Application (in particular data of the Organization's customers, employees and business partners), the Customer is the controller and the Service Provider processes it on the Customer's behalf under the Data Processing Agreement constituting Annex No. 1 to the Terms. Concluding the Agreement means concluding the Data Processing Agreement.

§ 15a. Remote access by technical support

In order to diagnose and solve reported technical problems, the Service Provider may obtain remote access to the data of the Customer's Organization in the Application. Granting access is an instruction to process data within the meaning of the Data Processing Agreement (Annex No. 1). Access is possible only when all of the following conditions are met:

1. The Customer has created a ticket in the technical support system (the “Help and support” widget in the Application).
2. The Customer has given express consent to access by clicking the “I consent to account access” button in the ticket window. Consent is given separately for each ticket.
3. An access session lasts a maximum of 24 hours from the moment it is started and expires automatically.

As part of remote access, the Service Provider may view and edit the Organization's data (orders, products, recipes, ingredients, customers, settings) to the extent necessary to resolve the ticket. All actions performed by the Service Provider during the session are recorded in the event log (audit log).

The Customer may withdraw consent at any time by clicking the “Revoke” button (withdraw consent) in the ticket window. Withdrawing consent immediately ends the active access session.

§ 16. Invoicing and KSeF

VAT invoices for the Subscription are issued in the Fakturownia system (Fakturownia sp. z o.o.) and, where required by law, sent to the National e-Invoicing System (KSeF). The KSeF number is given in the e-mail with the invoice. Invoices are delivered only in electronic form (PDF). The Customer is obliged to provide up-to-date invoice details when paying.

§ 16a. Customer integration with KSeF

The Application allows the Customer to connect their own account with the National e-Invoicing System: issue a KSeF certificate, send sales invoices and download purchase invoices issued to the Customer's NIP. The Service Provider acts solely as a technical tool transmitting data to and from KSeF on behalf of the Customer.

The Customer is responsible for having the authorizations to act in KSeF on behalf of their entity, for the correctness and completeness of the data on the documents issued and for the timely fulfillment of obligations under the e-invoicing regulations. The certificate and the associated key are stored in encrypted form and used solely to perform the functions of the Application.

The Service Provider is not liable for unavailability, errors or changes on the KSeF side, including the rejection of a document by that system, or for the consequences of the Customer lacking or losing authorizations in KSeF.

§ 16b. Nature of tax and financial data

Application features that present tax calculations, in particular the Finance module (VAT estimate), are solely auxiliary and informational. They are used to plan cash flow and do not constitute a tax return, tax books, records within the meaning of tax law, or tax or accounting advice.

The calculations are based on the data entered by the Customer and may be incomplete if that data is incomplete. The Service Provider does not provide tax advisory services within the meaning of the Tax Advisory Act (ustawa o doradztwie podatkowym). Only the Customer and their accountant are responsible for the correctness of tax settlements, the returns filed and the books kept.

§ 17. Out-of-court dispute resolution

A Consumer may use out-of-court methods of handling complaints and pursuing claims, in particular the assistance of the provincial inspector of the Trade Inspection (Inspekcja Handlowa), a permanent consumer arbitration court or another entity entered in the register of entities authorized to conduct out-of-court consumer dispute resolution proceedings, maintained by the President of the Office of Competition and Consumer Protection (Prezes UOKiK) (uokik.gov.pl). A Consumer may also ask a municipal or district consumer ombudsman for help. Using these procedures is voluntary.

§ 18. Amendment of the Terms

The Service Provider reserves the right to amend the Terms for important reasons: changes in the law, a decision of an authority, a change in the scope of the Service or the payment operator, security considerations. The Customer receives information about the change together with the new text by e-mail at least 14 days before it enters into force. A Customer who does not accept the changes may terminate the Agreement before that date at no cost; failure to terminate means acceptance of the new Terms. Until the changes enter into force, the previous version of the Terms applies, available at the link given at the beginning of the document. The changes do not affect Subscription Periods already paid for.

§ 19. Changes to the Service

The Service Provider may make changes to the Application (new features, modifications, removals). The Customer is informed of material changes that adversely affect the Service at least 14 days in advance. If a change materially and adversely affects the use of the Service, the Customer may terminate the Agreement within 30 days without additional costs.

