Data Processing Agreement

1. Parties and roles

This Data Processing Agreement (“DPA”) is between the Customer that uses Ark Agency (“Controller”) and Bonce Filip P.F.A., CUI 54376757, Oradea, Bihor County, Romania (“Processor”). It applies to all personal data the Processor processes on the Controller's behalf through the Service (“Customer Personal Data”). Words like “personal data”, “processing” and “data subject” have the meaning given in Regulation (EU) 2016/679 (GDPR).

2. Details of the processing

• Subject matter and purpose: providing the Ark Agency service, including storing, displaying, organising and transmitting Customer content, as the Controller directs through its use of the Service.
• Duration: for as long as the Customer uses the Service, plus the deletion period in section 9.
• Data subjects: the Controller's team members, its clients and their staff, people who appear in videos or files, contract signers, and anyone else whose data the Controller chooses to enter.
• Types of data: names, email addresses, phone numbers, job titles, images and voices in video and photo files, comments, signatures, login credentials for client accounts, and any other data the Controller enters. The Service isn't designed for special categories of personal data, and the Controller shouldn't upload them.

3. Instructions

The Processor processes Customer Personal Data only on the Controller's documented instructions. These Terms, this DPA and the Controller's use of the Service's features are those instructions. If the Processor believes an instruction breaks data protection law, it will tell the Controller. If the law requires the Processor to process data in some other way, it will tell the Controller first, unless the law forbids that.

4. Confidentiality

Everyone the Processor authorises to access Customer Personal Data is bound by confidentiality and only accesses it when needed to provide, support or secure the Service.

5. Security

The Processor maintains appropriate technical and organisational measures under Article 32 GDPR, including: encryption in transit; encryption of stored client credentials and third-party tokens; workspace and client separation enforced by database access policies; role-based permissions; restricted administrative access; and backups. The current measures are described on our security page.

6. Subprocessors

The Controller gives general authorisation for the Processor to use the subprocessors listed below. The Processor binds each one to data protection obligations at least as protective as this DPA and remains responsible for their work. The Processor will email the Controller at least 30 days before adding or replacing a subprocessor. If the Controller objects on reasonable data protection grounds and we can't resolve it, the Controller may cancel and receive a refund of any prepaid, unused fees.

Services the Controller or its users choose to connect, such as Google Calendar, Google Drive, Canva, Instagram, Facebook and TikTok, aren't subprocessors. They're used under their own terms, and data only moves between them and the Service when a user connects one and acts in it.

7. International transfers

Where Customer Personal Data is transferred outside the European Economic Area, the Processor ensures it's covered by an adequacy decision (such as the EU-US Data Privacy Framework for certified recipients) or the European Commission's Standard Contractual Clauses.

8. Helping the Controller

• Data subject requests: the Service lets the Controller find, edit, export and delete data. If a data subject contacts the Processor directly, the Processor will pass the request to the Controller and won't answer it on its own.
• Personal data breaches: the Processor will notify the Controller without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Customer Personal Data, with the information the Controller needs to meet its own obligations.
• Impact assessments and authorities: the Processor will give reasonable help with data protection impact assessments and consultations with supervisory authorities.

9. Deletion and return

The Controller can export its data while the account is active. When the Service ends, the Processor deletes Customer Personal Data within 30 days, and backup copies within a further 90 days, unless EU or Romanian law requires it to be kept.

10. Audits

The Processor will make available the information needed to show compliance with Article 28 GDPR and answer reasonable written questions. Where that isn't enough, the Controller may carry out an audit, at its own cost, with at least 30 days' notice, no more than once a year, during business hours and under confidentiality, in a way that doesn't disrupt the Service or other customers' data.

11. Liability and precedence

Liability under this DPA is subject to the limits in the Terms of Service, except where the GDPR doesn't allow them. If this DPA and the Terms conflict on data protection, this DPA wins.

12. Contact

Data protection questions, including requests for a countersigned copy of this DPA: support@ark-agency.app.