Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between SIA «Vietne» (“Processor”) and the Customer (“Controller”) and governs the processing of personal data by Otnox on behalf of the Customer in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR).

1. Definitions

“Personal Data”, “Controller”, “Processor”, “Processing”, “Data Subject”, and “Supervisory Authority” have the meanings given in the GDPR (Regulation (EU) 2016/679).

“Customer Data” means any personal data submitted to or processed through the Otnox platform by or on behalf of the Customer.

2. Scope and Purpose

2.1 The Processor shall process Customer Data only for the purpose of providing the Otnox platform and related services as described in the Terms of Service.

2.2 The Processor shall not process Customer Data for any other purpose without the prior written consent of the Controller.

2.3 The subject matter, nature, purpose, and duration of processing, as well as the types of personal data and categories of data subjects, are set out in Annex 1 to this DPA.

3. Controller’s Obligations

3.1 The Controller represents and warrants that:

• It has a valid legal basis under GDPR for processing the personal data it submits to the platform.
• It has provided all required notices and obtained all necessary consents from data subjects.
• Its instructions to the Processor comply with applicable data protection law.

4. Processor’s Obligations

4.1 The Processor shall:

• Process Customer Data only on documented instructions from the Controller, unless required to do so by applicable law.
• Ensure that persons authorized to process Customer Data are bound by confidentiality obligations.
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR.
• Not engage sub-processors without prior written authorization from the Controller, except as set out in Annex 2 (Authorized Sub-processors).
• Assist the Controller in responding to data subject requests under Chapter III of GDPR, to the extent technically feasible.
• Assist the Controller in ensuring compliance with obligations under Articles 32–36 GDPR (security, breach notification, DPIA).
• At the choice of the Controller, delete or return all Customer Data upon termination of the service, and delete existing copies unless retention is required by law.
• Make available all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits conducted by the Controller or its designated auditor, with reasonable notice.

5. Sub-processors

5.1 The Controller grants the Processor general authorization to engage the sub-processors listed in Annex 2.

5.2 The Processor shall inform the Controller of any intended additions or replacements of sub-processors at least 14 days in advance. The Controller may object to such changes in writing within that period.

5.3 The Processor shall impose data protection obligations equivalent to those in this DPA on all sub-processors.

6. Security

6.1 The Processor shall implement and maintain appropriate technical and organizational measures including:

• Encryption of personal data in transit (TLS) and at rest (AES-256).
• Access controls and role-based permissions limiting data access to authorized personnel.
• Regular security assessments and vulnerability testing.
• Incident response procedures and business continuity measures.

7. Personal Data Breaches

7.1 The Processor shall notify the Controller without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting Customer Data.

7.2 Such notification shall include, to the extent available: the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed.

8. Data Subject Rights

8.1 The Processor shall promptly notify the Controller if it receives a request from a data subject exercising rights under GDPR.

8.2 The Processor shall not respond to such requests directly unless authorized by the Controller or required by law.

8.3 The Processor shall provide reasonable assistance to enable the Controller to fulfill its obligations to respond to data subject requests within statutory timeframes.

9. International Transfers

9.1 The Processor shall not transfer Customer Data outside the European Economic Area (EEA) without the Controller’s prior written consent, except where transfers are covered by an adequacy decision or appropriate safeguards such as Standard Contractual Clauses (SCCs) under Article 46 GDPR.

9.2 Transfers to sub-processors outside the EEA (as listed in Annex 2) are covered by SCCs incorporated by reference into the agreements with each such sub-processor.

10. Term and Termination

10.1 This DPA shall remain in force for the duration of the Terms of Service.

10.2 Upon termination of the Terms of Service, the Processor shall, at the Controller’s choice, delete or return all Customer Data within 30 days, unless longer retention is required by applicable law.

11. Governing Law

This DPA is governed by the laws of the Republic of Latvia. Any disputes shall be subject to the exclusive jurisdiction of the courts of Riga, Latvia.

Annex 2 — Authorized Sub-processors