Draft under legal review. The binding version is the one you accept when you sign up or choose a plan; we will ask you to accept any change.
Data processing agreement
Version 2026-10-22 · IntentBid.co is provided by BNNR Kamil Bednarski, Warsaw, Poland, VAT ID PL6783171607, REGON 368967330 · ask@answerbid.co
1. Parties and subject
1.1. This agreement is concluded between the customer that accepts it (“Controller”) and BNNR Kamil Bednarski, Warsaw, Poland, VAT ID PL6783171607 (“Processor”), as part of the contract for the IntentBid.co service (the “Terms”). It is concluded in electronic form when the Controller accepts it online, which meets the form requirement of art. 28(9) GDPR.
1.2. The Processor processes personal data on behalf of the Controller only to provide the Service described in the Terms, for the duration of the Terms and until the data is deleted under section 9.
2. Nature, purpose and data
| Purpose | Identifying the companies that visit the Controller’s websites, showing their visits, scores and alerts in the Service, measuring campaigns; storing data the Controller imports |
|---|---|
| Data subjects | Visitors of the Controller’s websites; people listed in files the Controller imports (for example target account contacts); the Controller’s users |
| Personal data | IP address (hashed or encrypted, see section 6), pages viewed, referring site, campaign tags and click identifiers, time of visit, browser type, random session identifier; business contact data in imported files |
| Special categories | None. The Controller must not import special categories of data. |
| Operations | Collection, storage, lookup with the identification provider, aggregation, display, export, deletion |
3. Processor obligations
The Processor:
- processes the data only on documented instructions of the Controller; the Terms, this agreement and the Controller’s settings in the Service are those instructions. If an instruction breaches the law, the Processor tells the Controller;
- ensures that people authorised to process the data are bound by confidentiality;
- applies the technical and organisational measures in section 6;
- uses sub-processors only under section 5;
- helps the Controller, as far as possible, to answer requests from data subjects and to meet its obligations under articles 32–36 GDPR;
- notifies the Controller of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, with the information available;
- deletes or returns the data at the end of the Service under section 9;
- makes available the information needed to show compliance and allows audits under section 8.
4. Controller obligations
The Controller ensures that it has a legal basis for the processing, informs the visitors of its websites in its privacy notice (naming the Processor and the identification provider as recipients), and, where the law requires, loads the script only after consent (the script supports this with data-consent="required").
5. Sub-processors
5.1. The Controller gives general authorisation to use the sub-processors below. The Processor informs the Controller at least 14 days before adding or replacing one; the Controller may object for justified reasons and, if no solution is found, end the Terms before the change.
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting of the application and the website script | USA, global edge network (EU SCCs / EU–US Data Privacy Framework) |
| Supabase Inc. | Database, sign-in and storage | Data stored in the EU (Ireland) |
| ipapi.is | First step in finding the company behind an IP address | VERIFY provider entity and location |
| Enrich.so | Company behind an IP address and company details | VERIFY provider entity and location (EU SCCs where outside the EEA) |
5.2. The Processor imposes on each sub-processor the same data protection obligations as in this agreement and remains liable for them.
6. Security measures
- IP addresses are never stored in readable form: a keyed hash (HMAC-SHA-256) is kept for at most 30 days for de-duplication; an encrypted copy (AES-256-GCM) is kept for at most 24 hours while a lookup is pending
- Encryption in transit (TLS) and at rest; customers’ ad account keys are encrypted with AES-256-GCM
- Separation of customers’ data enforced in the database (row-level security); administrative access only for named staff
- Data stored in the EU; automatic deletion on the schedule in section 9; daily backups
- Script filters out bots and internal traffic and accepts events only from the Controller’s domains
7. Transfers outside the EEA
Where a sub-processor processes data outside the European Economic Area, the transfer is based on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
8. Audits
The Processor answers the Controller’s written questions about compliance within 14 days. The Controller may carry out an audit, itself or through an auditor bound by confidentiality, once a year with at least 30 days’ notice, during business hours and without disrupting the Service; each party bears its own costs.
9. Deletion
Visits that match no company: 30 days. IP data: as in section 6. Visits and companies: while the Terms are in force. After the Terms end, the Controller can export the data for 30 days; the Processor then deletes it, including from backups within the following 30 days, unless the law requires it to be kept.
10. US customers: service provider terms
For personal information covered by the California Consumer Privacy Act as amended by the CPRA and similar US state privacy laws, the Processor acts as a service provider (or processor) to the Controller. The Processor will not sell or share the personal information, will not retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Service, will not combine it with personal information from other sources except as those laws allow, will comply with those laws and provide the same level of privacy protection they require, and will tell the Controller if it can no longer meet these obligations. The Controller may take reasonable steps to stop and remedy unauthorised use.
11. Final provisions
Liability under this agreement follows the Terms and art. 82 GDPR. If this agreement and the Terms conflict on data protection, this agreement prevails. Polish law applies.