Data Processing Agreement

1. Subject matter

This Data Processing Agreement ("DPA") under Article 28 GDPR forms part of the agreement between the Customer (controller) and Lintejas Company s.r.o., [[COMPANY_ADDRESS]], Zvolen, Slovakia, IČO [[ICO]] (processor) for the RomLet service. It covers all personal data the Customer enters into its RomLet account.

2. Duration

The DPA applies for as long as Lintejas processes personal data for the Customer, including the data return and deletion period in section 10.

3. Nature and purpose of processing

Hosting, storage, display, reporting and backup of workforce records so that the Customer can manage competencies, training, development plans, safety observations and permits for its site. Lintejas processes the data only on the Customer's documented instructions, which are the use of the Service as configured by the Customer.

4. Categories of personal data

Identification and contact data (name, work email, role, position, department, language); competency assessments and levels; training records and certificate files; development plans; safety observations, surveys, abnormality reports, permits, lockout and confined-space entries; audit log entries (acting user, action, old and new values, IP address, time). No special categories of data are intended; RomLet has no fields for health, biometric or payroll data.

5. Categories of data subjects

Employees, contractors and other site personnel of the Customer who are entered into RomLet as users or as subjects of records.

6. Obligations of the processor

Lintejas: processes personal data only on the Customer's documented instructions; ensures that persons authorised to process the data are bound by confidentiality; implements the security measures in section 8; respects the conditions for engaging subprocessors in section 7; assists the Customer in responding to data subject requests and in meeting its obligations under Articles 32 to 36 GDPR; deletes or returns the data as in section 10; and makes available the information needed to demonstrate compliance and allows audits as in section 9.

Lintejas informs the Customer without undue delay if it believes an instruction infringes the GDPR.

7. Subprocessors

The Customer authorises the subprocessors listed on romlet.tech/security at the date of signature: Railway Corporation (hosting, database, cache; United States) and Cloudflare, Inc. (DNS, TLS, edge delivery). Lintejas will give 30 days' written notice before adding or replacing a subprocessor, including the email relay once chosen; the Customer may object on reasonable data protection grounds. Lintejas remains liable for its subprocessors.

8. Security measures

Transport encryption (TLS) for all traffic; storage on persistent volumes encrypted at rest by the hosting platform; role-based access with one role per user and module gating; an audit log with before-and-after values; separation of tenants by account; access to production systems limited to named Lintejas personnel; database backups as stated on the Security page (in preparation at the date of this draft).

9. Audit

On request, no more than once a year unless required by a supervisory authority or following a personal data breach, Lintejas provides the documentation needed to demonstrate compliance with this DPA and allows an audit by the Customer or an auditor mandated by it, at the Customer's cost, with 30 days' notice and under confidentiality.

10. Deletion and return of data

At the end of the Service the Customer may request an export of its data within 30 days. After that period Lintejas deletes the data from the live service and, as backups rotate, from backups, unless the law requires storage.

11. Personal data breach

Lintejas notifies the Customer of a personal data breach affecting the Customer's data without undue delay and no later than 48 hours after becoming aware of it, with the information the Customer needs for its own notification duties.

12. International transfers

Data is hosted in the United States by Railway. Transfers rely on the European Commission's Standard Contractual Clauses in the agreement between Lintejas and the subprocessor [[TRANSFER_MECHANISM — confirm the Railway data processing terms]]. EU-region hosting is available for pilot sites on request.

13. Liability and precedence

Liability follows the main agreement. Where this DPA and the main agreement conflict on data protection, this DPA prevails. This is draft 0.1.

Questions about this document: [email protected]