for the use of the Crewory service — under Article 28 GDPR

This is an English translation provided for information. The binding version is the Hungarian original (https://crewory.app/jog/adatfeldolgozoi-szerzodes); in case of any discrepancy, the Hungarian text prevails.

Version: 2.0 · Effective: 21 October 2026

1. What this agreement covers, and what it does not

When Crewory is used, two kinds of personal data enter the system, and the role of Pagency Solution Kft. (the Provider) differs between them:

This agreement covers Layer 2 only, in two situations:

• The Partner's own workspace: the Partner is the controller, the Provider the processor.
• Client Spaces: the Client is the controller, the Partner is the Client's processor, and the Provider is the Partner's further processor (GDPR Art. 28(4)). In this case the Provider fulfils the obligations undertaken in this agreement towards the Partner for the Client's data as well.

The Provider processes Layer 2 data solely to provide the Crewory service, and only on instructions (section 6).

2. Parties and definitions

Processor (the Provider)

Controller, or for Client Spaces processor (the Partner)

The business that has subscribed to the Crewory service within the partner programme (Terms 1.3). The Partner's identification data is recorded in its Crewory account and forms part of this agreement.

(Together: the Parties.)

Further definitions (consistent with the Terms and the Privacy Notice):

3. How this agreement is concluded — by acceptance, not signature

3.1. Under GDPR Art. 28(9) a data processing agreement must be in writing, including in electronic form. This agreement therefore requires no handwritten signature.

3.2. The agreement is concluded when the Partner accepts it by an express, active act on the Crewory interface — at the partner application or when starting the subscription, by ticking an unticked checkbox, next to which this document is available to download and open.

3.3. Acceptance relates to the given version number. Changes of version are governed by section 18.

3.4. The Partner's attention is specifically drawn to the following provisions, which are significant compared with usual contractual practice (Hungarian Civil Code § 6:78(2)):

• section 5 — the Partner's obligations towards its Clients, in particular the data processing agreement to be concluded with the Client;
• section 9 — general authorisation to engage further processors, with a right to object;
• section 14 — the transfer of data to the United States involved in using AI providers, for which the Partner gives instructions;
• section 12 — the 30-day deletion grace period after termination, after which data is permanently lost;
• section 13 — the procedure for exercising audit rights;
• section 16 — liability provisions.

4. Subject matter, duration, nature and purpose of processing

(GDPR Art. 28(3), introductory wording)

5. Obligations and rights of the Partner

5.1. The Partner may:

• give the Provider instructions on processing (section 6);
• audit the Provider's compliance (section 13);
• object to a new further processor (section 9);
• decide on deletion or return of data at the end of the contract (section 12).

5.2. For its own workspace, as controller, the Partner is responsible for:

• having a legal basis for processing the personal data entered, and being able to prove it;
• providing its own privacy notice to Data Subjects, naming Crewory as a system used — and the Provider as processor;
• entering only data necessary for its purpose, and not unnecessarily entering special categories of data (GDPR Art. 9) or criminal data (Art. 10);
• the lawfulness of emails and newsletters sent from the system — sending advertising only with the recipient's prior, express consent, not circumventing double opt-in and unsubscription, not importing address lists without consent, and disclosing newsletter open and click tracking to Data Subjects;
• the lawfulness of data collected on integrated external sites and forms (information, consent);
• assigning access correctly and revoking access of departing staff;
• answering Data Subjects' requests (the Provider assists under section 10).

5.3. For Client Spaces, as the Client's processor, the Partner must:

• conclude a data processing agreement under GDPR Art. 28 with the Client which (i) names the Provider as a further processor together with the current subprocessor list and contains the Client's authorisation for this, (ii) sets out the Client's obligations equivalently to 5.2, and (iii) informs about the data transfer under section 14 involved in the AI functions;
• forward the Client's instructions, objections and audit requests to the Provider, and forward the Provider's notices (in particular: subprocessor changes, personal data breaches) to the Client without delay;
• ensure that the Client complies with the rules under 5.2 in the Client Space.

5.4. If a workspace owner intends to process special categories of data in the system, the Partner notifies the Provider in advance at its data protection contact, as this may require a review of the security measures.

5.5. The Provider is not liable for damage or adverse legal consequences arising from the Partner or the Client breaching the above obligations.

6. Processing on instructions

(GDPR Art. 28(3)(a))

6.1. The Provider processes personal data only on documented instructions, including with regard to transfers to a third country.

6.2. Documented instructions are:

• this agreement and the Terms;
• settings and operations performed by Users in the workspace (creating an object, enabling an automation, sending an email template or newsletter, creating an integration, publishing a website, using an AI function, starting an export, deleting a record) — the system logs these against the workspace and the User. In a Client Space, the operations of the Client's Users count as the Partner's instructions: by granting the Client's Users access, the Partner authorises this;
• written instructions sent by the Partner to the Provider's data protection contact.

