Door Cloud

Data Processing Agreement

1. INTRODUCTION

This Data Processing Agreement ("DPA") forms part of the agreement between the Customer ("Controller") and Spica International d.o.o. ("Processor") for the provision of Door Cloud cloud access control services (the "Service").

This DPA is entered into in accordance with Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and sets out the terms under which the Processor processes personal data on behalf of the Controller.

2. DEFINITIONS

Personal Data means any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller through the Service.

Processing means any operation performed on personal data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, combination, restriction, erasure, or destruction.

Sub-processor means any third party engaged by the Processor to process personal data on behalf of the Controller.

Data Subject means the identified or identifiable natural person to whom the personal data relates.

3. SCOPE AND PURPOSE OF PROCESSING

The Processor processes personal data solely for the purpose of providing the Door Cloud access control service to the Controller. The categories of personal data processed include:

  • User identification data (name, email address, phone number)
  • Access credentials (card numbers, mobile device identifiers)
  • Access log data (timestamps, door identifiers, access decisions)
  • Visitor data (name, email, visit purpose, host)

The categories of data subjects include employees, contractors, visitors, and other individuals whose access is managed by the Controller through the Service.

4. OBLIGATIONS OF THE PROCESSOR

The Processor shall:

  • (a) Process personal data only on documented instructions from the Controller, unless required by EU or member state law.
  • (b) Ensure that persons authorized to process personal data are bound by confidentiality obligations.
  • (c) Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption of data in transit and at rest, access controls, and regular security testing.
  • (d) Not engage another processor (sub-processor) without prior written authorization from the Controller.
  • (e) Assist the Controller in responding to requests from data subjects exercising their rights under the GDPR.
  • (f) Assist the Controller in ensuring compliance with data security, breach notification, data protection impact assessments, and prior consultation obligations.
  • (g) At the Controller's choice, delete or return all personal data after the end of the service, unless retention is required by law.
  • (h) Make available to the Controller all information necessary to demonstrate compliance with Article 28 of the GDPR and allow for audits.

5. SUB-PROCESSORS

The Controller provides general authorization for the Processor to engage sub-processors. The Processor shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors, giving the Controller the opportunity to object.

Current sub-processors:

  • Microsoft Azure (EU region) — cloud infrastructure and hosting
  • Intercom — customer support chat platform

The Processor shall impose the same data protection obligations on sub-processors as set out in this DPA by way of a contract. The Processor remains fully liable for the performance of sub-processor obligations.

6. DATA TRANSFERS

Personal data shall be processed within the European Economic Area (EEA). Any transfer of personal data outside the EEA shall only take place with the Controller's prior written consent and subject to appropriate safeguards as required by Chapter V of the GDPR.

7. DATA SECURITY

The Processor implements and maintains the following security measures:

  • ISO/IEC 27001 certified information security management system
  • ISO/IEC 27017 cloud security controls
  • ISO/IEC 27018 cloud privacy controls
  • Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
  • Role-based access controls with principle of least privilege
  • Regular penetration testing and vulnerability assessments
  • Automated backup and disaster recovery procedures
  • Multi-tenant logical data isolation on Microsoft Azure Platform-as-a-Service

8. DATA BREACH NOTIFICATION

The Processor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach. The notification shall include:

  • A description of the nature of the breach
  • The categories and approximate number of data subjects and records affected
  • A description of the likely consequences
  • A description of the measures taken or proposed to address the breach

9. DATA SUBJECT RIGHTS

The Processor shall assist the Controller in fulfilling data subject requests including access, rectification, erasure, restriction, data portability, and objection. The Processor shall respond to such requests within the timeframes required by the GDPR.

10. DATA RETENTION AND DELETION

Upon termination of the Service, the Processor shall delete all personal data within 90 days unless retention is required by applicable law. The Controller may export their data at any time during the active subscription period.

11. AUDIT RIGHTS

The Controller has the right to conduct audits, including inspections, to verify the Processor's compliance with this DPA. The Processor shall cooperate with such audits and make available all necessary information. Audits shall be conducted with reasonable notice and during normal business hours.

12. LIABILITY

Each party's liability under this DPA is subject to the limitations of liability set out in the main agreement between the parties (Terms of Service).

13. GOVERNING LAW

This DPA shall be governed by and construed in accordance with the laws of the Republic of Slovenia. Any disputes shall be subject to the exclusive jurisdiction of the courts in Ljubljana, Slovenia.

14. CONTACT

Spica International d.o.o.
Pot k Sejmiscu 33
1231 Ljubljana, Slovenia EU
Email: contact form
Web: www.spica.com

15. VALIDITY

This DPA is effective as of 21 June 2024 and supersedes all previous versions. This DPA shall remain in effect for as long as the Processor processes personal data on behalf of the Controller.