Data Processing Agreement

1.1 The Contracting Parties agree that this Agreement is concluded for the purpose of regulating their mutual relations concerning the protection of personal data of natural persons exchanged between the Contracting Parties within the framework of their business cooperation, including compliance with the provisions of Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation – GDPR), as well as other applicable personal data protection regulations within the European Union.

In this Agreement, the following terms shall have the meanings assigned below, and related terms shall be interpreted accordingly.

2.1 Erasure means the permanent destruction or removal of data in a way that prevents their reuse, reading, or reconstruction.

2.2 Further transfer means the transfer of Personal Data, from the Partner to a sub-processor.

2.3 Agreed purposes means the permitted purposes of processing Personal Data, i.e., the purposes for which the data subjects’ personal data may be processed in order to perform the Main Agreement, as defined in Article 4 of this Agreement.

2.4 Member State means a Member State of the European Union.

2.5 EEA means the European Economic Area.

2.6 Data subject means a natural person whose identity can be established directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity, and whose data is processed by the Processor on behalf of the Controller in the performance of the Main Agreement.

2.7 Supervisory Authority means the Croatian Personal Data Protection Agency.

2.8 Adequacy Decision means a positive determination of adequacy by the European Commission with respect to the data protection regime of a country or territory outside the EEA under Article 45 of the GDPR.

2.9 Authorized recipients are the parties to the Main Agreement, employees of each party, and all third parties engaged in fulfilling obligations arising from the provisions of the Main Agreement.

2.10 Main Agreement means the Agreement Client concluded with BIND TECHNOLOGIES by registration and selection of Services via BIND TECHNOLOGIES Platform’s customer portal, including the applicable Terms of Service.

2.11 Partner’s Staff means:

(a) directors, managers, employees, consultants, representatives, agents and/or other staff of the Partner;

(b) directors, managers, employees, consultants, representatives, agents and/or other staff of the sub-processor engaged in accordance with this Agreement.

2.12 Personal Data means any data relating to an identified or identifiable individual that is processed for the Agreed purposes, based on the Main Agreement.

2.13 Description of data processing activities includes the subject matter and duration of processing, the types of personal data, the categories of data subjects, and the agreed purposes of processing.

2.14 International data transfer means any transfer from the EEA to another country or territory outside the EEA.

2.15 Personal data breach means a security breach likely to result in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to exchanged personal data transmitted, stored, or otherwise processed, as well as any breach of this or the Main Agreement provisions relating to data protection, confidentiality, or security, insofar as such breach concerns exchanged personal data.

2.16 Data Protection Impact Assessment means an assessment of the impact of current or future exchanges of personal data on the protection of exchanged personal data and/or the privacy of data subjects.

2.17 Data Protection Regulations means all applicable data protection and privacy laws in force in the Republic of Croatia during the term of the Main Agreement, including the GDPR (EU 2016/679), the Croatian GDPR Implementation Act, the Electronic Communications Act, as amended, and any other regulations, laws, or regulatory decisions in force that bind either Party and relate to personal data, and, where applicable, privacy regulations applicable in the EU.

2.18 Risk means any objectively identifiable circumstance or event with the potential for adverse impact.

2.19 Security event means a change that may affect business and/or the security of systems or data, impacting the confidentiality, integrity, or availability of such data.

2.20 Security incident means any event that has an actual adverse effect on security.

2.21 Security means the state in which the integrity, confidentiality, and availability of information, services, or network entities are guaranteed.

2.22 Standard Contractual Clauses (SCCs) means clauses applicable to the relationship between a data controller and a data processor under Commission Implementing Decision (EU) 2021/915 of 4 June 2021 on standard contractual clauses between data controller and data processor from article 28. para. 7. of Regulation (EU) 2016/679 of European Parliament and Council and article 29. para. 7. of Regulation (EU) 2018/1725 of European Parliament and Council or any other text adopted by the EU that replaces, amends, or supplements the standard contractual clauses’ text adopted under the Commission Implementing Decision (EU) 2021/915.

