Pilot Data Processing Addendum
A contract template for cases in which Banalytics processes personal data on behalf of a pilot or Enterprise customer.
Not automatically executed
This page is a negotiation template. It does not become binding merely because a customer uses Community Edition, creates a Portal account or reads this page. It takes effect only when incorporated into a written agreement signed by BANALYTICS sp. z o.o. and the customer, with the deployment details completed.
Controller and processor
The customer acts as controller of the personal data described in the applicable order, pilot statement of work or annex. Banalytics acts as processor only to the extent that the contracted service requires Banalytics to process that data on the customer’s documented instructions.
Data independently processed by Banalytics for Portal accounts, billing, service security and its own legal obligations remains subject to the Privacy Policy and is not customer-processor data under this template.
Terms to complete in the signed agreement
- Process customer personal data only on documented instructions, unless applicable law requires otherwise.
- Ensure that authorised personnel are subject to appropriate confidentiality obligations.
- Apply technical and organisational measures proportionate to the agreed deployment and risk.
- Notify the customer without undue delay after confirming a personal-data breach affecting customer-processor data.
- Provide reasonable assistance with data-subject requests, DPIAs and regulator consultations, taking account of the nature of processing and information available to Banalytics.
- Use a subprocessor only under the agreed authorisation model and impose materially equivalent data-protection obligations.
- At the end of the service, return or delete customer-processor data as agreed, except where law requires retention.
- Make information reasonably necessary to demonstrate these obligations available under the confidentiality and audit terms of the signed agreement.
Transfer mechanism
If contracted processing requires a restricted transfer from the EEA, the signed agreement must identify the relevant parties, destination, data and transfer mechanism. Where appropriate, the parties may incorporate the European Commission’s Standard Contractual Clauses and document any supplementary measures required by the deployment.
Deployment details that must be completed
| Subject matter and duration | To be completed in the pilot or Enterprise agreement |
|---|---|
| Nature and purpose | To be completed for the contracted support, hosting or managed service |
| Data subjects | To be identified by the customer |
| Personal-data categories | To be identified before Banalytics receives access |
| Special-category data | Not permitted unless expressly identified and approved in writing |
| Approved subprocessors | To be listed for the contracted deployment |
| Security measures | To be attached to the agreement based on the selected architecture |
| Return and deletion | To be agreed, including any legally required retention |
Request a contract-ready copy from info@banalytics.live.
Template updated: 23 July 2026.