Data processing agreement (DPA)

This agreement is between the business using OraSync ("the Controller") and Doimih Design S.R.L., a company registered in Romania (company no. 27344782), with its registered office at Str. Drm. Gura Putnei nr. 137A, Sector 3, București, România ("the Processor").

It forms part of the Terms and conditions and applies for as long as the Controller has an OraSync account. On data protection, it prevails over any other contractual term.

• It processes the data only on the Controller's documented instructions: this agreement, the Controller's configuration in the platform and its written requests. If an instruction infringes the law, it tells the Controller straight away.
• It ensures that the people with access to the data are bound by confidentiality.
• It applies the security measures in section 5.
• It uses sub-processors only as set out in section 6.
• It helps the Controller respond to data subjects, through the platform’s features and directly where needed. Requests it receives from data subjects are passed to the Controller without delay.
• It helps the Controller with the security of processing, breach notifications and data protection impact assessments (UK GDPR art. 32–36), as far as the information it holds allows.
• It does not use the data for its own purposes, does not sell it and does not send marketing messages to the Controller's clients.

• It has a lawful basis for each processing activity and informs its clients as required by Article 13 of the UK GDPR, including about its use of OraSync.
• It obtains its clients’ consent where the law requires it, for example for marketing by email under PECR.
• It enters in the platform only the data needed for the purpose and gives its team access in line with each person’s role.
• It keeps the account’s sign-in details confidential and, where it applies, pays the data protection fee to the ICO.

• Hosting in data centres in the European Union;
• Encryption of traffic (HTTPS) and of backups;
• Isolation of each Controller's data in the database (row-level security);
• Access control by role and location, checked on the server for every request;
• Passwords stored as hashes, account lock after repeated wrong attempts, time-limited sessions;
• An audit log that cannot be changed from the application;
• Technical logs with no phone numbers and no message content;
• Hourly backups, kept in a separate location and tested automatically by restoring them.

The Controller gives general authorisation for the sub-processors below. The Processor imposes on each, by contract, data protection obligations at least equivalent to those in this agreement and remains responsible for them.

Deposits paid online by clients are processed directly on the Controller's own Stripe account, using that account's API key configured by the superadmin. The Controller retains its commercial relationship with Stripe; the Processor sends Stripe only the data needed for the payment.

WhatsApp messages are sent through the Controller's WhatsApp Business account. The relationship with Meta Platforms Ireland Ltd. is governed by the Controller's direct contract with Meta; the Processor sends the messages on the Controller's behalf.

Before adding or replacing a sub-processor, the Processor tells the Controller by email at least 30 days in advance. The Controller may object, with reasons, during that time. If no solution is found, the Controller may end the contract without penalty.

The Processor notifies the Controller without undue delay, and at most within 48 hours of becoming aware of a breach affecting the Controller's data, so that the Controller can report it to the ICO within 72 hours where required.

The notice includes, as far as known: the nature of the breach, the categories and approximate number of people and records affected, the likely consequences and the measures taken or proposed. Information not available straight away is sent as it becomes known.

The Processor is established in Romania and hosts the data in the European Economic Area. Transfers from the UK to the EEA are permitted under the UK adequacy regulations made under the Data Protection Act 2018, so no further safeguard is needed for them.

The Processor does not transfer the data outside the EEA. Any future transfer will be made only after the notice in section 6 and with the safeguards required by Chapter V of the UK GDPR.

When the contract ends, the Controller's data remains available for 90 days, during which the Controller may ask for a copy in a structured format.

After that, the data is permanently deleted from the database. It disappears from the encrypted backups as they expire, within 12 months at most.

This does not apply to data the Processor is required by law to keep, such as billing documents.

The Processor makes available to the Controller the information needed to demonstrate compliance with this agreement.

The Controller may carry out an audit, itself or through an auditor bound by confidentiality, at most once a year, with 30 days’ prior notice, at its own cost and without affecting the security of other customers. Audits required by a supervisory authority are not subject to these limits.

For anything about this agreement: [email protected].