- 1. Roles
- 2. Subject matter
- 3. Our obligations
- 4. The customer’s obligations
- 5. Security measures
- 6. Sub-processors
- 7. International transfers
- 8. Personal data breaches
- 9. Deletion
- 10. Audits
- 11. Duration
- 12. Contact
This agreement applies when Ofski, MB processes personal data on behalf of a customer in OFSKI EMS, as required by Article 28 of the GDPR. It forms part of the Terms of Service.
1. Roles
The customer is the controller of the personal data in its workspace. Ofski, MB, company code 304215619, Naugarduko g. 26-13, LT-03225 Vilnius, Lithuania, is the processor.
2. Subject matter
We process the personal data that the customer enters into the Service — such as names and contact details of staff, artists, crew, venues and partners — in order to provide, secure and support the Service, for as long as the agreement is in force.
3. Our obligations
- We process personal data only on the customer’s documented instructions. The Terms, this agreement and the customer’s use of the Service are those instructions.
- Everyone we allow to process the data is bound by confidentiality.
- We apply appropriate technical and organisational measures (section 5).
- We help the customer respond to requests from data subjects, mainly through the features of the Service.
- We help the customer meet its security and breach notification obligations.
4. The customer’s obligations
The customer is responsible for having a lawful basis for the processing it instructs, for informing data subjects, and for the accuracy of the data it enters.
5. Security measures
- Each workspace has its own database.
- Data is encrypted in transit.
- Passwords are stored as hashes; access rights are set by the customer.
- Staff access is limited to what is needed, through individual accounts.
- Backups are taken regularly and stored in the European Union.
6. Sub-processors
The customer authorises us to use sub-processors to provide the Service: a hosting provider and an email delivery provider in the European Union. We bind them to data protection obligations no less protective than those in this agreement, and we remain responsible for their work. We will inform the customer before adding or replacing a sub-processor, and the customer may object on reasonable data protection grounds.
7. International transfers
Personal data is processed in the European Union. If data is transferred outside the EU/EEA, we ensure an appropriate safeguard is in place, such as an adequacy decision or the European Commission’s Standard Contractual Clauses.
8. Personal data breaches
We will notify the customer without undue delay after becoming aware of a personal data breach affecting the customer’s personal data, and will describe what happened, what data is affected and what we are doing about it.
9. Deletion
When the agreement ends, the workspace and its data are deleted within 30 days, unless the law requires us to keep them. Copies in backups are deleted when those backups expire.
10. Audits
On request, we provide the information needed to show that we meet this agreement. The customer may audit us once a year, with reasonable notice, at its own cost.
11. Duration
This agreement lasts as long as we process personal data on the customer’s behalf.
12. Contact
Ofski, MB · Naugarduko g. 26-13, LT-03225 Vilnius, Lithuania · info@ofski.dev