§ 20. Final provisions

In matters not regulated herein, the provisions of Polish law apply (the Civil Code, the Act on the Provision of Electronic Services, the Consumer Rights Act, the GDPR (Regulation (EU) 2016/679), copyright law). Disputes with Consumers and Entrepreneurs with Consumer Rights are resolved by the court having jurisdiction under the general rules; disputes with other Entrepreneurs, by the court having jurisdiction over the Service Provider's address (Kalisz). The invalidity of one provision does not affect the remaining provisions.

Version history:

• version 2.0 - in force from 2 November 2026 (data processing agreement as Annex No. 1, right of withdrawal and model form for Consumers, gross prices, full data export ordered in Settings, end of the Agreement, Service Provider's addresses),
• previous version - in force from 27 March 2026 to 1 November 2026.

Annex No. 1. Data Processing Agreement

The Data Processing Agreement (Article 28 of Regulation (EU) 2016/679, the “GDPR”) is concluded together with the Agreement. Capitalized terms have the meaning given to them in the Terms.

§ 1. Parties

The Controller is the Customer. The Processor is the Service Provider (details in § 1 of the Terms).

§ 2. Subject matter, nature and purpose

The Controller entrusts the Processor with the processing of personal data that the Controller or its Users enter into the Application or that reach it on the Controller's instruction (e.g. invoices downloaded from KSeF). Processing consists of storing, organizing, displaying, calculating, transmitting (e.g. an e-mail to the Organization's customer, sending to KSeF) and deleting data and serves solely to provide the Service.

§ 3. Duration

The Data Processing Agreement remains in force for the duration of the Agreement and, after its termination, until the data is deleted in accordance with § 7.

§ 4. Type of data and categories of data subjects

1. customers and recipients of the Organization: first name, last name, name, phone, e-mail, delivery address, order history, invoice details;
2. employees and associates of the Organization (Time tracking module): first name, last name, position, type of contract, rate or salary, working hours and clock-ins, schedule, absences (including sickness absence, i.e. information about health), PIN code;
3. business partners and suppliers: data from sales and purchase invoices, including those downloaded from KSeF;
4. Account Users: first name, last name, e-mail, phone, role.

§ 5. Obligations of the Processor

The Processor:

1. processes data only on documented instructions from the Controller, including with regard to transfers of data to a third country; the instructions are the Agreement, the use of the Application's features by the Controller and its Users, the Account settings and consent to remote access in a support ticket (§ 15a of the Terms); if processing is required of it by law, it informs the Controller of this, unless the law prohibits it; it promptly informs the Controller if, in its opinion, an instruction infringes data protection law;
2. ensures that persons authorized to process the data have committed themselves to confidentiality;
3. applies the security measures described in § 8 (Article 32 GDPR);
4. engages sub-processors on the terms of § 6;
5. as far as possible, assists the Controller in responding to requests from data subjects, primarily through the Application's features (viewing, correcting, deleting and exporting data);
6. taking into account the nature of processing and the information available to it, assists the Controller with the obligations under Articles 32-36 GDPR; it notifies the Controller of a personal data breach by e-mail without undue delay, no later than within 48 hours of becoming aware of it, providing the information referred to in Article 33(3) GDPR known to it;
7. after the end of the provision of the Service, returns or deletes the data in accordance with § 7;
8. makes available to the Controller the information necessary to demonstrate compliance with the obligations under Article 28 GDPR and allows for audits, including inspections, on the terms of § 9.

