Data Processing Agreement

You are the controller and determine the purposes and means of processing. DIA DIGITAL j.d.o.o. is the processor and processes the data solely on your documented instructions, which consist of this agreement and your use of the service.

If you instruct us to carry out processing that would infringe data protection law, we will inform you and may refuse to act.

The contact form does not request special categories of data under Article 9 of the Regulation. If a visitor volunteers such data in their message, you are responsible for that processing.

• we process the data only on your instructions and for no purpose of our own
• persons with access to the data are bound by confidentiality
• we apply the technical and organisational measures set out in Article 5 below
• we assist you in responding to data subject requests and in meeting your obligations under Articles 32 to 36 of the Regulation
• we notify you without undue delay, and in any event within 48 hours, if we become aware of a personal data breach
• on request we make available to you the information needed to demonstrate compliance

We are authorised to engage sub-processors. At present these are:

We have a contract with the sub-processor imposing obligations equivalent to these. We will inform you at least 30 days in advance of any intention to add or replace a sub-processor; you may object, and if we cannot resolve your objection you may terminate the contract.

Data of visitors to your website is not transferred outside the European Economic Area.

• encryption in transit (TLS) between the visitor, our service and you
• server access exclusively by cryptographic keys, never passwords
• role-based access separation; personal data is visible only to those who need it
• daily database backups, stored within the European Union
• protection against automated form submission and request rate limiting
• access logs allowing it to be established who accessed the data and when

If a visitor to your website contacts us with a request for access, rectification or erasure, we will not answer it ourselves but will forward it to you without delay, unless you instruct us to respond. Answering such a request is your obligation as controller.

We keep enquiries received through your sites for 24 months, and you may delete them earlier, individually or all at once.

On termination of your service contract we delete all data processed on your behalf, including enquiries received, unless we are required by law to retain it. You may request an export before deletion.

Deletion is final, and data cannot be restored from backups once their retention period, which does not exceed 30 days, has elapsed.

You have the right to verify that we meet the obligations under this agreement, at most once a year and on 30 days' notice, except where a data breach is suspected. We may satisfy such a request by providing existing documentation of our security measures.