Data processing agreement

Introduction

This data processing agreement forms part of the terms of service (/terms) between you (the "customer", controller) and Studio 404 d.o.o., registered seat: Gradišče 15C, 1360 Vrhnika, Slovenia, company no.: 6835228000, VAT ID: SI42531357 (office: Slovenska cesta 55, 1000 Ljubljana, Slovenia) ("we", processor). It applies to personal data we process on your behalf when you use the services listed below, and is intended to meet Article 28 of the General Data Protection Regulation (GDPR). For your own account and order data we are the controller; the privacy policy applies to it.

1. Subject matter and details of processing

Subject matter and purpose: providing the services you use:

• email: mailboxes, email forwarding and the website-package inbox (the messages, addresses and delivery logs of the people who write to you)
• DNS zones of your domains (the records you enter, which can contain names or email addresses)
• your website: the content you publish and the messages visitors send through its contact form
• online booking: the names, contact details and appointments of your clients who book

Duration: as long as you use the service, and then until deletion under section 5.

Data subjects: the people who write to you, visitors and clients of your website, and people whose data you enter.

Special categories of personal data: not intended. Do not process such data through the services unless you have a legal basis and appropriate safeguards.

2. Our obligations

• We process the data only on your documented instructions (the terms, this agreement and your use of the services), unless Union or Member State law requires otherwise; we tell you about that unless the law forbids it.
• The people who have access to the data are bound to confidentiality.
• We take appropriate technical and organisational measures under Article 32: encryption in transit (TLS), encrypted backups of the mail server, access only for staff who need it, hashed passwords and abuse limits.
• Taking into account the nature of the processing, we help you answer requests from data subjects, and with security, breach notification, impact assessments and prior consultation (Articles 32 to 36).
• We notify you without undue delay, and in any case within 72 hours of becoming aware of it, of a personal data breach affecting your data.
• We make available the information needed to demonstrate compliance and allow for audits, conducted through written questionnaires and documentation; on-site audits only where the law requires them, with reasonable notice, at your cost and under confidentiality.
• We tell you if, in our opinion, an instruction infringes data protection law.

3. Sub-processors

You give us general authorisation for the sub-processors listed at /subprocessors. We impose data protection obligations on each that are no less protective than this agreement, and we remain responsible for them. We give at least 30 days' notice of a new or replacement sub-processor by updating that page and emailing the address of your account. Within that period you may object on reasonable data protection grounds; if we cannot agree, you may terminate the affected service.

4. International transfers

Our application and its database are hosted by Railway Corporation in the United States. The mail server is in Germany (Hetzner), and we send email through Amazon SES in Frankfurt. For transfers of personal data out of the EEA we rely on an adequacy decision (the EU-U.S. Data Privacy Framework, where the recipient is certified) or on the EU standard contractual clauses (Commission Decision (EU) 2021/914, Module 2 or 3 as applicable), which are incorporated into this agreement by reference, together with supplementary measures where needed.

5. Return and deletion

When a service ends we delete the data: a mailbox after it has been locked and the period stated in the terms has passed; a website when it is taken offline; DNS records when the domain is no longer with us. We do not store contact-form messages. Copies in the encrypted backups of the mail server are deleted as those backups rotate, within 12 months at most. We keep data longer only where the law requires it.

6. Your obligations

You are responsible for the lawfulness of your own processing, including the legal basis, informing the people concerned (for example in your website's privacy policy) and answering their requests.

7. Liability, precedence and governing law

Liability under this agreement is subject to the limits in the terms of service, except where the law does not allow them. If this agreement conflicts with the terms on data protection, this agreement prevails. Slovenian law applies.

8. Contact

Data protection requests: hello@domainspace.si. For a signed copy of this agreement, write to the same address.