Draft data processing agreement under Art. 28 GDPR: orders from web configurators, sub-processors, security and deletion.
Version 1.0 (draft) of 7 November 2026
This data processing agreement (the "DPA") forms part of the contract for gull system services, which consists of the Terms of Business (the "Terms") and the End User Licence Agreement (EULA). It is concluded together with them when the customer orders a service, and applies for as long as the provider processes personal data for the customer. It implements Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). The provider sends a signed copy to the customer on request.
1.1 The controller is the customer, a business or legal entity using gull system under the Terms. The controller decides what personal data it puts into gull system or what its configurators and forms will collect, and what the data is used for.
1.2 The processor is the provider, Daniel Racek, company ID (IČO) 30167825, with the registered address stated in the Terms, e-mail [email protected].
1.3 This DPA covers personal data the provider processes for the controller in providing gull system services ("Personal Data"). It does not cover data the provider processes as a controller in its own right, such as data about the customer account, licence and invoicing. That data is covered by the Privacy Policy.
2.1 The provider processes Personal Data only to provide gull system services to the controller: storing and synchronising the controller's data between its computers, publishing web configurators, receiving orders and enquiries from them and delivering them to the controller's app, receiving orders from forms and spreadsheets, backups, support and troubleshooting.
2.2 The categories of data subjects, the categories of Personal Data and the nature of the processing are described in Annex 1.
2.3 Processing lasts for the term of the services contract and then for as long as needed for deletion under section 11.
3.1 The provider processes Personal Data only on documented instructions from the controller, including with regard to transfers to third countries, unless Union or Member State law requires the processing. In that case the provider informs the controller beforehand, unless that law prohibits it.
3.2 The controller's instructions are this DPA and the Terms, the settings the controller makes in the gull system app (for example the content of forms, publishing and unpublishing a configurator, deleting an order), and instructions the controller sends by e-mail from the address in the customer account.
3.3 If in the provider's opinion an instruction infringes the GDPR or other data protection law, the provider tells the controller without undue delay and need not carry out the instruction until it is clarified.
The provider keeps Personal Data confidential. It ensures that every person with access to Personal Data is bound by confidentiality by contract or by law. Confidentiality survives the end of the contract.
5.1 The provider has implemented the technical and organisational measures under Article 32 GDPR described in Annex 2. It reviews them regularly and may change them as long as the level of security is not reduced. It gives the controller a more detailed description on request, where doing so does not endanger the security of the service.
5.2 The controller is responsible for security on its side, in particular the computers running the gull system app, the account's sign-in details and who it gives access to the account.
6.1 The controller gives the provider general authorisation to engage sub-processors. The provider sends the controller, on request to [email protected], the current list of sub-processors with their name, country, activity and safeguard for transfers outside the European Economic Area. Annex 3 lists the categories of sub-processors.
6.2 The provider notifies the controller of any intended addition or replacement of a sub-processor by e-mail to the account owner at least 30 days in advance. The notice states the name, address, activity and location of processing.
6.3 The controller may object to the change on data protection grounds within 14 days of the notice. The parties then try to find a solution. If they find none by the date the change takes effect, the controller may terminate the affected service as of that date, and the provider refunds the pro-rata part of the subscription for the unused period.
6.4 Where a sub-processor must be replaced immediately for security or continuity of the service, the provider may do so without the period in 6.2. It notifies the controller without undue delay, and the controller has the right under 6.3.
6.5 The provider imposes on every sub-processor, by contract, the same data protection obligations as this DPA sets, in particular sufficient guarantees of security. The provider is liable to the controller for the performance of each sub-processor's obligations as for its own.
The provider transfers Personal Data outside the European Economic Area only to a sub-processor and only where protection under Chapter V GDPR is ensured, by a European Commission adequacy decision or by standard contractual clauses. The list under 6.1 states the safeguard for each sub-processor.
8.1 The provider forwards to the controller, within 5 working days, any request from a data subject concerning Personal Data, and does not answer it on the merits unless the controller asks it to. The controller handles most requests itself in the gull system app, where it can view, correct and delete orders. What cannot be done in the app, the provider does on the controller's instruction.
8.2 The provider gives the controller the information available to it that the controller needs to meet its obligations under Articles 32 to 36 GDPR, in particular on security, breach notification, data protection impact assessment and prior consultation.
8.3 Assistance under this section to a normal extent is included in the price of the services. Assistance beyond that, requested by the controller, may be charged at the rate for custom work, if the provider announces it in advance.
9.1 The provider notifies the controller of a personal data breach affecting Personal Data without undue delay and at the latest within 48 hours of becoming aware of it, by e-mail to the account owner.
9.2 The notice includes, where available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and a contact person. Information not available at once is provided in phases without undue delay.
9.3 The controller notifies the supervisory authority and the data subjects under Articles 33 and 34 GDPR. The provider assists under section 8.
10.1 The controller is responsible for processing Personal Data lawfully, in particular for having a legal basis and for informing data subjects under Articles 13 and 14 GDPR. For a published web configurator this means stating, on the configurator page or on its own website, who processes the order data, and linking to its privacy policy.
10.2 The controller collects only the data it needs. It does not put special categories of personal data under Article 9 GDPR, or data on criminal convictions and offences, into gull system, and does not collect them with a form.
