Data Processing Agreement

1. Subject matter, duration and purpose

The Processor processes personal data only to provide the Platform service to the Client: storing and displaying data, sending invitations and emails, receiving Supplier offers, reading documents (including with artificial intelligence), preparing documents and reports, keeping the activity log, making backups, providing support and ensuring security. Processing lasts while the Terms of Use are in force and during the transition, data retrieval and deletion periods set out in section 10 of the Terms.

2. Data and data subjects

• Data subjects: the Client’s employees and other Users; Supplier representatives and Suppliers who are natural persons; other persons whose data is contained in uploaded documents.
• Data categories: name, position, email, phone, company; contents of offers, orders, invoices and other documents (including financial details such as bank account numbers); comments; Supplier ratings; activity log; login and technical data.
• Special categories of data are not processed — the Client undertakes not to upload them and, if they are uploaded, to delete them.

3. Client instructions

The Processor processes data only on the Client’s documented instructions. These are the Terms of Use, this agreement, the actions and settings of the Client and its Users on the Platform (e.g. sending an invitation, running an AI feature, deleting data) and the Client’s written instructions by email, if consistent with the Terms of Use.

The Processor may process data otherwise only where required by Union or Member State law to which it is subject; in that case it informs the Client of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The Client instructs and permits: (a) the use of AI features when a User runs them, sending the AI provider only the information needed for the task; (b) the transfer of data to the sub-processors listed in Annex 1 and, outside the EEA, under the conditions of section 6.

If, in the Processor’s opinion, an instruction infringes data protection law, it informs the Client without delay and may suspend its execution until the Client confirms or changes it.

4. Obligations of the Processor

The Processor:

• ensures that persons processing the data are bound by confidentiality; views the Client’s account only with the Client’s permission or when necessary to investigate a security incident — every view is logged and visible to the Client administrator;
• applies the technical and organisational security measures set out in Annex 2 (Art. 32 GDPR);
• assists the Client in responding to data subject requests (access, rectification, erasure, etc.) — the Client can handle most of them itself on the Platform; forwards a request received directly to the Client within 5 working days and does not substantively respond without the Client’s instruction;
• assists the Client in meeting its obligations under Articles 32–36 GDPR (security, breach notifications, impact assessments, prior consultation) based on the information available to it;
• notifies the Client of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, stating as far as possible: the nature of the breach, the approximate number of data subjects and records, a contact person, likely consequences and measures taken (in phases if not all is available at once); takes measures to contain the breach and documents it; the decision to notify the supervisory authority is the Client’s;
• after the agreement ends, allows the Client to export the data and then deletes it as set out in section 10 of the Terms of Use, except where retention is required by Union or Member State law; in backups, data is never restored to the live system and disappears within the 12-month backup cycle; confirms deletion in writing on request;
• provides the Client with the information needed to demonstrate compliance and allows audits — agreed at least 30 days in advance, no more than once a year (more often after a breach or at a supervisory authority’s request), without disrupting the service for other clients or accessing their data, at the Client’s expense; sub-processors are audited under the procedures in their contracts (reports, certificates);
• keeps records of processing activities carried out on behalf of the Client (Art. 30(2) GDPR).

5. Sub-processors

The Client gives general authorisation to engage the sub-processors listed in Annex 1. The Processor gives at least 30 days’ notice by email and on the Platform of any new or replaced direct sub-processor; the Client may reasonably object during that period and, failing agreement, terminate before the change and receive a pro-rata refund for the unused prepaid period.

Direct sub-processors engage their own sub-processors, whose lists are published at the places stated in Annex 1. The Processor informs the Client of material changes to them without delay once it becomes aware, and the same objection and termination rights apply; a change required by security or law may take effect sooner.

A written contract is in place with each direct sub-processor ensuring substantially equivalent data protection to this agreement (Art. 28(4) GDPR). The Processor remains responsible to the Client for the sub-processors’ performance.

The Processor ensures that the AI provider does not use Client data to train its models or for its own other purposes (except short-term retention for abuse monitoring under its terms).

6. Transfers outside the EEA

Platform data is stored in the European Union. Some sub-processors of the sub-processors (e.g. email delivery, spam and attack protection providers) are outside the EEA, so some data (especially email data) may be transferred to third countries.

The Client permits such transfers only where a Chapter V GDPR safeguard applies: a European Commission adequacy decision or standard contractual clauses (Decision (EU) 2021/914) with any necessary supplementary measures. At the Client’s request the Processor provides information on the safeguards applied. New transfers are notified under section 5.

7. The Processor’s own purposes and prohibitions

This agreement does not apply to data the Processor processes as an independent controller under the Privacy Policy: administration of the contract with the Client and invoices; server and Platform security logs (including technical data from Supplier forms); website and support channel data.

The Processor may use aggregate technical statistics on Platform use that cannot identify persons and do not reveal the content of Client data.

The Processor must not: use Client data for its own or third parties’ marketing; use it to train AI models; combine it with other clients’ data; sell or otherwise disclose it except as provided in this agreement.

8. Obligations of the Client

The Client ensures that it has a legal basis to process the data uploaded to the Platform and to give the instructions set out in this agreement.

The Client properly informs data subjects (Arts. 13–14 GDPR): Suppliers — about the processing of their data and the use of AI (to assist, the Processor shows a short notice in the offer form); its employees — about the use of the Platform and the activity log, as required by employment law.

The Client sets its own retention periods on the Platform (e.g. deletes Supplier contacts and purchases it no longer needs) and, where necessary, carries out a data protection impact assessment.

9. Liability and term

The parties’ liability to each other is governed by the Terms of Use unless the GDPR or other mandatory law provides otherwise; each party is liable to data subjects under Article 82 GDPR. This agreement remains in force for as long as the Processor processes Client data and is amended in the manner set out in the Terms of Use. In case of conflict regarding the processing of personal data, this agreement prevails.

Annex 1. Sub-processors

• Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus — server hosting (data centre in Lithuania) and email service (sending invitations, notifications and other system emails). Its sub-processor list and transfer safeguards (standard contractual clauses) — in Hostinger’s Data Processing Addendum (DPA); some sub-processors are outside the EEA (e.g. USA).
• Mistral AI SAS, 15 rue des Halles, 75001 Paris, France — artificial intelligence service for reading documents and drafting texts, only when AI features are used; only the text of the processed document is sent or, for a scanned document, the document itself for text recognition. Data is processed in the EU; model training on Client data is switched off. Its sub-processor list and transfer safeguards — in Mistral AI’s Data Processing Addendum (DPA) and trust centre (trust.mistral.ai).

Annex 2. Security measures

• Encrypted connections (HTTPS / TLS) for the entire Platform.
• Passwords stored only as cryptographic hashes; failed login attempts are limited; idle sessions end automatically.
• Each company’s data is separated — every query is limited to that company’s data; verified by automated tests before every update.
• Access by roles and permissions; the company administrator manages its users.
• Log of important actions (who, what, when), visible to the Client administrator.
• Files accessible only with permission; uploaded file types and sizes are restricted; offer submission links are unique.
• The Provider can view a Client account only with the Client’s permission; every view is logged.
• Daily backups: on the server — 7 days, a separate copy on the Provider’s computer in Lithuania — up to 12 months; restoration is tested.
• Server access only with a cryptographic key; firewall; regular updates.
• Limits and accounting of AI requests; only necessary information is sent to the AI provider; training is switched off.
• Incident management with a 48-hour deadline for notifying the Client.