Marrëveshja për përpunimin e të dhënave

1. Scope and precedence

The DPA is accepted together with the Terms of service and applies for as long as Preventiv processes Customer personal data. In case of conflict on data protection matters, the DPA prevails over the Terms. Where the Standard Contractual Clauses apply (section 8), they prevail over the DPA.

[[REVIEW: R-23 Whether accepting the DPA by clicking at sign-up is enough for both markets, or whether a signed version must be available on request (and for public-sector customers).]]

2. Definitions

Terms such as "personal data", "processing", "controller", "processor", "sub-processor", "data subject" and "personal data breach" have the meaning given in the GDPR and, for processing subject to Albanian law, in Law 124/2024. "Customer personal data" means personal data contained in Customer Data.

3. Roles and instructions

The Customer is the controller and Preventiv is the processor. Preventiv processes Customer personal data only on the Customer's documented instructions: the Terms, this DPA, the configuration chosen in the Service and written requests from the Customer. If Preventiv believes an instruction infringes the law, it informs the Customer.

Preventiv does not process Customer personal data for its own purposes, does not sell it and does not use it to train AI models.

If Preventiv is required by law to process data otherwise, it informs the Customer beforehand unless the law forbids it.

4. Details of processing (Annex I)

• Subject matter and duration: provision of the Service for the duration of the contract plus the export period of 30 days.
• Nature and purpose: hosting, storage, organisation, calculation, generation of documents, sharing via links, e-mail delivery, widget request collection, API access, backup and deletion.
• Data subjects: the Customer's clients and prospects, site contacts, suppliers and subcontractors, visitors who use the Customer's widget, signatories on share pages, the Customer's staff.
• Categories of data: identification and contact data, addresses and project locations, tax identifiers, financial data in estimates, invoices and SAL, photos and attachments uploaded, signatures (name, image, date, IP address, browser), widget answers and messages, pseudonymised IP hash.
• Special categories: none are required; the Customer must not upload special categories of data or data on criminal convictions unless strictly necessary and lawful.

5. Confidentiality of personnel

Preventiv ensures that persons authorised to process Customer personal data are bound by confidentiality, receive appropriate instructions and access only the data needed for their tasks.

6. Security measures

Preventiv implements the technical and organisational measures described in Annex II, appropriate to the risk under GDPR art. 32. It may update them provided the overall level of protection is not reduced.

7. Sub-processors

The Customer gives Preventiv general authorisation to engage the sub-processors listed in Annex III. Preventiv informs the Customer of any intended addition or replacement at least 30 days in advance (by e-mail and in the application). The Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a refund of the unused prepaid fees.

Preventiv imposes on each sub-processor data protection obligations equivalent to this DPA and remains liable to the Customer for its performance.

8. International transfers

Customer personal data is stored in the European Union. Preventiv transfers it outside the EEA only in compliance with Chapter V GDPR, for example on the basis of an adequacy decision or the Standard Contractual Clauses (Commission Implementing Decision 2021/914), which are incorporated by reference where required, with any supplementary measures.

[[REVIEW: R-18 (as in the Privacy policy): SCC module and parties if the operator, staff or support access are located in Albania, and Albanian rules for transfers from Albanian customers.]]

9. Assistance to the Customer

Taking into account the nature of the processing, Preventiv assists the Customer:
- with data subject requests, through the export, correction and deletion functions of the Service and, where needed, on request; requests received directly are forwarded to the Customer without undue delay;
- with security, breach notification, data protection impact assessments and prior consultation, by providing the information reasonably available to it.

[[REVIEW: R-25 Whether assistance beyond the self-service functions may be charged at a published rate.]]

10. Personal data breaches

Preventiv notifies the Customer without undue delay, and in any case within [48] hours of becoming aware of a personal data breach affecting Customer personal data, with the information then available: nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed and a contact point. It updates the information as it becomes available and takes reasonable steps to contain the breach.

11. Return and deletion

At the end of the contract the Customer may export its data for 30 days. Preventiv then deletes Customer personal data, unless the law requires its storage. Copies in backups are deleted at the end of their rotation cycle and are not restored except to recover the Service. On request, Preventiv confirms deletion in writing.

12. Information and audits

Preventiv makes available the information necessary to demonstrate compliance with art. 28 GDPR, including this DPA, the measures in Annex II and, where available, certifications or audit reports of its sub-processors. If this is not sufficient, the Customer may carry out an audit, by itself or through an independent auditor bound by confidentiality, once a year with 30 days' notice, during business hours and at its own cost, without access to other customers' data.

[[REVIEW: R-26 Audit regime: frequency, costs, remote versus on-site audits and reliance on sub-processor reports (Supabase, Stripe, Cloudflare).]]

13. Liability

Each party's liability under this DPA is subject to the limitations in the Terms of service, without prejudice to the rights of data subjects under GDPR art. 82 and to liability that cannot be limited by law.

[[REVIEW: R-11 (as in the Terms): whether data-protection liability is inside or above the general cap.]]

14. Term and governing law

This DPA lasts as long as Preventiv processes Customer personal data. It is governed by the law and jurisdiction chosen in the Terms of service, without prejudice to the mandatory application of the GDPR and of Albanian Law 124/2024.

Annex II. Technical and organisational measures

• Hosting in EU data centres of certified providers (ISO 27001 / SOC 2 reports available from the providers).
• Encryption in transit (TLS, HSTS) and at rest; signed, expiring links for files and documents.
• Logical separation of customers with row-level security policies in the database and server-side permission checks.
• Role-based access with least privilege, optional or mandatory two-factor authentication, session expiry and revocation.
• Passwords stored only as hashes by the authentication service; API keys stored as hashes.
• Audit log of significant actions inside each company.
• Security headers, content security policy, rate limiting, anti-abuse checks on public forms, protection of webhooks against requests to internal networks.
• Daily backups with point-in-time recovery; tested restore procedure. [[REVIEW: R-27 The operator must confirm the backup plan, restore tests and the incident response procedure actually in place.]]
• Data minimisation in the widget: the visitor's IP address is stored only as a salted hash.
• Staff confidentiality obligations and access limited to what is needed for support.

Annex III. Authorised sub-processors

• Supabase, Inc. (USA; data hosted in the EU region eu-west-1 (Ireland)): database, authentication, file storage. Safeguards: DPA, SCCs for any access from outside the EU.
• Vercel Inc. (EU region (Dublin, Ireland)): hosting of the web application and processing of requests.
• [E-MAIL PROVIDER] ([REGION]): sending e-mails (documents, reminders, notifications).
• Cloudflare, Inc. (USA): Turnstile anti-abuse check on widget forms. Safeguards: EU-US Data Privacy Framework / SCCs.
• OpenStreetMap Foundation (United Kingdom): geocoding of project addresses (Nominatim). Safeguards: adequacy decision for the United Kingdom.
• Anthropic, PBC (USA), only if AI assistance is enabled by the Customer: processing of the submitted text. Safeguards: SCCs / commercial terms excluding training.
• Stripe Payments Europe, Ltd. (Ireland): only for the Customer's own subscription billing; it does not process Customer personal data.