Data Processing Agreement

1.Scope

This DPA applies where the Controller’s use of the Services involves the processing of personal data for which the Controller is the controller. It prevails over any conflicting term on data protection in the Terms of Use.

2.Nature and purpose of processing

The Processor processes personal data to operate an anonymous whistleblowing and case-management channel on the Controller’s behalf under Directive (EU) 2019/1937, including:

• receiving and storing reports, voice messages and attachments;
• enabling two-way, anonymous communication between reporters and the Controller’s handlers;
• tracking acknowledgement and feedback deadlines and producing compliance records and exports.

3.Categories of data and data subjects

Data subjects: reporters (anonymous), persons named within a report, and the Controller’s handlers and administrators.

Personal data: report content and category, voice messages, attachments, case references, handler names and work email addresses, and audit metadata. Reporters are advised not to submit special-category data unless necessary; the Controller instructs the Processor accordingly.

4.Obligations of the processor

The Processor shall:

• process personal data only on the Controller’s documented instructions;
• ensure persons authorised to process are bound by confidentiality;
• assist the Controller with data-subject requests and with its obligations under Articles 32–36 GDPR;
• make available the information needed to demonstrate compliance.

5.Security measures

The Processor maintains appropriate technical and organisational measures, including:

• encryption in transit and at rest, with application-layer encryption of report bodies, MFA secrets and attachments under a key the storage providers do not hold;
• metadata stripping of uploaded files before storage;
• tenant isolation at the database layer and role-based access control;
• an append-only audit log and activity monitoring.

6.Sub-processors

The Controller authorises the Processor to engage the sub-processors below. Each is bound by obligations no less protective than this DPA. The Processor will give notice of intended changes and the Controller may object on reasonable data-protection grounds.

7.Data subject requests

Taking into account the nature of the processing, the Processor assists the Controller by appropriate measures to respond to requests to exercise data-subject rights. Because reporting is anonymous, the Processor may be unable to locate data relating to a reporter without the case reference.

8.Data breach notification

The Processor notifies the Controller without undue delay after becoming aware of a personal-data breach, and provides the information the Controller reasonably needs to meet its obligations under Articles 33–34 GDPR.

9.Data retention

The Processor retains personal data for as long as the Services or the Controller’s instructions require, aligned to the retention period of the Controller’s jurisdiction. On termination, the Processor deletes or returns personal data at the Controller’s choice, save where storage is required by law.

10.International transfers

The Processor processes personal data within the EEA. Where a transfer outside the EEA is necessary, it is made under an adequacy decision or the European Commission’s Standard Contractual Clauses.

11.Audit rights

The Processor makes available information to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor it mandates, on reasonable notice and subject to confidentiality.

12.Contact

Processor: Samarkand Industries OÜ — privacy@republicoftrust.eu.