Data Processing Agreement
DATA PROCESSING AGREEMENT
This Data Processing Agreement ("DPA") forms part of the agreement between Interactive32 doo, a company incorporated in Serbia ("Processor"), and the customer using our services ("Controller").
This DPA applies to the extent that the Processor processes Personal Data on behalf of the Controller in connection with the provision of the Service. Where the Service does not involve the processing of Personal Data, the obligations in this DPA shall not apply.
1. Scope
This DPA applies where the Processor processes Personal Data on behalf of the Controller in connection with the Service.
The Processor acts as a processor and the Controller acts as a controller for such Personal Data.
2. Processing Details
Subject matter: Provision, maintenance and security of the Service, including processing necessary to generate results and manage customer accounts.
Duration: Processing will continue for the duration of the Controller's use of the Service and for any additional period required by applicable law.
Nature and purpose: The Processor processes Personal Data to provide and secure the Service, manage accounts, provide customer support, prevent abuse, monitor service performance, and maintain service records.
Personal Data: The Personal Data may include names, email addresses, IP addresses, account and service usage information, and technical or log information.
Data subjects: Data subjects may include the Controller's users, employees, contractors and other individuals whose Personal Data is provided to the Processor through the Controller's use of the Service.
The Processor will process Personal Data only on the Controller's documented instructions, except where processing is required by applicable law.
The Controller is responsible for determining the purposes and lawful basis of processing and for providing appropriate instructions to the Processor.
3. Confidentiality
The Processor will ensure that persons authorized to process Personal Data are subject to appropriate confidentiality obligations.
4. Security
The Processor will implement appropriate technical and organizational measures designed to protect Personal Data against unauthorized access, loss, destruction, alteration or disclosure.
5. Sub-processors
The Controller authorizes the Processor to use Sub-processors where reasonably necessary to provide, maintain or secure the Service.
Upon request, the Processor shall make available to the Controller an up-to-date list of all Sub-processors used to process Personal Data.
The Processor shall notify the Controller of any material changes to its Sub-processors where required by applicable data protection law. The Controller may object to the change on reasonable data protection grounds by written notice.
The Processor will require Sub-processors to comply with appropriate data protection and confidentiality obligations and remains responsible for their performance.
6. Assistance
Taking into account the nature of the processing, the Processor will reasonably assist the Controller with data subject requests, security, personal data breaches, data protection impact assessments and regulatory consultations.
7. Personal Data Breaches
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting Personal Data processed on behalf of the Controller and will provide reasonably available information necessary for the Controller to meet its obligations.
8. International Transfers
Where Personal Data relating to an EU or UK Data Subject is transferred outside the EEA or the United Kingdom, it shall be processed only by entities which:
* are located in a country or territory recognised as providing an adequate level of protection under applicable data protection law;
* are subject to Standard Contractual Clauses or other approved contractual safeguards, where required; or
* are otherwise subject to legally recognised appropriate safeguards.
Where required by applicable data protection law, the Parties agree to cooperate in implementing an appropriate transfer mechanism, including the EU Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum or other approved safeguards.
9. Audits
The Processor will provide information reasonably necessary to demonstrate compliance with this DPA.
The Controller may conduct reasonable audits where necessary to verify compliance, subject to reasonable prior notice and appropriate confidentiality and security requirements.
Audits should, where reasonably possible, be conducted through documentation or remote review. On-site inspections may be conducted where reasonably necessary and cannot reasonably be replaced by remote review.
10. Deletion of Personal Data
Upon termination of the Service, the Processor will delete Personal Data processed on behalf of the Controller, unless applicable law requires continued retention.
The Processor may retain limited information where necessary for legal, security, fraud-prevention or accounting purposes.
Unless a longer retention period is required or permitted by applicable law, the Processor will retain Personal Data processed on behalf of the Controller for a maximum period of 90 days from the date of collection or the date the relevant processing activity is completed. Upon expiry of this period, the Processor will delete or anonymize the Personal Data
11. Data Protection Laws
The Parties will comply with applicable data protection laws, including, where applicable:
* the EU General Data Protection Regulation (EU) 2016/679 ("GDPR"); and
* the UK General Data Protection Regulation ("UK GDPR").
12. Liability
The liability of the Parties under this DPA is subject to the limitations and exclusions contained in the agreement governing the Service, except to the extent prohibited by applicable law.
13. Duration
This DPA remains in effect for as long as the Processor processes Personal Data on behalf of the Controller.
14. Updates to this DPA
The Processor may update this DPA from time to time to reflect changes in its processing practices, the Service, or applicable data protection laws. Any updates will be made available on this page. The Processor will not make changes that materially reduce the data protection obligations applicable to the processing of Personal Data under this DPA.
Effective: 2026-10-08
If you have any questions, please contact us at [email protected]