Data processing agreement

Parties and purpose

This agreement is part of the Terms and conditions and is accepted by the Customer at sign-up. The Customer is the controller and Vadim Savchuk, tax ID [tax ID pending] (“PafPaf”), the processor. Its purpose is the processing of personal data needed to provide the PafPaf service.

Duration

It lasts as long as the service contract and then for the time needed to return and delete the data as set out under end of processing.

Nature and purpose of processing

Hosting, storage, organisation, consultation, modification, export and deletion of data to manage the Customer's members, clients, attendance, orders, products and employees, and sending on its behalf the service's transactional emails (email confirmation, access, invitations).

Data and data subjects

• Data subjects: the Customer's members, clients and employees, and contact persons.
• Data: identification and contact data (name, email, phone), member or client number, status and joining dates, attendance records, orders, signature, and copies of identity documents if the Customer chooses to keep them, plus any extra fields the Customer configures.
• The Customer decides which data it enters. If it processes special categories of data (for example health data), it must have a valid legal basis and have assessed the risk; PafPaf will apply the measures of this agreement.

PafPaf's obligations

• Process the data only on the Customer's documented instructions, which are this agreement and its use of the application, including as regards international transfers. If an instruction appears to infringe the law, PafPaf will inform the Customer immediately.
• Ensure that persons authorised to process the data have committed to confidentiality.
• Apply the security measures of Article 32 GDPR: encrypted connections, passwords stored with a one-way hash, separation of each customer's data, least-privilege access control, backups and logging of technical activity.
• Help the Customer respond to data subject requests and comply with Articles 32 to 36 GDPR (security, breach notification, impact assessments and prior consultation), taking into account the information available to PafPaf.
• Notify the Customer of any personal data breach affecting its data without undue delay and in any case within 48 hours of becoming aware of it, with the information available so that the Customer can notify the authority within 72 hours.
• Make available the information needed to demonstrate compliance and allow audits, with reasonable notice and without access to other customers' data.
• Keep a record of the processing activities it carries out as processor.

Sub-processors

The Customer gives PafPaf general authorisation to use the sub-processors listed under Sub-processors. PafPaf will give at least 30 days' notice of any change to the list; the Customer may object on reasonable grounds and, if no agreement is reached, cancel without penalty.

PafPaf binds each sub-processor by contract to the same data protection obligations and remains liable to the Customer for their performance.

International transfers

Data is hosted on servers in the European Union. Where a sub-processor belongs to a group based outside the European Economic Area, the transfer relies on an adequacy decision, such as the EU-US Data Privacy Framework, or on the European Commission's standard contractual clauses.

Requests from authorities

If an authority requests access to the Customer's data, PafPaf will check that the request has a legal basis and, where applicable, a court order, disclose only what is strictly required and inform the Customer, unless the law prohibits it.

Customer's obligations

Have a legal basis for each processing operation, inform data subjects, enter only the data needed, configure its employees' access and carry out an impact assessment where required.

End of processing

When the service ends, PafPaf will make the data available to the Customer for export for 30 days and then delete it, including copies, unless the law requires it to be kept. Backups are erased when their rotation cycle expires.