1. Parties
1.1. This Data Processing Agreement (the “Agreement”) is made between:
• you as a client of Bereg-IT services (the “Controller”); and
• BEREG-INFORMATION TECHNOLOGY LLC (ТОВ «БЕРЕГ-ІТ»), EDRPOU code 40428558, registered address: 17-21 Bahhovutivska St, Kyiv 04107, Ukraine, which provides businesses with IT infrastructure, information security and support services (the “Processor”).
1.2. The Agreement takes effect on the date you agree to use or order the Processor’s services (the “Services”), whichever occurs first.
2. Background
(A) This Agreement puts in place proper arrangements for personal data that the Controller entrusts to the Processor.
(B) This Agreement complies with Article 28 GDPR and with the Law of Ukraine “On Personal Data Protection” as regards the relationship between a controller and a processor of personal data.
(C) The parties wish to record their commitments in this Agreement.
3. Definitions
3.1. In this Agreement:
• “Data Protection Laws” means the Law of Ukraine “On Personal Data Protection”, the GDPR to the extent it applies to the processing of the Data, and other personal data protection laws that apply to the parties;
• “Data” means personal data, as defined in the Data Protection Laws, that the Controller passes to the Processor or that the Processor accesses while providing the Services;
• “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
• “Sub-processor” means a third party engaged by the Processor to process the Data;
• “Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, the Data.
3.2. “Controller” and “Processor” in this Agreement correspond to “володілець” and “розпорядник” of personal data under the Law of Ukraine “On Personal Data Protection”.
4. Subject matter and details of processing
4.1. Subject matter: the Data whose processing is needed to provide the Services under the Controller’s contract or order — IT infrastructure administration, information security, security monitoring (SOC), cloud services, consulting and audit.
4.2. Duration: the term of the services contract plus the time needed to return or delete the Data after it ends.
4.3. Nature and purpose: storage, administration, backup, monitoring, analysis of security events, incident response and technical support — solely to provide the Services.
4.4. The types of Data and categories of data subjects are set out in the contract or order. As a rule, they are identification and contact data of the Controller’s employees and users, account data, IP addresses, system and security event logs, and the content of systems and mailboxes that the Processor administers.
4.5. Processing that the Processor carries out as a controller (for example, data of website visitors and contact persons) is described in the Processor’s Privacy Policy at www.beregit.com.
5. Processor’s obligations
The Processor processes the Data only in accordance with the Data Protection Laws and, in particular, undertakes to:
5.1. process the Data only on documented instructions from the Controller, including with regard to transfers of the Data abroad, and only to provide the Services (Article 28(3)(a) GDPR); immediately inform the Controller if, in the Processor’s opinion, an instruction infringes the Data Protection Laws;
5.2. ensure that all employees and other representatives with access to the Data are aware of the terms of this Agreement, have been trained in data protection and are bound by a commitment of confidentiality (Article 28(3)(b) GDPR);
5.3. implement technical and organisational measures that ensure a level of security appropriate to the risk, in line with Article 32 GDPR and Article 24 of the Law of Ukraine “On Personal Data Protection”; specific measures may be set out in the contract (Article 28(3)(c) GDPR);
5.4. not engage Sub-processors without the Controller’s prior written consent, which the Controller may withhold without giving reasons. Where consent is given, the Processor concludes a written contract with the Sub-processor imposing the same data protection obligations and remains liable to the Controller for the Sub-processor’s acts. The current list of Sub-processors is provided to the Controller on request (Article 28(2) and 28(4) GDPR);
5.5. taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as possible, in responding to data subject requests for access, rectification, erasure, restriction, portability, objection and the right not to be subject to automated decisions (Chapter III GDPR; Article 28(3)(e) GDPR);
5.6. assist the Controller in meeting its obligations under Articles 32–36 GDPR — security, notification of breaches to the supervisory authority and to data subjects, data protection impact assessments and prior consultation with the supervisory authority — taking into account the nature of the processing and the information available to the Processor (Article 28(3)(f) GDPR);
5.7. at the Controller’s choice, securely delete or return the Data at any time; deletion covers all existing copies unless the law requires them to be kept. On the Controller’s request, the Processor confirms the destruction of the Data (Article 28(3)(g) GDPR);
5.8. make available to the Controller all information needed to demonstrate compliance with this Agreement, and allow for and contribute to audits and inspections carried out by the Controller or an auditor it mandates (Article 28(3)(h) GDPR);
5.9. maintain the integrity of the Data without alteration and keep it separate from other information;
5.10. notify the Controller immediately, and without undue delay, of any Data Breach or incident in which the Data may have been compromised, with the information available on the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken (Article 33(2) and 33(3) GDPR).
6. Controller’s obligations
6.1. The Controller is responsible for having a legal basis for the processing of the Data and for informing data subjects.
6.2. The Controller gives the Processor instructions on processing in writing, including by email, and informs it of any special processing requirements arising from the laws that apply to the Controller.
7. Transfers of Data abroad
7.1. The Processor transfers the Data outside Ukraine or the European Economic Area only on the Controller’s instructions or with its consent and subject to appropriate safeguards, in accordance with Chapter V GDPR and Article 29 of the Law of Ukraine “On Personal Data Protection”.
8. Term and termination
8.1. This Agreement remains in force for as long as the Processor provides the Services to the Controller or processes its Data.
8.2. The Controller or the Processor may terminate this Agreement at any time by written notice to the other party.
8.3. Obligations to return or delete the Data and to keep it confidential survive termination.
9. General
9.1. This Agreement represents the entire understanding of the parties on the legal safeguards for data protection in their controller–processor relationship under the Data Protection Laws.
9.2. In matters of personal data protection, this Agreement prevails over other terms of the services contract unless the parties have expressly agreed otherwise.
9.3. This Agreement is governed by the law of Ukraine; the GDPR applies to the extent it applies to the processing of the Data. Disputes are resolved as set out in the services contract or, failing that, by the courts of Ukraine.
9.4. If any provision of this Agreement becomes invalid, the remaining provisions stay in force.