11.1 An order the controller deletes in the app is removed from the provider's server within 30 days at the latest. If it is the controller's highest-numbered order, a record without personal data (number, page name, state and dates) remains until a newer order exists, so that its number is not issued again. Data the controller deletes into the app's trash, or stops sharing, is removed from the server with its files at the latest 30 days later. Files left on the server by data deleted before 7 November 2026 are removed in the deletion under 11.2. When the controller unpublishes a web configurator, the page stops being available and takes no orders. Its versions and files, including 3D data no other page or other data uses, are deleted 30 days after unpublishing. If the controller publishes the page again within that period, it returns at the same address.
11.2 After the contract ends, Personal Data stays on the provider's server for another 30 days so that the controller can retrieve it. If the controller asks within that period, the provider hands it a copy of the Personal Data on the server in a machine-readable format within 14 days of the request. It then deletes the data within 30 days, unless Union or Member State law requires it to be kept. The provider warns the owners of the customer account by e-mail at least 14 days before deleting.
11.3 Deleted Personal Data disappears from backups at the latest 30 days after deletion, when the backups expire. Until then, backups are used for nothing but disaster recovery.
11.4 The provider does not delete data stored on the controller's computers, including orders downloaded into the gull system app. The controller is responsible for that data.
11.5 On request the provider confirms the deletion in writing.
12.1 The provider makes available to the controller the information needed to demonstrate compliance with Article 28 GDPR. It answers a written request within 30 days, usually by completing the controller's security questionnaire or handing over existing documentation.
12.2 If the information under 12.1 demonstrably does not suffice, the provider allows an audit or inspection by the controller or an auditor it appoints. The audit must be announced at least 30 days in advance, takes place at most once every 12 months, during business hours and so as not to disrupt the service or expose other customers' data. The auditor must be bound by confidentiality and must not be a competitor of the provider.
12.3 The controller bears the cost of the audit. If the audit reveals a material breach of this DPA, the provider bears the cost and remedies the breach without undue delay.
12.4 The limits in 12.2 and 12.3 do not apply where a supervisory authority orders the audit or after a personal data breach.
The provider does not use Personal Data for its own purposes, does not sell it, does not pass it on for marketing and does not use it to train artificial intelligence models. To run the service and plan its capacity it monitors only aggregate technical figures without personal data, such as the number of orders or the volume of stored data.
14.1 The parties' liability for damage arising from this DPA is governed by the Terms and the EULA, including the limitation of liability in them.
14.2 This does not affect liability towards data subjects under Article 82 GDPR or liability for damage caused intentionally or by gross negligence.
15.1 On matters of personal data protection, this DPA takes precedence over the Terms and the EULA.
15.2 The provider may change this DPA under the procedure for changing the Terms. A change required by law or by a decision of a supervisory authority may be made with a shorter period where the law or decision allows.
15.3 This DPA is governed by Czech law. It is made in Czech and English. The Czech version prevails.
No special categories of personal data are processed (section 10.2).
Receiving, storing, synchronising between the controller's computers, delivering to the controller's app, displaying, backing up, correcting and deleting.
Servers and data storage in the European Union. The other sub-processors under Annex 3, some of them also in the USA.
The provider sends the controller the list with names, countries and safeguards on request (section 6.1). It announces changes under section 6.2.
The legal documents for gull system in one place.
Who runs the service, how we handle personal data, the contract documents and where you set your consent to traffic measurement. Each document shows when its content last changed. For journalists and partners, the logos are here to download too.
Czech Trade Licensing Register, Trade Licensing Office Děčín
Who operates gull system: name, company ID, registered office, register entry and contact.
What personal data we process, why, on what basis and for how long, who receives it and your rights. Including cookies and the measurement settings.
Sole trader under the Czech Trade Licensing Act
Where the photos on this site come from and who to credit for them.
Photos that gull system did not make itself are listed here with their author, as their licences require.
The silver wave at the top of the site’s pages and in the link preview when the site is shared, and the background of gull system’s LinkedIn page.
How gull system services are ordered, paid for and ended, and what happens to the data afterwards. A draft, not yet in force.
The terms of use of the gull system app. A draft, not yet in force.
This document is in preparation. It is a draft and not yet final or in force. The valid version will be published here.
The gull system logos to download, the colours, a short description of the company and a contact for journalists and partners.
Logos, colours and a short description of gull system for articles, presentations and partner pages. You may use the files when you write about gull system or offer it.
Do not recolour, distort or redraw it. Use the dark logo on light backgrounds and the light logo on dark ones.
The name is always written in lowercase: gull system.
Dark: the logo’s letters, the website’s background
A short description to copy, in Czech and English.
gull system je česká softwarová firma, která strojírenským firmám v měsíčním předplatném nabízí dva produkty. S Web konfigurátory si zákazníci prohlédnou produkty ve 3D přímo na webu výrobce, vyzkouší varianty a pošlou hotovou specifikaci, kterou nikdo nepřepisuje. S CAD konfigurátory konstruktéři přestanou překreslovat stejné díly: pravidla nastaví vzorci jako v Excelu, bez programování, a výkresy, DXF, STEP i kusovník ke každé zakázce pak vzniknou automaticky z CAD modelů, které firma už má.
gull system is a Czech software company offering engineering firms two products on a monthly subscription. With Web configurators, customers see a manufacturer’s products in 3D on its own website, try the variants and send a finished specification nobody has to retype. With CAD configurators, engineers stop redrawing the same parts: they set the rules as Excel-style formulas, with no programming, and the drawings, DXF, STEP and bill of materials for every order are then produced automatically from the CAD models the company already has.
How gull system processes personal data for customers, above all their own customers' orders from web configurators. Sub-processors and security. A draft, not yet in force.