Data Processing Agreement (DPA)

This DPA forms part of the Terms of Service between OÜ OPSKAP SYSTEMS (“Processor”) and the customer (“Controller”) and applies where we process personal data on the Controller’s behalf.

Roles & instructions

The Controller determines the purposes and means; the Processor processes personal data only on the Controller’s documented instructions, which include providing the Service.

Processor obligations

• process personal data only on documented instructions;
• bind authorised personnel to confidentiality;
• implement appropriate technical and organisational measures (Art. 32);
• assist with data-subject requests, breach notification and DPIAs;
• notify the Controller without undue delay (within 72 hours of awareness) of a personal-data breach;
• delete or return personal data at the end of the services within 30 days, subject to legal retention.

Sub-processors

The Controller grants general authorisation to the sub-processors in the Privacy Policy. We give at least 30 days’ notice of changes; the Controller may object on reasonable data-protection grounds and, failing resolution, terminate the affected Service. We remain liable for our sub-processors.

International transfers

Transfers outside the EEA are covered by adequacy decisions, the EU Standard Contractual Clauses, or the UK IDTA, with appropriate safeguards.

Annex 1 — Details of processing

• Subject matter: provision of the OPSKAP OS service. Duration: the term of use plus the deletion period.
• Nature & purpose: hosting, storing, organising and transmitting personal data for operational, invoicing and document features.
• Data subjects: the Controller’s clients, contacts, employees and contractors.
• Data: identification and contact details, business and financial details, uploaded document contents. No special-category data intended.

Annex 2 — Security measures

Row-level security and per-user isolation; encryption in transit (TLS); private file storage with signed-URL access; access controls and least privilege; regular backups; breach-response procedures.

Execution

To execute a signed DPA, contact [email protected].