2.23 Instruction means any written instruction, guideline, or order, including the contents of the Main Agreement, regarding the processing of Personal Data issued by the Company as Controller to the Partner as Processor.

2.24 The terms Commission, Controller, Processing, Processor, Sub-processor, and Special categories of personal data shall have the same meaning as in data protection law, and related terms shall be interpreted accordingly.

2.25 Unless expressly stated otherwise in this Agreement, all references to the Agreement or provisions thereof shall be deemed to refer to the provisions of this Data Processing Agreement.

3.1 This Agreement establishes the framework for the exchange of personal data between the Company and the Partner, based on the provisions of the Main Agreement. Under the Main Agreement, the Partner provides services to the Company which, for the purposes of fulfilling the Main Agreement, require access to employees’ personal data.

3.2 The Parties agree that the Partner shall receive and process Personal Data on behalf of and according to the business needs of the Company, for the Agreed purposes and obligations under the Main Agreement, where the Partner acts as Processor and the Company as Controller.

3.3 The Partner undertakes to act in compliance with all applicable Data Protection Regulations and process Personal Data solely on the basis of the Main Agreement and the Company’s written or documented instructions, except where processing is required to comply with a legal obligation under Croatian or EU law. If allowed under the strict provisions under which additional processing of Personal Data is required, the Partner shall promptly inform the Company on such processing cases.

3.4 If, in the Partner’s reasonable business judgment, an instruction appears contrary to Data Protection Regulations, the Partner shall immediately inform the Company, and the Parties shall cooperate to resolve the matter in compliance with data protection law.

3.5 The Company hereby authorizes the Partner to process Personal Data for fulfilling obligations under the Main Agreement and in line with the Agreed purposes.

4.1 Categories of data subjects: End users of Client’s services, Client’s employees, contractors, or business contacts

Type of personal data: Identification numbers, contact details, transaction data, logs, and other data submitted through the Platform

Agreed purposes: provision of Services under the Agreement

Duration of processing: the term of the Agreement and any post-termination period required by law

The Company undertakes to:

(a) ensure that all Personal Data provided to the Partner are collected on a valid legal basis and that all Instructions issued during the execution of this Agreement are lawful and compliant with Data Protection Regulations;

(b) ensure that all Personal Data provided to the Partner are complete, accurate, and up to date.

6.1 The Partner undertakes to:

(a) ensure that access to Personal Data is provided solely in the agreed manner, using security mechanisms and standards at least equivalent to those applied by the Company;

(b) ensure that all persons with access to Personal Data have received training on data protection;

(c) restrict access strictly to individuals who need it to perform services under the Main Agreement;

(d) ensure Partner’s Staff are bound by confidentiality or by statutory obligations for personal data confidentiality;

(e) take all reasonable steps to assist and support the Company in complying with and acting per the requirement of the GDPR and other applicable regulations, including security measures in processing, breach notifications to Supervisory Authority, notifying data subjects on personal data breach, conducting personal data processing impact assessments, and prior consultations, where such alignment for compliance is required and related to Personal Data and activity under the Main Agreement;

(f) maintain records of data processing activities in compliance with Data Protection Regulations;

(g) comply with Supervisory Authority requirements and provide assistance to the Controller in its dealings with the Authority in relation to Personal Data.

7.1 The Partner shall, considering Risks related to probability and degree of endangerment of rights and freedoms of individuals that may occur, implement appropriate technical and organizational measures proportionate to the Risks, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage of Personal Data. Such measures include: (i) pseudonymization and encryption, (ii) ensuring permanent confidentiality, integrity, availability and resilience od the processing system, (iii) ability to restore Availability and access to Personal Data in case of physical or tecnichal incident, and (iv) process for regular testing, grading and assessing the effectiveness of technical and organisational measures ensuring the security of processing.

7.2 Partner’s organisational and technical measures, that will be implemented in its systems in which Personal Data is used, shall include, without limiting: (i) identifying and assessing all Risks; (ii) protecting systems containing Personal Data; (iii) detecting Security Events; (iv) responding to Security Incidents; (v) recovering systems containing Personal Data post-Security Incident.