6.3. The Provider immediately informs the Partner if, in its opinion, an instruction infringes the GDPR or other data protection law, and may suspend execution of that instruction until the infringement is remedied.

6.4. If Union or Member State law requires the Provider to process data without instructions (e.g. a request from an authority), the Provider informs the Partner before processing, unless the law prohibits such information on important grounds of public interest.

6.5. The Provider does not make autonomous automated decisions with legal effect on Data Subjects based on Layer 2 data. The fact that the system sends no further emails to permanently bouncing or complaining addresses is a technical condition of email deliverability, not such a decision.

7. Confidentiality

(GDPR Art. 28(3)(b))

7.1. The Provider ensures that every person with access to the personal data — employee, contractor, subcontractor's staff — has committed to confidentiality or is under a statutory obligation of confidentiality. The obligation survives the end of the relationship.

7.2. The Provider's staff access the data only to the extent necessary for their tasks. A Provider staff member with operator rights enters a workspace's interface only for support, troubleshooting or legal reasons; the system records such entry in that workspace's audit log.

7.3. Persons acting under the Provider's authority may process the data only on the Provider's instructions, unless required otherwise by Union or Member State law (GDPR Art. 29 and Art. 32(4)).

8. Security measures

(GDPR Art. 28(3)(c) and Art. 32)

8.1. The Provider applies technical and organisational measures appropriate to the risk; they are listed in detail in Annex 3. The most important:

• encrypted connection (HTTPS/TLS) to every interface, including Partners' own domains;
• passwords only as one-way hashes; two-factor login available to every User;
• separation per workspace and role-based access; Client Spaces cannot access each other's data;
• encrypted daily backup, with a copy independent of the server, within the EU;
• EU storage: database, uploaded files and backups are in the European Union;
• logging and automatic expiry of logs (Annex 1, 1.5);
• self-service data export per workspace (sections 10 and 12).

8.2. The Provider may adapt the security measures to technological progress, provided the level of protection does not decrease. It informs the Partner of significant changes.

9. Further processors (subprocessors)

(GDPR Art. 28(2), (3)(d) and (4))

9.1. By accepting this agreement the Partner — for its own workspace in its own name, and for the Client Spaces on the basis of the authorisation received from the Client under 5.3 — gives the Provider general authorisation to engage further processors to provide the service.

9.2. The list of further processors is in Annex 2 and, continuously updated, at https://crewory.app/jog/alvallalkozok. Where the selection of a provider is still in progress when this agreement takes effect, the list sets out the role and the conditions (in particular processing within the EU); naming the selected provider counts as a change under 9.3.

9.3. Changes: if the Provider intends to engage a new further processor or replace an existing one, it notifies the Partner by email and on the interface at least 15 days before the change takes effect. The notice states the new provider's name, role, the data it will see, where it processes data, whether data is transferred to a third country, and the legal basis for such transfer.

9.4. Right to object: the Partner — in its own name or forwarding its Client's objection — may object in writing, with reasons, at hello@pagency.hu within 15 days of the notice. In case of objection the Parties consult in good faith. If consultation does not lead to a result within 15 days, the Partner may terminate the contract by extraordinary termination, without charge, with effect from the date the change takes effect; the Provider refunds pro rata the fees paid for the period not used.

9.5. The Provider imposes by contract on each further processor the same data protection obligations as apply to it under this agreement. If a further processor fails to fulfil its obligations, the Provider remains fully liable to the Partner for their performance.

9.6. A provider acting as an independent controller (e.g. Stripe for payment data) is not a further processor, nor is one that processes only Layer 1 data (e.g. Billingo).

10. Assistance with data subject requests

(GDPR Art. 28(3)(e))

10.1. The workspace owner must answer Data Subjects' requests, as it is the controller; in Client Spaces the Partner assists the Client.

10.2. If a data subject request reaches the Provider directly, the Provider does not answer it on the merits but forwards it to the Partner without undue delay, and informs the Data Subject.

10.3. The system supports fulfilling requests as follows:

10.4. The Provider provides assistance to the usual extent free of charge. If fulfilling a request requires extraordinary, custom development or disproportionate effort, the Provider may charge the hourly rate published in the Price List, after informing the Partner in advance and with its approval.

11. Personal data breaches and further assistance

(GDPR Art. 28(3)(f), Arts. 32–36)

11.1. Breach notification. The Provider notifies the Partner of a personal data breach affecting Layer 2 data that it detects without undue delay, and at the latest within 24 hours of becoming aware of it, at the contact email address given in the account; the notice identifies the affected workspaces (Client Spaces).

