Data Processing Agreement (DPA)

For this DPA, the Controller is the user or the entity on whose behalf the user uses EZINDRA, to the extent that it determines the purposes and means of processing third-party personal data. The Processor is Albert Fiksak, identified as the provider in the Terms. If the user acts on behalf of another entity, the user represents that they are authorised to enter into this DPA on that entity's behalf.

This DPA forms an integral part of the Terms and is concluded electronically when the Terms are accepted. It applies only to personal data processed by the Processor on behalf of the Controller (the “Entrusted Data”). It does not govern data for which the Processor acts as an independent controller, including account, billing, security and direct user-contact data.

“Applicable Data Protection Law” means the data-protection and privacy laws that apply to the relevant processing, including GDPR where applicable. References to Controller and Processor include equivalent roles under Applicable Data Protection Law where those laws use different terminology.

The processing concerns personal data submitted by the Controller when using EZINDRA. Processing may include storing, organising, retrieving, displaying, synchronising, generating documents and PDF files, securely sharing quotes, sending messages and carrying out operations initiated by the user.

The purpose is solely to provide and secure EZINDRA in accordance with the Terms and the Controller's documented instructions. Processing continues for the period in which the service is used and for the technical and legal period needed to return or delete the data after the service ends.

Data subjects may include customers, prospective customers, contact persons, representatives, employees and other persons whose data the Controller enters into EZINDRA in connection with its activities.

Personal data may include identity and contact data, company or organisation information, addresses, quote, job, service or project information, correspondence, quote-sharing and decision status, and other content or files submitted by the Controller.

EZINDRA is not designed for sensitive or specially protected categories of personal data, including special categories under Article 9 GDPR or data relating to criminal convictions and offences under Article 10 GDPR where those provisions apply. The Controller should not intentionally submit such data without prior agreement with the Processor and an appropriate legal basis and safeguards.

The Processor processes Entrusted Data only on the Controller's documented instructions, including instructions concerning international transfers, unless processing is required by Applicable Data Protection Law. Where legally permitted, the Processor will inform the Controller of such a legal requirement before processing. Instructions include actions performed by the user in the application, account settings and documented requests given to the Processor in connection with the service.

The Controller is responsible for the lawfulness of collecting and submitting personal data to EZINDRA, having an appropriate legal basis, providing required notices to data subjects, the accuracy and lawfulness of its instructions, and using the service in compliance with Applicable Data Protection Law.

If the Processor considers that an instruction infringes Applicable Data Protection Law, it will inform the Controller unless prohibited by law from doing so.

The Processor ensures that persons authorised to process Entrusted Data are bound by confidentiality, applies security measures appropriate to the risk and limits access to what is necessary to provide the service.

Taking into account the nature of the processing and the information available, the Processor assists the Controller within a reasonable scope with data-subject rights and applicable security, breach-notification, impact-assessment and regulatory-consultation obligations, including Articles 32–36 GDPR where applicable.

The Processor makes available information reasonably necessary to demonstrate compliance with this DPA and, where GDPR applies, Article 28 GDPR, and cooperates with reasonable compliance reviews under this DPA.

The Processor applies technical and organisational measures appropriate to the service and risk, including encryption in transit through HTTPS, authentication and access controls, isolation of data between accounts and workspaces, privilege limitation, safeguards against unauthorised operations, logging of relevant security events, and processes for security updates and incident response.

Measures may be developed or replaced by measures providing at least a comparable level of protection where required by security, technical development or infrastructure changes.

After becoming aware of a personal data breach affecting Entrusted Data, the Processor will notify the Controller without undue delay and, as information becomes available, provide information reasonably needed for the Controller to meet its obligations under Applicable Data Protection Law. The Processor will also take reasonable steps to contain the incident and reduce the risk of recurrence.

The Controller gives the Processor general written authorisation to engage sub-processors as necessary to provide EZINDRA. The Processor imposes data-protection obligations on sub-processors that are substantially equivalent to those under this DPA and remains responsible to the Controller for their performance to the extent required by Applicable Data Protection Law.

The current list of providers used by EZINDRA, including those acting as sub-processors, their principal roles and the main processing or transfer locations, is published on the ‘Providers, sub-processors and infrastructure’ page.

The Processor will notify the Controller electronically at the email address associated with the account at least 14 days before an intended addition or replacement of a sub-processor. The notice will identify at least the provider, its role or processing purpose, the intended engagement date and, where relevant to assessing the change, the principal processing or transfer location, and will allow the Controller to raise a reasoned objection on data-protection grounds before that date. The parties will make a reasonable attempt to resolve the objection; if that is not possible, the Controller may discontinue the service before the relevant sub-processor is engaged.

For international transfers of Entrusted Data, the transfer mechanism required by Applicable Data Protection Law will be used. Where GDPR applies and a transfer outside the European Economic Area requires a transfer mechanism, the transfer will be made using a mechanism under Chapter V GDPR, applied by the Processor or the relevant sub-processor depending on the structure of the particular transfer. This may include, in particular, an adequacy decision or standard contractual clauses together with supplementary safeguards where needed.

Information about the basis for a transfer and the safeguards used, including how to obtain a copy or where they have been made available, can be requested at contact@ezindra.com.

If the Processor receives a request from a data subject relating to Entrusted Data, it will not decide the request independently and will forward it to the Controller where legally permitted. The Processor will provide reasonable technical assistance needed to handle the request, taking into account the nature of the processing and the features of EZINDRA.

After the end of services involving processing, the Processor will, at the Controller's choice, return Entrusted Data in a reasonable technically available format or delete it and delete existing copies, unless Applicable Data Protection Law or other binding law requires specific data to be retained. Available export functionality may be used to return the data.

Data remaining solely in rotating backups where selective deletion is not available in the ordinary operation of the system or provider infrastructure will, after deletion from active systems, remain protected and excluded from ordinary use and will be deleted or overwritten according to the normal retention cycle of the relevant backup, unless law requires longer retention. If such a backup is used to restore the system after a failure, the data remains subject to the deletion obligation in this section.

On a reasonable request, the Processor will provide information needed to demonstrate compliance with this DPA. Available security documentation, reports or other compliance evidence may be used first. If that information is insufficient, the Controller may conduct an audit itself or through an independent auditor on reasonable prior notice and in a manner that does not compromise security, other customers' confidentiality or service continuity.

If this DPA conflicts with the Terms in relation to processing of Entrusted Data, this DPA prevails. Changes to the DPA are versioned and communicated as required by law and the Terms; an update to the sub-processor list made in accordance with section 8 does not require a separate DPA. Where a country-specific addendum is expressly identified as applicable to the Controller, that addendum forms part of this DPA and prevails to the extent of a conflict concerning requirements specific to that jurisdiction. DPA contact: contact@ezindra.com.