7.3 The Company is entitled to audit the Partner’s compliance with relevant data protection regulations in processing Personal Data for Agreed Purposes, via questionnaires on compliance with GDPR and information security status or direct review by on-site visit with 30 days’ prior written notice.

8.1 The Partner shall immediately notify the Company of any Security Event or Incident suspected to be a Personal Data Breach.

8.2 Such Security Event or Incident notification shall include:

(a) circumstances and facts, including the quantity, type and categories of Personal Data affected by Security Event or Incident;

(b) contact details of Partner’s Data Protection Officer or representatives responsible for the internal investigation;

(c) assessment of consequences or potential consequences that may arise from the breach;

(d) measures taken by Partner and Partner’s Staff to mitigate or eliminate the consequences of the Security Incident or potential security breach.

8.3 In case of Security Incident, the Partner shall take all necessary measures to reduce the personal data breach and mitigate damage occurred to that may occur due to Security Incident.

8.4 The Company will cooperate with the Partner to eliminate all negative consequences of the Security Incident, stopping breaches, recovering Personal Data, and eliminating errors or vulnerabilities that may have caused the Security Incident.

9.1 The Partner shall implement technical and organisational measures to enable compliance in responding to data subject’s exercising their rights relating to Personal Data under Data Protection Regulations and assist and support the Company in responding to such requests.

9.2 The Partner shall promptly notify the Company of any Data Subject request on Personal Data received under the Data Protection Regulations and forward the original request in unaltered form.

9.3 At the Company’s request, the Partner shall promptly provide copies of Personal Data in a readable form or, per Company’s choice, allow access to them at any time.

9.4 The Partner shall, upon Company’s request, immediately amend, rectify or erase Personal Data as prescribed under the Main Agreement or Data Protection Regulations.

10.1 Upon termination of the Main Agreement, the Partner shall, at the Company’s choice, return all Personal Data at its disposal, received or processed under the Main Agreement, or delete/destroy them or ensure they are deleted/destroyed.

11.1 The Partner may engage sub-processors only with prior written approval of the Company.

11.2 Such engagements with sub-processors must include a written agreement containing provisions prescribed by GDPR Article 28, ensuring the same level of data protection as this Agreement.

The Partner shall support the Company in conducting Data Protection Impact Assessments relating to Personal Data, if required under the GDPR, and in any prior consultations with Supervisory Authorities required under GDPR article 35. or 36.

13.1 The Parties agree that the Partner shall not transfer Personal Data outside the EEA. If exceptionally required, transfers shall only occur with the Company’s prior written consent and only if:

(a) an Adequacy Decision applies; or

(b) SCCs or equivalent agreements are in place.

14.1 Regular business contact details of employees (e.g., business email, phone number, role, etc.) exchanged under this Agreement and the Main Agreement will be processed only as necessary for maintaining usual business communication relating to the performance of the business relationship.

15.1 Section headings are for convenience only and do not affect interpretation of provisions in this Agreement.

15.2 The SCCs concerning data transfers between Controller and Processor shall automatically cease upon termination of the Main Agreement.

15.3 Obligations regarding processing and transfer of Personal Data under the Main Agreement remain valid after termination of the Main Agreement.

15.4 Any breach of this Agreement constitutes a breach of the Main Agreement.

15.5 The Party may notify in writing the other Party on the need to amend this Agreement to ensure compliance with Data Protection Regulations.

15.6 Invalidity of any provision does not affect the validity of the remaining provisions of this Agreement. The Parties shall replace invalid provisions with valid ones. If agreement on replacing provisions is not achieved, applicable statutory provisions shall apply in place of the invalid provisions.

15.7 This Agreement is made in electronic form, available to each Party.

This Agreement is concluded and applies in accordance with Section 6.3. of BIND TECHNOLOGIES’ Terms of Service

If the Client so requires, executed copies can be exchanged by email, as specified in above stated Section 6.3.