Data Processing Agreement (Article 28 GDPR)

1. Scope, nature and duration

Processing includes collection, recording, organization, consultation, extraction, analysis, authorized disclosure, storage and deletion for enabled modules: staff, shifts, attendance, HACCP, inventory, production, documents, sales, events and communication. It lasts for services and agreed return/deletion operations.

2. People and data categories

Staff, contractors, administrators, supplier/customer contacts and people in files. Identity, contacts, contract/payroll details, social-security identifiers in documents, shifts, attendance, absence, photos, signatures, location submitted in enabled functions, messages, documents and technical metadata. Medical documents may contain Article 9 data: the controller must minimize, identify a valid condition and give specific instructions.

3. Instructions and legality

The processor follows documented instructions, including for international transfers, unless law requires otherwise; it informs the controller beforehand unless prohibited. Instructions include contract, settings and authorized requests. It immediately informs the controller of instructions it considers unlawful and seeks clarification. Provider-own processing such as billing is separate in the privacy notice.

4. Confidentiality and security

The processor binds authorized people to confidentiality and applies risk-proportionate Article 32 measures: organization/site access limits, authentication, protected transmission, incident management and continuity, periodic review. Infrastructure and backup details belong in applicable annexes and must not be assumed. Some shared images may be reachable by URL: controllers must limit confidential publication.

5. Providers and authorization

Services are listed at /legal/privacy and /legal/mentions-legales: Supabase, Vercel, Google Firebase, Resend, Google Gemini, OpenAI, Google Maps Platform, Gurtam UAB (flespi) for the Fleet module; Stripe handles payments and may have its own purposes. Not all are sub-processors for every activity. The contract must identify relevant providers and specific/general controller authorization.

Before additions/replacements the processor gives sufficient notice for a reasoned objection; parties agree a solution, alternative or termination of the affected processing. It imposes equivalent duties in writing and remains responsible to the controller for sub-processor obligations. No claim is made that every agreement has already been verified.

6. Transfers and AI

GDPR transfers require valid Chapter V safeguards; countries, mechanisms and measures must be documented for actual services. European hosting alone does not rule out transfers.

AI may send text, authorized context, contracts, images and audio to Google Gemini/OpenAI, including enabled automatic workflows. The controller assesses necessity, categories and instructions; unrestricted special-category submission is not presumed. Significant decisions require human review.

7. Data-subject rights

Considering the nature of processing, the processor assists with technical/organizational measures for Articles 15–22 requests. It passes customer-data requests to the controller rather than deciding retention grounds itself. Available personal export alone does not guarantee inclusion of every attachment or related record.

8. Incidents, assessments and consultation

The processor notifies personal-data breaches without undue delay after awareness, progressively providing nature, categories, impact, contact and available measures. It assists with Articles 32–36, impact assessments and prior consultation, considering information available. The Article 33 72-hour deadline applies, where relevant, to the controller notifying authorities, not a permitted processor waiting period.

9. Return, deletion and retention

A request does not trigger automatic deletion of all copies at AI or notification services. Data already transmitted requires checking recipient terms, retention and procedures, and further requests where applicable.

At the controller’s choice after services, it returns or deletes personal data and deletes copies unless legally required, documenting methods, periods and backup cycles. Residual access is restricted. Anonymizing a profile does not erase names in messages/files; assess actual irreversibility and residual data. Controller retention must follow applicable law.

10. Information and audits

The processor makes information available to demonstrate Article 28 duties and allows/contributes to audits and inspections by the controller or appointed auditor, with proportionate measures protecting other customers. Organizational limits must not empty statutory audit rights of substance.

11. Contacts and completion

Documented requests/instructions: admin@mtdigitalservices.net. Before use complete controller identity/contact, modules, allowed special categories, duration, measures, authorized sub-processors and transfer mechanisms. The controller retains information, legal-basis and employment duties; the processor retains its own GDPR obligations.