11.2. The notice contains — as far as known at the time — the nature of the breach, the approximate categories and number of Data Subjects and records concerned; the likely consequences; the measures taken and planned; a contact for further information. If not all information is available at once, the Provider provides it in phases, on an ongoing basis.

11.3. Notifying NAIH and the Data Subjects is the controller's task (GDPR Arts. 33–34); the Partner notifies its Client without delay of a breach affecting a Client Space. The Provider provides all information reasonably available to it for this.

11.4. On request, the Provider provides reasonable assistance with the data protection impact assessment (Art. 35) and prior consultation (Art. 36), by providing technical information on how the system works.

11.5. The Provider keeps a record of processing activities carried out as processor (GDPR Art. 30(2)) and makes it available to the Partner or the supervisory authority on request.

12. Deletion or return at the end of the contract

(GDPR Art. 28(3)(g))

12.1. When the contract ends for any reason, the Provider, at the Partner's choice, deletes or returns the personal data and deletes existing copies, unless Union or Member State law requires storage of the data.

12.2. Grace period. For 30 days from the end of the contract — on termination for late payment, for 30 days from the suspension (Terms 11.3) — the workspaces' data is kept and remains available for reading and export: self-service from the Settings page, in JSON and CSV formats. If the interface is no longer accessible, the Partner may request the data in writing in the same format, which the Provider delivers within 30 days at the latest. The Partner is responsible for ensuring that its Clients receive their data during this period.

12.3. When the grace period ends, the Provider permanently deletes the workspaces and their data — records, notes, relations, attachments, website content and images, logo, emails and newsletter recipients, AI conversations, company memory, logs. When a Client Space is closed, the same applies to that Client Space's data, at the time chosen by the Partner.

12.4. Backups. Deleted data remains in the encrypted backups for at most 14 days (database backup) or 35 days (file backup) — i.e. deleted data drops out of the backups within 35 days at the latest. Restoration from backup happens solely to remedy a failure.

12.5. On request the Provider gives a written statement that deletion has taken place.

13. Audit, information

(GDPR Art. 28(3)(h))

13.1. The Provider makes available to the Partner all information necessary to demonstrate compliance with Art. 28 and allows for and contributes to audits, including inspections, by the Partner — or the Client, through the Partner — or an independent auditor mandated by them.

13.2. Procedure:

• an audit request is first to be met by a completed security questionnaire, an operations description or an independent certification; an on-site audit may be requested if these are insufficient;
• an on-site audit may be requested at most once per calendar year (for a Partner and its Clients together), unless a personal data breach has occurred or a supervisory authority orders it;
• the audit must be announced in writing at least 30 days in advance;
• it takes place on working days, during working hours, without unreasonable disruption of business;
• the auditor may not be a competitor of the Provider and signs a confidentiality statement;
• the audit may not extend to the data of other Partners and workspaces, business secrets or third-party data.

13.3. The reasonable, proven costs of an on-site audit are borne by the requesting party, unless the audit reveals a serious breach by the Provider.

14. Transfers to third countries — the AI functions

14.1. EU baseline. Layer 2 data stays in the European Union: the server is in France (Lauterbourg), the backup copy is with an EU-based storage provider, and the sending providers work in EU data centres. This is not a transfer to a third country.

14.2. When data leaves the EU. Crewory's AI functions (the "AI admin", text generation, AI-assisted processing of data, voice use) send data to AI providers operating in the United States (Anthropic, OpenAI). If a User starts an AI function that also uses the content of records, the content of those records — including personal data — is transferred to the United States. The full database is never sent, only the part belonging to the request.

14.3. This is part of the instructions. Using the AI functions is the workspace owner's decision. By accepting this agreement and making the AI functions available, the Partner instructs the Provider to make the necessary transfer (GDPR Art. 28(3)(a)).

14.4. Safeguards. Transfers are based on the standard contractual clauses (SCC) under Commission Decision (EU) 2021/914, which form part of the AI providers' data processing agreements; supplementary measures: data minimisation, encrypted connection, provider retention of at most 30 days, exclusion of model training. The Provider sends a copy of the safeguard documents on request.

14.5. Data minimisation towards AI. The Provider seeks to send AI providers only the data needed for the function, and to work with the system's configuration (non-client) data where possible.

14.6. Changes in law. The Provider may adapt the legal basis for transfers to the Union law in force from time to time. It informs the Partner; if the change is disadvantageous to the Partner, the Partner may exercise the termination right under 9.4.

15. Linking with the "AI marketer" system

15.1. The workspace owner may, at its own decision, link the workspace with the Provider's other product, the "AI marketer" system (aimarketinges.app), by entering a pairing key. This link does not exist by default.