§ 6. Sub-processors

1. The Controller gives general written authorization for the use of the sub-processors listed in item 4 and for their replacement on the terms of items 2-3. Each sub-processor is bound by an agreement imposing on it the same data protection obligations as this Data Processing Agreement.
2. The Processor informs of an intended addition or replacement of a sub-processor by an e-mail sent to the Owner's address at least 14 days in advance. During this time the Controller may raise a reasoned objection by e-mail.
3. An objection does not suspend the change. If the Parties do not agree on a solution, the Controller may terminate the Agreement with effect on the day preceding the change, at no cost; the Service Provider then refunds a proportional part of the Fee for the paid, unused period.
4. List of sub-processors:
   • Supabase Inc. - database, login and file storage (servers in the EU, Ireland);
   • Vercel Inc. - Application hosting (Application functions in the Dublin region, Ireland);
   • Resend Inc. - sending e-mails from the Application, including to the Organization's customers (e.g. quotes);
   • Anthropic PBC - reading documents uploaded to the invoice price scanner;
   • Google Ireland Ltd. / Google LLC - push notifications in the mobile application (Firebase Cloud Messaging, notification content);
   • OpenStreetMap Foundation - converting a delivery address into coordinates (Nominatim; the address only, without a name);
   • Functional Software Inc. (Sentry) - Application error diagnostics.
   Data is transferred to entities in the USA on the basis of standard contractual clauses approved by the European Commission or the Commission's adequacy decision (EU-US Data Privacy Framework) for entities entered on its list.
5. The following are not sub-processors: the Ministry of Finance (KSeF), which receives and makes invoices available as a public authority, on the Controller's instruction; entities that process data for which the Service Provider is the controller (e.g. Stripe, Fakturownia, Meta, Telegram, CallMeBot), which are described in the Privacy Policy.

§ 7. Return and deletion of data

1. Throughout the term of the Agreement and after its termination, until the Account is deleted, the Controller may order a full data export (§ 12 of the Terms), which is a form of returning the data.
2. Deletion of the Account by the Owner in Settings deletes the data immediately. At the Controller's request submitted by e-mail, the Processor deletes the data within 30 days.
3. If the Account remains in restricted mode for 6 months (§ 8 of the Terms), the Processor deletes the data, notifying the Controller by e-mail at least 30 and 7 days in advance; until the deletion date the Controller may order a full data export.
4. Deleted data may remain in database backups until they are overwritten in the normal cycle, for no longer than 7 days, and is not restored from them, unless the law requires it to be stored.

§ 8. Security measures

Encryption in transit (TLS); isolation of organization data in the database (Row Level Security); User roles and permissions assigned by the Controller; an optional administrator password for modules with sensitive data; encryption of KSeF certificates; an event log of remote support access; database backups maintained by the infrastructure provider.

§ 9. Audit

1. The Processor demonstrates compliance with its obligations primarily by making documentation available: this Data Processing Agreement, a description of the security measures (also on the page bakepilot.com/security) and written answers to the Controller's questions, provided within 30 days.
2. An inspection (remote or at the Service Provider's office) is possible when the documentation referred to in item 1 is not sufficient to demonstrate compliance, after a personal data breach concerning the Controller's data, or at the request of a supervisory authority. The Controller announces it at least 14 days in advance, no more often than once a year (except in the case of a breach or a request from an authority); the inspection takes place on business days, without access to the data of other Customers, and the auditor undertakes to keep it confidential.
3. The costs of the audit are borne by the Controller, including the Processor's reasonable costs related to the inspection, unless the inspection reveals a material breach of the Data Processing Agreement by the Processor.

§ 10. Liability and final provisions

The liability of the Parties under the Data Processing Agreement is subject to the rules and limitations of § 13 of the Terms, to the extent permitted by law; this does not limit the rights of data subjects (Article 82 GDPR). The Data Processing Agreement expires when the data is deleted in accordance with § 7. In matters not regulated herein, the Terms and the GDPR apply.

Annex No. 2. Model withdrawal form

(complete and return this form only if you wish to withdraw from the agreement)

• To: KamikStudio Patryk Kowalski, ul. Fabryczna 1, 62-800 Kalisz, Poland, kontakt@bakepilot.pl
• I/We(*) hereby give notice that I/We(*) withdraw from my/our(*) agreement for the provision of the BakePilot service
• Date the agreement was concluded (Account created): ...
• Name of consumer(s): ...
• Account e-mail address: ...
• Address of consumer(s): ...
• Signature of consumer(s) (only if this form is submitted on paper): ...
• Date: ...

(*) Delete as appropriate.

Contact: kontakt@bakepilot.pl | phone +48 519 109 063