Data processing agreement (DPA)

This agreement is concluded between:

01. Purpose and scope

This agreement governs the processing of personal data by TECHINS DIGITAL SRL (the “Company”) on behalf of the Client, in the context of providing the ArgonStack software platform and related services (the “Services”).

The purpose of processing is limited solely to operating the platform and to actions carried out on the Client’s documented instructions.

The Company acts solely as a processor and does not determine or influence the purposes or legal basis of the processing.

02. Client responsibility

The Client:

• Bears sole responsibility for the lawfulness of the processing.
• Determines the legal basis for processing.
• Ensures that all required notices have been given and all consents and permissions obtained.

The Company does not provide legal advice and is not responsible for assessing the Client’s compliance with data protection law.

03. Definitions

Terms used in this agreement have the meaning given in Regulation (EU) 2016/679 (GDPR).

04. Processor obligations

The Company shall:

• Process data only on the Client’s documented instructions.
• Ensure the confidentiality of its staff.
• Implement appropriate technical and organisational security measures.
• Notify the Client without undue delay and, where possible, within 72 hours of becoming aware of a personal data breach.
• Assist the Client with data subject requests.
• Keep records of processing in accordance with Article 30(2) GDPR.

05. Limitation of liability for content and data

The Company is not responsible for the content, accuracy, lawfulness or source of data entered or processed by the Client through the platform.

The Client bears full responsibility for the data it manages.

06. Sub-processors

The Client grants general authorisation to use the sub-processors required to operate the platform. The Company ensures that all sub-processors:

• Are bound by data processing contracts.
• Implement appropriate security measures.
• Comply with the Standard Contractual Clauses (SCCs) where required.

07. Security measures

At a minimum:

• Data encryption.
• Role-based access control.
• Multi-factor authentication for administrators.
• Incident logging and monitoring.
• Backup and recovery procedures.

08. Audits and inspections

The Company provides compliance information on reasonable request.

On-site inspections take place only where required by law or a competent authority, and only with prior written agreement that respects the operational security of the platform.

09. Liability

Each party is solely liable for breaches caused by its own acts or omissions. The Company’s total liability shall not exceed the total fees paid in the last twelve (12) months.

10. Duration and termination

This agreement applies for as long as the Company processes data on the Client’s behalf. On termination, data will be deleted or returned within 90 days unless the law requires otherwise.

11. Governing law and jurisdiction

This agreement is governed by Romanian law. Disputes will be settled by the competent courts at the Company’s registered office in Cluj-Napoca.

Precedence. This agreement prevails over any other terms and conditions relating to data processing.

Annex I. Processing details

Data subjects

The Client’s customers, prospects, partners and end users.

Categories of data

Identification data, contact details, CRM data, technical data.

Nature of processing

Collection, storage, automation, communication, analysis, deletion.

Purpose

Solely the operation of the ArgonStack platform.

Duration

For the duration of the contractual relationship.