15.2. If linked, the following is shared: company profile, description of services, content of published websites, aggregate (non-personal) statistics, the company's memory, and notification of incoming leads.

15.3. Not shared: the content of records — names, email addresses, phone numbers, addresses, notes and attachments.

15.4. The link can be removed at any time; data sharing then stops. When the workspace is deleted, the Provider removes the link itself. Data protection classification of the link: both systems are products of the same Provider, so linking them does not constitute a transfer to another controller; for the data entered into the workspaces, the Provider acts as processor in both systems.

16. Liability

16.1. The Parties' liability is governed by GDPR Art. 82 and the Hungarian Civil Code.

16.2. The Provider is liable for the performance of further processors (9.5) as if it had acted itself.

16.3. The Partner is liable for the consequences of breaching its obligations under section 5 — including its Clients' obligations —, including where an authority, a Client or a Data Subject makes a claim against the Provider as a result.

16.4. Limitations of liability between the Parties are set out in the Terms (Terms 18): the Provider's liability is capped at the fees actually paid in the 12 months preceding the damaging event. These limitations do not affect liability towards Data Subjects under GDPR Art. 82, and do not apply to intentional damage or to damage to life, physical integrity or health caused by breach of contract (Civil Code § 6:152).

17. Logging of acceptance — how conclusion of the agreement can be proven

17.1. The Provider creates an electronic log entry for every acceptance, containing:

17.2. The interface visibly draws attention to the highlighted provisions listed in 3.4; their acceptance is logged together with the main checkbox.

17.3. Retention. The Provider keeps the acceptance log for 5 years after the contract ends (Civil Code § 6:22) and provides a copy at the Partner's request.

17.4. The Partner's copy. The document can be downloaded and printed at the moment of acceptance and retrieved at any time afterwards (Hungarian E-commerce Act § 5(1)).

18. Amendment of the agreement

18.1. The Provider may amend this agreement where justified by a change in law, a decision of an authority or court, a significant change in the service, or the engagement of a new further processor. Changes to the subprocessor list are governed by section 9, other amendments by this section.

18.2. The Provider notifies the Partner of an amendment by email and on the interface at least 30 days before it takes effect, with a summary of the changes.

18.3. If the amendment is disadvantageous to the Partner, the Partner may terminate the contract free of charge with immediate effect until the amendment takes effect.

18.4. Acceptance of the amendment is logged under section 17; a new version number is issued. The Provider archives earlier versions and sends them on request.

19. Final provisions

19.1. This agreement is governed by Hungarian law, the GDPR (Regulation (EU) 2016/679) and the Hungarian Privacy Act (Act CXII of 2011).

19.2. This agreement forms an integral part of the Terms. In case of conflict between this agreement and the Terms on data protection matters, this agreement prevails.

19.3. If any provision of this agreement is invalid, the validity of the other provisions is not affected.

19.4. The Partner may complain to the Provider's data protection contact and — as a data subject — to the Hungarian National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; phone: +36 (1) 391-1400; email: ugyfelszolgalat@naih.hu; www.naih.hu), or to a court. The Parties shall first seek to settle disputes by negotiation.

ANNEX 1 — Personal data processed and categories of Data Subjects

(Mandatory specification under GDPR Art. 28(3), introductory wording)

1.1. Categories of Data Subjects

1.2. Types of personal data

The system works with freely definable objects, so the exact scope of data depends on the workspace owner's setup; itemising it is part of the controller's own record under GDPR Art. 30(1).

1.3. Special categories of data

The service is not designed for special categories of data. Special categories under GDPR Art. 9 and criminal data under Art. 10 may be entered only after prior notice under 5.4 and agreement on the necessary supplementary measures.

1.4. Place of processing

The European Union: the server in France (Lauterbourg), the backup copy with an EU-based storage provider, email in EU data centres. Exception: AI calls under section 14, which go to the United States.

1.5. Retention of operational logs

The system automatically deletes the logs below after the stated period, by a daily clean-up.

What does not expire automatically — because it is workspace content, not a log: records, notes, relations, attachments, newsletter consents and unsubscriptions, AI conversations, company memory, configuration and its version history. The workspace owner deletes these whenever it wishes, or they are deleted when the workspace ends (section 12).

ANNEX 2 — Further processors (subprocessors)

The current, up-to-date list: https://crewory.app/jog/alvallalkozok

2.1. Subprocessors with access to Layer 2 data

2.2. Not further processors — Layer 1 or independent controllers

These providers do not process Layer 2 data and are therefore outside the scope of this agreement; section 7 of the Privacy Notice applies to them.

2.3. Conditional, only on the workspace owner's separate act

ANNEX 3 — Technical and organisational security measures

(GDPR Art. 32)