Data Processing Agreement (template)

This agreement applies where a solution built or maintained by the contractor (for example a booking form, a contact form or an administrative panel) processes the personal data of the client's end users, and the contractor carries out that processing on the client's instructions.

It does not apply where the contractor has no access to end users' personal data, or where the client independently and fully controls the system in question.

The document is a template. It becomes binding only once the parties incorporate it into the agreement (order) for a specific project, with adjustments where needed.

Processor: ФОП Гаталович Олександр Олександрович, RNOKPP 3965902319.

Controller: the client named in the relevant order.

As controller, the client determines the purposes and means of processing end users' personal data and is responsible for having a legal basis for the processing and for informing data subjects.

As processor, the contractor processes such data solely within the scope of the client's instructions and to the extent needed to provide the agreed services.

Subject matter: provision of services for developing, configuring, operating and technically supporting the client's digital solution.

Duration: for the term of the relevant agreement (order), unless the parties agree otherwise.

Categories of data: determined by the functionality of the specific solution. Typically contact and identification data that the end user enters into a form themselves (for example name, phone number, e-mail address, dates and details of a booking request, message text).

Categories of data subjects: the client's end users and customers, and the client's authorised staff who use the administrative interface.

The contractor does not process special categories of personal data on the client's instructions unless expressly agreed separately.

The contractor processes personal data only on the client's documented instructions, including those contained in the relevant order and in the parties' subsequent correspondence, and where processing is required by law.

If the contractor considers that an instruction from the client conflicts with personal data protection legislation, it informs the client without delay.

The contractor ensures that persons with access to personal data are bound by confidentiality and have access only to the extent needed to perform their tasks.

The contractor applies appropriate technical and organisational protection measures, taking into account the nature of the processing and the risks involved, in particular: transmission of data over an encrypted connection, restriction of the circle of persons with access, storage of access keys outside the application code, and application of the data minimisation principle.

The parties acknowledge that no system can be completely secure; the contractor does not guarantee that breaches are impossible.

The client gives general authorisation to engage the technical infrastructure providers needed for the solution to operate (in particular hosting, e-mail delivery and notification services).

The contractor engages such providers only to the extent needed to provide the services and on terms not inconsistent with this agreement. At the client's request, the contractor provides a list of the providers actually engaged for the relevant project.

Infrastructure providers may be foreign companies, so data may be processed and stored outside Ukraine.

The parties take into account the requirements of Ukrainian legislation on cross-border transfers of personal data. The contractor does not claim that separate adequacy decisions or certifications are in place where such documents have not been separately concluded and verified.

On becoming aware of an incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data, the contractor notifies the client without delay and provides the information the client needs to fulfil its obligations as controller.

Taking into account the nature of the processing, the contractor provides reasonable assistance to the client in responding to requests from data subjects exercising the rights granted by Article 8 of the Law of Ukraine “On Personal Data Protection”.

If a data subject's request is sent directly to the contractor, the contractor does not answer it independently but forwards it to the client, unless the parties have agreed otherwise.

After the provision of services ends, the contractor, at the client's choice, hands over the personal data it holds or deletes it, and deletes existing copies, except where retention is required by law.

Where the client independently holds the system and the access credentials, the hand-over obligation is deemed fulfilled by providing the relevant access.

This agreement supplements the contract (order) for the specific project. In the event of a conflict on matters of personal data processing, the provisions of this agreement prevail, unless the parties have expressly agreed otherwise.