DRAFT – for legal review. The platform is English only; a Bulgarian version is kept for the lawyer in docs/legal/.
1. Roles
1.1. The Customer is the controller, and ANB Consult Ltd, VAT BG208982488, Bratiya Miladinovi 12, 4230 Asenovgrad, Bulgaria (the "Provider") its processor, for personal data that the Customer enters, uploads or collects through the Service: passports, models, documents and their reading by AI, supplier requests, and access requests to its passports that the Customer decides. 1.2. The Provider is a controller for personal data that it processes for its own purposes: user accounts and sign-in, logs, company registration, authorisations and acceptance of legal documents, invoicing, support tickets and other communication with the Customer, the website contact form, notices of illegal content and access requests that the Provider decides itself under section 4.2 of the terms. Its privacy notice describes that processing. 1.3. Terms used here have the meaning given in Regulation (EU) 2016/679 ("GDPR") and in the terms of use.
2. Description of processing
2.1. Subject and purpose: providing the Service to the Customer under the terms of use, and nothing else (Article 78(d) of Regulation (EU) 2023/1542). 2.2. Nature: hosting, storage, structuring, display, transmission, backup, access control, logging and deletion; reading of documents by AI when a user starts it. 2.3. Duration: the term of the contract and the transition and retrieval periods under section 6 of the terms, then section 3.7. 2.4. Data subjects: users and contact persons of the Customer; contact persons of its suppliers, importers and manufacturers; signatories named in passport documents; persons named in documents the Customer uploads. 2.5. Data categories: names, business e-mail addresses and phone numbers, roles and functions; the content of documents the Customer uploads. The Customer does not provide special categories of personal data or personal data of end users of batteries (section 3.15 of the terms). Battery usage data is processed without an owner identifier.
3. Processor obligations
3.1. The Provider processes personal data only on the Customer's documented instructions, including on transfers to third countries. The instructions are this agreement, the terms and the Customer's settings and actions in the platform. Further instructions must be in writing and are carried out only if they are technically feasible and compatible with the Service; the Provider may charge for work they require. If Union or Member State law requires other processing, the Provider informs the Customer before processing, unless that law prohibits it. 3.2. The Provider informs the Customer if, in its opinion, an instruction infringes data protection law, and may refuse to carry it out. 3.3. The Provider ensures that persons authorised to process the data are bound by confidentiality. 3.4. The Provider applies the technical and organisational measures in Annex 1. It may replace a measure with an equivalent one if the overall level of protection does not decrease. 3.5. The Provider notifies the Customer without undue delay after becoming aware of a personal data breach concerning the Customer's data, and aims to do so within 48 hours. The notice states, as far as known: the nature of the breach, the categories and approximate number of persons and records concerned, the likely consequences and the measures taken or proposed. Information not yet known follows when available. A notice is not an admission of fault or liability. 3.6. Taking into account the nature of the processing and the information available to it, the Provider assists the Customer with data subject requests and with its obligations under Articles 32 to 36 GDPR, mainly through the functions of the platform. The Provider forwards to the Customer any data subject request it receives about the Customer's data and does not answer it itself. Assistance beyond the functions of the platform is charged at the Provider's usual rates, unless it is needed because of a breach of this agreement by the Provider. 3.7. After the contract ends, the Customer may export its data for 30 days; after a switch, this period starts when the transition period ends. The export is the return of the data. The Provider then deletes the personal data it processes for the Customer from its live systems within 30 days, unless Union or Member State law requires its storage. Copies in database backups are overwritten in their normal rotation: daily copies after 35 days, monthly copies after 400 days. Published passport versions and their copies are kept for the period in section 5.2 of the terms, because Regulation (EU) 2023/1542 requires them to stay available.
4. Sub-processors
4.1. The Customer gives general authorisation for the sub-processors that the Provider lists in the "Switching and data portability information". On the date of this agreement they are: hosting – [to be completed]; document and backup storage – [to be completed]; e-mail – Google Workspace (Google); reading of documents a user gives to the AI, in an EU region only – [to be completed]. 4.2. The Provider informs the account owners by e-mail at least 30 days before it adds or replaces a sub-processor. Within that period the Customer may object in writing on reasonable data protection grounds. If the parties do not agree, the Customer's only remedy is to end the contract before the change takes effect; section 7.4 of the terms applies. 4.3. If a sub-processor stops its service, or must be replaced at once to keep the Service secure or available, the Provider may replace it without the notice under 4.2 and informs the account owners afterwards. 4.4. The Provider binds each sub-processor by contract to data protection obligations that protect the data at least as well as this agreement, and remains liable to the Customer for them under Article 28(4) GDPR, within the limits of section 9 of the terms.
5. Data location
5.1. Data is processed and stored only in the European Union, except (a) where users of the Customer, the public or third parties authorised under section 4.2 of the terms view or download it from outside the Union, and (b) e-mail sent through the e-mail sub-processor named in 4.1, which may process the messages, including the recipient's name and e-mail address and the content of the message, outside the Union, including in the United States. 5.2. Transfers under 5.1(b) are made under the sub-processor's data processing terms and rely on an adequacy decision of the European Commission, the standard contractual clauses or another mechanism permitted by Chapter V GDPR. The Service's database, documents and backups stay in the European Union.
6. Audit
6.1. The Provider makes available the information needed to demonstrate compliance with Article 28 GDPR, first by its description of technical and organisational measures (Annex 1) and the summary of its latest security review. 6.2. If that information is not sufficient, the Customer, or an independent auditor bound by confidentiality who does not work for a competitor of the Provider, may audit the Provider once a year, with 30 days' written notice, during working hours, without access to other customers' data and without disturbing the Service. An additional audit is possible when a supervisory authority requires it. 6.3. The Customer bears the costs of the audit, including the Provider's time at its usual rates, unless the audit finds a material breach of this agreement by the Provider.
7. Customer's obligations
7.1. The Customer is responsible for the lawfulness of its instructions and of the personal data it enters, including the legal basis and the information given to data subjects. 7.2. The Customer does not enter personal data of end users or special categories of personal data into passports or documents (section 3.15 of the terms).
8. Liability and precedence
8.1. The limits and exclusions of liability in section 9 of the terms apply to this agreement, except where the GDPR does not allow them. 8.2. For personal data, this agreement prevails over the terms.
Annex 1. Technical and organisational measures
- Hosting and transfer: data is hosted and backed up only in the European Union; all connections use TLS and the website enforces HTTPS.
- Access control: passwords are stored only as Argon2id hashes; two-factor authentication is mandatory for the Provider's administrators and for the Customer's users; API keys are stored only as hashes; access within a company follows user roles.
- Separation of customers: each customer's data is separated in the database by row-level security; the access levels of passports and documents are applied on the server.
- Integrity: each published version of a passport and of a generated document receives a SHA-256 hash and an electronic signature; a published version is never changed.
- Logs: access to non-public passport data and actions in the Customer's account, including those of the Provider's administrators, are logged; the Customer can view the logs in the platform.
- Backups: each published version is copied to a storage provider separate from the hosting provider; the database is backed up every night; copies are checked automatically.
- Vulnerabilities: dependencies and the container image are checked for known vulnerabilities; critical vulnerabilities are fixed or mitigated without undue delay.
- People: only named administrators of the Provider have access to production systems, with two-factor authentication, and are bound by confidentiality; test systems do not use the Customer's data.