Legal
Data processing agreement
When you upload a document that contains personal data, we process it on your instructions. This page is the agreement that governs that.
1. How this agreement applies
This data processing agreement (the “DPA”) forms part of the terms & agreements between the customer (the “controller”) and Piotr Osiński, trading as Code Fibers, ul. Tyszkiewicza 14/24/61, 01-182 Warszawa, Poland, NIP 5222853697, REGON 362492920 (the “processor”, “we”).
- It applies to every paid plan automatically, without a request, from the moment the subscription starts.
- On a free trial it applies on request — write to hello@kosmobids.com and we will send a countersigned copy, usually the same working day.
- If you have a signed DPA of your own, send it: we will sign reasonable terms, and where the two documents conflict, the signed one wins.
Where we process personal data for our own purposes — your account, billing, security, support — we are the controller, not the processor, and the privacy policy applies instead of this DPA.
2. What is processed, and why
| Item | Detail |
|---|---|
| Subject matter | Searching public tender notices, reading tender and company documents, assessing requirements, drafting bid content, and the adjacent tasks the controller asks for. |
| Duration | For the term of the subscription, plus the deletion period in section 12. |
| Nature and purpose | Collection, storage, retrieval, analysis, automated text generation, transmission to the controller. No processing for our own purposes, and no use of the content to train or fine-tune models. |
| Categories of data subjects | The controller's users; individuals named in tender documents; individuals named in the controller's own documents (employees, referees, certificate holders). |
| Categories of personal data | Identification and contact data, professional and employment data, qualifications and certifications, signatures and contact details in documents. No special categories, unless the controller uploads them (see section 4). |
3. Our obligations as processor
- Instructions only. We process personal data only on the controller's documented instructions, including as set out in this DPA and in the controller's use of the Service, and we tell the controller if an instruction would breach the GDPR.
- Confidentiality. Everyone with access is bound by confidentiality, and access is limited to those who need it to provide the Service.
- Security. We apply the technical and organisational measures in section 6, appropriate to the risk.
- Subprocessors. We engage subprocessors only under section 7, with a written contract that puts the same obligations on them.
- Assistance. We help the controller answer data-subject requests and meet its obligations under Art. 32–36 GDPR, taking into account the nature of the processing, and we do not answer a data-subject request directed to the controller ourselves unless the controller asks.
- Deletion. We delete or return the data at the end of the arrangement as described in section 12.
- Records. We keep the records required by Art. 30(2) GDPR and make them available to a supervisory authority on request.
4. The controller's obligations
The controller is responsible for the lawfulness of the processing it instructs, for the content it uploads, and for having a basis for any personal data in it — including personal data of third parties that appears in a tender document or a reference letter. Special categories of data should not be uploaded unless a tender genuinely requires it and the controller has a condition under Art. 9 GDPR; if they are uploaded, the controller confirms it has done that assessment.
5. Personnel and access
Production access is limited to the operator. Access is individual (no shared accounts), logged, and reviewed when someone leaves. Subprocessor personnel never receive the controller's content as a separate processing purpose: our GPU suppliers run machines, and the model runs inside our environment, so no third-party model provider is in the path of your documents.
6. Security measures
- Encryption in transit (TLS 1.2+) and at rest for stored content and backups.
- Logical separation between customers' workspaces, enforced in the application and in storage paths.
- Role-based access to production, with authentication and audit logging.
- Daily backups with a tested restore path; deletion propagated through the backup cycle within 90 days.
- Dependency and container patching, and a vulnerability path through hello@kosmobids.com that we answer within two business days.
- Staff and contractor confidentiality undertakings that survive the arrangement.
We do not hold ISO 27001 or SOC 2 certification and we do not claim one. If a certification is a condition of your contract, tell us before you sign rather than after.
7. Subprocessors
The current list, which is also the one in the privacy policy:
| Subprocessor | Role | Location |
|---|---|---|
| Cloudflare, Inc. | Website delivery, TLS, DDoS and abuse protection | Global edge; EU for EU traffic |
| Novita AI | GPU compute, EU regions | EU |
| RunPod, Inc. | GPU compute, EU regions | EU infrastructure; US entity |
| Email delivery provider | Transactional email, shortlists, notices | EU or US under SCCs |
| Payment and accounting providers | Billing, invoices, bookkeeping | EU |
Changes. We email account owners at least 30 days before adding or replacing a subprocessor — for any customer on a paid plan, not only those who asked for a DPA — and we update this page at the same time. The controller may object on reasonable data-protection grounds within that period; if we cannot accommodate the objection, the controller may terminate the affected subscription and we refund the unused portion.
We remain liable to the controller for a subprocessor's performance of its obligations, to the same extent we are liable for our own.
8. International transfers
Content is processed and stored in the European Union. Where a subprocessor or a support activity involves a transfer outside the EEA, the transfer relies on a European Commission adequacy decision or on standard contractual clauses under Art. 46(2)(c) GDPR, with a transfer impact assessment where required. We will tell the controller which mechanism covers a named subprocessor on request.
9. Data-subject requests
If a data subject writes to us directly, we forward the request to the controller without responding to its substance, unless the controller asks us to act. Where the Service gives the controller self-serve tools (access, export, deletion), we expect the controller to use them; where it does not, we provide the data within 10 business days of an instruction.
10. Personal-data breaches
We notify the controller without undue delay and in any event within 48 hours of becoming aware of a personal-data breach affecting the controller's data, with what we know at that point: what happened, which data and how many data subjects are affected, the likely consequences, and what we have done. We follow up as the investigation develops, and we cooperate with the controller's own notification obligations at no additional charge. Notification is not an admission of fault.
11. Audit
Once a year, and on a documented security incident, the controller may audit our compliance with this DPA: first by questionnaire, then — if that does not answer the question — by a remote session with screen sharing, and only if neither is adequate, by an on-site visit during business hours with 14 days' notice. Audits are at the controller's cost unless they reveal a material breach. We keep the answers to the standard security questionnaire (CAIQ or the controller's equivalent) current and will send them on request.
12. Return and deletion
At the end of the arrangement the controller can export its content for 30 days, in the original file formats plus drafts and conversations as text. After that window, personal data is deleted from live systems within 30 days and leaves the backup cycle within 90 days, except where the law requires us to keep it (invoicing records, for the period tax law sets) or where it survives in a log we must retain for security — in which case it stays under this DPA until that retention ends.
13. Liability and precedence
Each party's liability under this DPA is subject to the limitations in section 12 of the terms & agreements, with the carve-outs stated there for confidentiality and data-protection claims. Where this DPA and the terms conflict on a data-protection question, this DPA wins. Where the GDPR or a supervisory authority requires more than this DPA provides, that requirement applies.
14. Contact
Data protection questions, a countersigned copy of this DPA, or a subprocessor objection: hello@kosmobids.com — Piotr Osiński, trading as Code Fibers, ul. Tyszkiewicza 14/24/61, 01-182 Warszawa, Poland.