Data Processing Agreement
When your screens show personal data, we process it for you. This agreement sets out how, as Article 28 GDPR requires. It is part of our terms and applies to every customer automatically.
Last updated: 25 October 2026
1. Parties and how this agreement applies
This agreement is between you, the customer named in an order (the controller), and DynamicDigital sp. z o.o., Al. Jerozolimskie 181B, 02-222 Warszawa, Poland, KRS 0000521993, trading as easyCMS (the processor, “we”).
It forms part of our Terms & Conditions and takes effect when you place an order or open an easyCMS account. You do not need to sign anything. If you would like a copy signed by both parties, email info@myeasycms.com.
If this agreement and the terms conflict on data protection, this agreement wins.
2. What we process for you
| Item | Details |
|---|---|
| Subject matter | Hosting and running the easyCMS service: storing your content and showing it on your screens |
| Duration | As long as you use easyCMS, then until deletion under section 9 |
| Nature and purpose | Storage, scheduling, display, backup, transmission to your screens, and the Studio features you choose to use (such as menu import and meeting room calendars) |
| Types of personal data | Whatever you put into easyCMS, typically names, job titles, photos and videos of people, meeting titles and organisers, contact details shown on screens, and the usernames and email addresses of your users |
| Categories of people | Your staff, guests, customers and anyone else who appears in your content, and your easyCMS users |
| Special categories | None are expected. Do not upload health or other special-category data unless you have a lawful basis and have told us in writing |
3. Your instructions
We process your content only on your documented instructions. Your instructions are these terms and what you do in easyCMS: what you upload, schedule, publish and delete. If we believe an instruction breaks data protection law, we will tell you. If the law requires us to process data in another way, we will tell you first, unless the law forbids it.
4. Confidentiality
Everyone at easyCMS who can reach your content is bound by confidentiality, and access is limited to the people who need it to run the service or to help you when you ask.
5. Security
We apply the technical and organisational measures required by Article 32 GDPR, including:
- encryption of every connection to easyCMS, its API and your screens (HTTPS and TLS)
- two-factor authentication on the administrator accounts that can reach customer data
- separate accounts and permissions per customer, so customers cannot see each other’s content
- regular backups held in the European Union, with the same restricted access
- software updates and monitoring of the platform, with a public status page
6. Sub-processors
You give us general authorisation to use sub-processors. The current list:
| Sub-processor | Location | What they do |
|---|---|---|
| Hetzner Online GmbH | Germany | Hosts the easyCMS platform (app.myeasycms.com) and its backups |
| DigitalOcean, LLC | Servers in Amsterdam, Netherlands | Hosts the older easyCMS V3 platform (cms.myeasycms.com) |
| Google Ireland Limited (Google Cloud and Firebase) | Belgium (europe-west1); Vertex AI requests may be handled globally | Our API, screen alerts, meeting room calendar sync, menu import |
| Resend, Inc. | United States | Sends account emails and screen alerts |
When you use certain features, we also send what you enter to services that act independently: the OpenStreetMap Foundation (United Kingdom) for a screen’s location, and Wikidata and Wikipedia for Find a logo. Meeting room calendars are fetched from the calendar provider whose link you add.
We impose data protection obligations on every sub-processor that are no less protective than this agreement, and we remain responsible to you for them. We will announce a new sub-processor on this page and by email at least 30 days before it starts. You may object on reasonable data protection grounds within that time; if we cannot resolve the objection, you may cancel the affected service and receive a proportionate refund of any prepaid, unused period.
7. Transfers outside the EEA
Where a sub-processor processes data outside the European Economic Area, the transfer relies on the European Commission’s Standard Contractual Clauses and, where the provider holds it, certification under the EU–US Data Privacy Framework.
8. Helping you
Taking into account what we can reasonably do, we will help you:
- answer requests from people exercising their rights. If a request about your content reaches us, we pass it to you without undue delay and do not answer it ourselves
- meet your obligations on security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR)
9. Personal data breaches
We will tell you without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting your content. We will give you what we know about its nature, the data and people affected, its likely consequences and the measures taken, and send further detail as we learn it.
10. When the service ends
When your account or subscription ends, your content remains available for 30 days so you can export it, and is then deleted. Copies in backups are deleted as those backups expire in their normal rotation. We keep nothing longer unless the law requires it, and we will confirm deletion in writing on request. If you want your content returned to you rather than exported yourself, ask before the 30 days end.
11. Audits
We will make available the information you need to demonstrate compliance with Article 28 GDPR, starting with this agreement and written answers to your questions. Where that is not enough, you, or an auditor bound by confidentiality, may audit us once a year, or after a breach, with 30 days’ notice, at your own cost, without access to other customers’ data.
12. Liability and law
Liability under this agreement follows the limits in our terms, except where the law does not allow them to apply. This agreement is governed by Polish law, like the terms.