Data Processing Agreement (DPA)

Last updated: 2026-06-30

This DPA forms part of the Terms of Service between OÜ OPSKAP SYSTEMS (“Processor”) and the customer (“Controller”) and applies where we process personal data on the Controller’s behalf.

Roles & instructions

The Controller determines the purposes and means; the Processor processes personal data only on the Controller’s documented instructions, which include providing the Service.

Processor obligations

• process personal data only on documented instructions;
• bind authorised personnel to confidentiality;
• implement appropriate technical and organisational measures (Art. 32);
• assist with data-subject requests, breach notification and DPIAs;
• notify the Controller without undue delay (within 72 hours of awareness) of a personal-data breach;
• delete or return personal data at the end of the services within 30 days, subject to legal retention.

Sub-processors

The Controller grants general authorisation to the sub-processors in the Privacy Policy. We give at least 30 days’ notice of changes; the Controller may object on reasonable data-protection grounds and, failing resolution, terminate the affected Service. We remain liable for our sub-processors.

International transfers

Transfers outside the EEA are covered by adequacy decisions, the EU Standard Contractual Clauses, or the UK IDTA, with appropriate safeguards.

Annex 1 — Details of processing

• Subject matter: provision of the OPSKAP OS service. Duration: the term of use plus the deletion period.
• Nature & purpose: hosting, storing, organising and transmitting personal data for operational, invoicing and document features.
• Data subjects: the Controller’s clients, contacts, employees and contractors.
• Data: identification and contact details, business and financial details, uploaded document contents. No special-category data intended.

Annex 2 — Security measures

Row-level security and per-user isolation; encryption in transit (TLS); private file storage with signed-URL access; access controls and least privilege; regular backups; breach-response procedures.

Execution

To execute a signed DPA, contact [[email protected] — your real contact email].

This document is provided for convenience and is not legal advice.