Data processing agreement

The customer named in the executed order is the controller, or an authorized processor acting for its controller. The Kosovo supplier in the Imprint is the processor, or subprocessor as appropriate. This DPA covers personal data processed to provide FiberAdmin for the term of the service agreement and any agreed return/deletion period. Data protection law and applicable standard contractual clauses take precedence over inconsistent contract terms.

This public framework requires an executed order and completed Annexes A–C. It does not itself execute standard contractual clauses or establish a lawful international-transfer arrangement.

The supplier processes data only on documented customer instructions, including international-transfer instructions, unless applicable law requires otherwise; it informs the customer of that requirement beforehand unless legally prohibited. The agreed service configuration and authorized customer actions are instructions within the agreed scope. The supplier promptly flags an instruction it believes infringes applicable data protection law.

People authorized to process data must be subject to a binding confidentiality duty and receive access only as necessary for their role. The supplier does not use customer personal data for independent advertising or model training without a separately lawful arrangement and transparent notice.

The supplier implements the appropriate technical and organizational measures recorded in completed Annex B, taking account of the risks and Article 32 GDPR. Measures must maintain appropriate confidentiality, integrity, availability and resilience and include periodic evaluation. Security changes must not materially reduce the agreed protection.

Taking account of the nature of processing and information available, the supplier assists with data-subject requests, security obligations, breach notifications, impact assessments and prior consultation. It forwards requests concerning customer data without undue delay and does not respond on the customer's behalf unless instructed or legally required.

The supplier notifies the customer without undue delay after becoming aware of a personal-data breach affecting customer data. Available information includes its nature, affected categories and approximate numbers, likely consequences, contact point and mitigation measures. Information may be provided in stages without undue further delay. The supplier cooperates with investigation and remediation. It does not wait 72 hours to notify the customer; the customer's own regulatory notification deadline is separate.

The customer may grant general written authorization for the providers expressly identified in completed Annex C. The supplier informs the customer in writing of intended additions or replacements at least 30 days in advance, giving a genuine opportunity to object on reasonable data-protection grounds before the change. The parties seek a suitable alternative; if none is available, the customer may terminate the affected service before the change takes effect.

Each approved subprocessor is bound by a written agreement imposing equivalent applicable data-protection obligations. The supplier remains responsible for performance of those obligations. Optional providers are authorized only for the enabled features and agreed processing. Paddle's independent merchant-of-record processing is not automatically subprocessing of workspace data.

No transfer or remote access outside authorized locations is permitted without the customer's documented authorization and a valid Chapter V mechanism where required. Complete the appropriate standard contractual clauses, parties, modules, competent authority, annexes and transfer-impact assessment as applicable; identify supplementary safeguards. Kosovo is not currently covered by an EU adequacy decision. Stating that an EU region is used is insufficient to settle operator or support access from Kosovo.

The supplier makes available information necessary to demonstrate compliance and allows and contributes to audits and inspections by the customer or its mandated independent auditor, with reasonable confidentiality and security arrangements. Such arrangements must not frustrate mandatory audit rights or an urgent investigation.

At the customer's choice, the supplier returns or deletes personal data after the service ends and deletes copies, unless applicable law requires retention. The completed schedule must specify export format, the agreed window, active-system deletion, backup isolation/expiry and confirmation of deletion. Retained data are restricted to the legally required purpose. The supplier must not represent an unimplemented deletion process as completed.

Subject and purpose: hosted business field operations, scheduling, record storage, reporting and customer-selected features. Operations: collection, recording, organization, storage, retrieval, disclosure to authorized users/providers, export and deletion. Frequency: continuous service access and customer-triggered actions. Duration: the executed agreement plus its documented return/deletion period.

Data subjects: customer users, employees and contractors, end customers and business contacts. Data categories: identifiers, business contact and employment information, time/leave records, client addresses, work orders, messages, location, photos and signatures as enabled. Special-category and criminal-conviction data are outside the intended scope unless expressly agreed with additional safeguards. Complete: customer legal entity/address, controller contact, authorized instructions, enabled features, categories, purposes, lawful bases and exact retention periods.

Complete with deployment evidence: infrastructure and regions; encrypted transport and storage configuration; administrator MFA and privileged-access process; tenant authorization tests; incident contacts and escalation; logging scope and retention; backup frequency, region, retention and restoration test; vulnerability/patch handling; personnel confidentiality; physical/provider controls; device and shared-link controls; deletion and export procedures; business continuity. Application roles alone are not a complete security annex.

Use the service-provider register as an inventory, then record each contracted legal entity, purpose, data categories, processing and support countries, signed DPA date, onward processors, applicable transfer mechanism and assessment reference. Include the actual frontend hosting provider. Obtain the customer's written authorization and execute the DPA using the agreed signature or electronic acceptance process. Keep the signed version and version history.