Back

Data Processing Agreement (GDPR) – BidCraft.io

Data Processing Agreement (DPA)

Version: 1.0

This DPA forms an integral part of the BidCraft.io Service Agreement/Terms and is concluded in documentary form by acceptance (checkbox) during the order process.

§1. Roles of the parties

  1. The Customer is the Controller of personal data processed in connection with data entered into the Service.
  2. BidCraft.io (the Provider) is the Processor.

§2. Subject and duration of processing

  1. The Controller entrusts the Processor with the processing of personal data in connection with the provision of the SaaS Service.
  2. Processing continues for the term of the Agreement and for any technically justified period of data deletion thereafter, as set out in §10.

§3. Scope: categories of data, data subjects and processing activities

  1. Data subjects: the Controller’s employees/collaborators, contact persons of counterparties, system users, and other individuals whose data the Controller enters into the Service.
  2. Categories of data: identification and contact data (e.g. name, email, phone), organisational data (job title, company), account identifiers, event logs, IP address, and other data entered by the Controller.
  3. Processing activities: recording, storage, organisation, retrieval (incidentally for support), modification (on Controller instructions), deletion.

§4. Controller instructions

  1. The Processor processes data only on documented instructions from the Controller, unless required by law.
  2. Instructions include in particular: Service configuration, User actions, support requests, and instructions communicated in writing (email/ticket).

§5. Confidentiality and authorisation

  1. The Processor ensures that persons authorised to process data are bound by confidentiality.
  2. Access to data is limited to what is necessary (least privilege).

§6. Support access to DB/logs

  1. The Processor may access logs and/or the database only where necessary for: (a) diagnosing and resolving reported issues, (b) security and continuity, (c) incident response.
  2. Access is generally provided upon the Controller’s request; in emergencies, the Controller is informed without undue delay.

§7. Security measures (Art. 32 GDPR)

The Processor implements appropriate technical and organisational measures, in particular:

  1. encryption in transit (TLS/HTTPS),
  2. access control and roles,
  3. monitoring and event logging,
  4. infrastructure safeguards and updates,
  5. incident response procedures.

§8. Subprocessors – OVH

  1. The Controller consents to the use of subprocessor OVHcloud (OVH) for hosting/infrastructure.
  2. The Processor ensures that OVH provides at least equivalent data protection measures.
  3. The Processor will inform the Controller of any change of subprocessor at least 14 days in advance, allowing the Controller to object on justified grounds.

§9. Transfers outside the EEA

  1. Data is processed within the EEA as a rule.
  2. Where a transfer outside the EEA is necessary, the Processor will ensure an appropriate legal basis (e.g. SCCs) and inform the Controller.

§10. Deletion/return of data after termination

  1. After termination of the Agreement, the Processor deletes personal data or provides the Controller with the possibility to export it, where the Service supports it.
  2. Data may be retained longer only where required by law.

§11. Assistance with data subject rights and Controller obligations

  1. The Processor assists the Controller, where possible, in fulfilling data subject rights (Arts. 12–22 GDPR) and in impact assessments and consultations, where relevant.
  2. The scope of assistance is limited by the technical capabilities of the Service.

§12. Data breaches

  1. The Processor notifies the Controller of a personal data breach without undue delay after becoming aware of it, together with available information needed to comply with Arts. 33–34 GDPR.

§13. Audits

  1. The Controller may audit no more than once per year, after agreeing a date (at least 14 days’ notice).
  2. Audits must not compromise the security of other customers or the Processor’s business secrets.
Back