Data Processing Agreement (DPA)

1.1. This DPA applies to all contracts between Interdevelopment UAB (hereinafter the ‘Provider’) and its clients (hereinafter the ‘Customer’) that contain a reference to this DPA (hereinafter the ‘Contract’), and forms an integral part of such contracts.

1.2. The DPA sets out the terms on which the Provider processes personal data on behalf of the Customer. The Customer is the controller and the Provider is the processor. Terms are used with the meaning given to them in the GDPR and the Contract.

1.3. The Customer is responsible for the lawfulness of the processing, including for the existence of legal bases and for informing data subjects.

1.4. The DPA shall remain in force for the term of the Contract and until the return and deletion of data under Section 8 have been completed.

2.1. Any extension of the list of categories of data subjects or data for a particular Customer (for example, in connection with the launch of a loyalty programme) shall be formalised by a written agreement between the Parties. Additional services related thereto shall be paid for as agreed between the Parties.

3.1. The Provider shall process personal data only on documented instructions from the Customer. The instructions are the Contract, this DPA and tasks assigned in the manner provided for in the Contract. The Provider shall notify the Customer if, in the Provider’s opinion, an instruction infringes data protection law, and is entitled to suspend the execution of that instruction until the Customer confirms or amends it.

3.2. The Provider shall ensure that confidentiality is observed by the persons to whom it has granted access to the data (its employees and sub-processors).

3.3. The Provider shall apply appropriate technical and organisational security measures in accordance with Article 32 GDPR, including access control, backup and protection of communication channels. A description of the measures applied shall be provided to the Customer upon request.

3.4. Taking into account the nature of the processing, the Provider shall assist the Customer in fulfilling data subject requests and the obligations laid down in Articles 32 to 36 GDPR. The Provider shall forward to the Customer without delay any requests received directly by the Provider. Assistance going beyond ordinary technical support (for example, participation in a data protection impact assessment) shall be paid for at an agreed rate.

3.5. The Provider shall notify the Customer of a personal data breach (including the unauthorised disclosure, loss, alteration or destruction of, or unauthorised access to, the personal data) without undue delay, but no later than 48 hours after its discovery. The notification shall contain the information available at that time on the nature of the breach, its likely consequences and the measures taken, as well as the Provider’s contact person.

4.1. A sub-processor is a person to whom the Provider entrusts the processing of the Customer’s personal data, including the hosting or storage of such data or the maintenance of systems with access to such data. Suppliers of ancillary services without access to the Customer’s personal data (communications, accounting, legal and other services) are not sub-processors.

4.2. The Customer gives a general authorisation for the engagement of sub-processors by the Provider. The current list of sub-processors is published at https://interdevelopment.eu/legal/subprocessors/.

4.3. The Provider shall notify the Customer in advance, at the e-mail address specified in the Contract, of the engagement or replacement of a sub-processor. The Customer is entitled, within 14 calendar days, to raise a reasoned objection on grounds relating to data protection. If the Parties do not reach agreement, the Customer is entitled to terminate the Contract without observing the notice period provided for in the Contract.

4.4. The Provider shall impose on sub-processors data protection obligations that meet the requirements of Article 28 GDPR, and shall be liable to the Customer for the performance of those obligations.

5.1. Personal data shall be processed and stored in data centres located in the EU/EEA that are certified to the ISO/IEC 27001 standard.

5.2. The transfer of data outside the EU/EEA is permitted only with the prior written consent of the Customer and subject to compliance with the requirements of Chapter V GDPR.

6.1. The Provider shall provide the Customer with the information necessary to demonstrate compliance with this DPA, primarily in the form of documents, including reports of independent auditors and certificates of sub-processors.

6.2. If the documents are insufficient, the Customer or an auditor mandated by the Customer is entitled to carry out an audit not more than once per calendar year, with at least 30 calendar days’ notice, during working hours and without disrupting the Provider’s operations. The auditor shall sign a confidentiality agreement and may not be a competitor of the Provider. The audit shall not extend to the data of the Provider’s other clients.

6.3. The costs of the audit shall be borne by the Customer.

7.1. The Provider is entitled to amend this DPA by publishing a new version on its website and notifying the Customer by e-mail at least 30 calendar days before the amendments take effect.

7.2. Amendments may not reduce the level of protection of personal data without the Customer’s consent. If the Customer does not agree to the amendments, it is entitled to terminate the Contract before the date on which they take effect, without observing the notice period provided for in the Contract.

7.3. Previous versions of the DPA shall remain available on the Provider’s website.

8.1. Upon termination of the Contract, the Provider shall return the data in the manner provided for in the Contract and shall then delete the copies thereof, unless their storage is required by law. Copies in backup archives shall be deleted in the course of their scheduled rotation, but no later than 90 days.

9.1. The liability of the Parties under this DPA shall be determined by the provisions of the Contract, including the limitation of liability.

9.2. In the event of a conflict between the Contract and this DPA in matters of personal data protection, this DPA shall prevail. The law applicable to the Contract shall apply to the DPA.

9.3. Contact for data protection matters: info@interdevelopment.eu.

9.4. This DPA is published in several languages. In the event of a discrepancy between the language versions, the Lithuanian-language version shall prevail.