- 1. Definitions
- 2. Scope and roles
- 3. Customer’s obligations
- 4. Our obligations
- 5. Sub-processors
- 6. International transfers
- 7. Personal data breaches
- 8. Deletion and return
- 9. Audits
- 10. Liability and precedence
- 11. Duration
- Annex I — Details of processing
- Annex II — Technical and organisational measures
- Annex III — Sub-processors
This Data Processing Agreement (“DPA”) applies when Ofski, MB processes personal data on behalf of a customer in OFSKI EMS, as required by Article 28 of the GDPR. It forms part of the Terms of Service and applies automatically to every customer; no signature is required.
1. Definitions
“GDPR” means Regulation (EU) 2016/679. “Customer Data”, “Workspace” and “User” have the meaning given in the Terms of Service. “Personal data”, “processing”, “controller”, “processor”, “sub-processor” and “data subject” have the meaning given in the GDPR.
2. Scope and roles
2.1. The Customer is the controller of the personal data in its Workspace. Ofski, MB is the processor.
2.2. Where the Customer’s own customers or partners are themselves controllers, the Customer acts as their processor and we act as a sub-processor.
2.3. For account, billing and technical data we are the controller; that processing is described in our Privacy Policy, not here.
3. Customer’s obligations
3.1. The Customer determines the purposes of the processing and is responsible for having a lawful basis for it.
3.2. The Customer informs data subjects about the processing, as the GDPR requires.
3.3. The Customer is responsible for the accuracy of the data it enters and for the access rights it grants to its Users.
3.4. The Customer must not enter special categories of personal data (Article 9 GDPR) into the Service unless agreed with us in writing.
4. Our obligations
4.1. We process personal data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s use of the Service are those instructions.
4.2. We do not use Customer Data for our own purposes and do not disclose it, except as set out here or as the law requires. If the law requires disclosure, we will tell the Customer first, unless we are forbidden to.
4.3. Everyone we allow to process the data is bound by confidentiality.
4.4. We apply the technical and organisational measures set out in Annex II.
4.5. We help the Customer respond to requests from data subjects, mainly through the features of the Service. If a data subject contacts us directly, we refer them to the Customer.
4.6. We help the Customer meet its obligations on security, breach notification and, where needed, data protection impact assessments.
5. Sub-processors
5.1. The Customer authorises the sub-processors listed in Annex III.
5.2. We bind each sub-processor to data protection obligations no less protective than those in this DPA, and we remain responsible for their work.
5.3. We will inform the Customer at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds; if we cannot resolve the objection, the Customer may terminate the affected part of the Service.
6. International transfers
Personal data is processed in the European Union. If a transfer outside the EU/EEA becomes necessary, we will rely on an adequacy decision or on the European Commission’s Standard Contractual Clauses, and will tell the Customer.
7. Personal data breaches
7.1. We will notify the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting the Customer’s personal data.
7.2. The notification will describe what happened, which data and how many data subjects are affected as far as we know, the likely consequences, and the measures we have taken.
7.3. Notifying supervisory authorities and data subjects is the Customer’s responsibility; we will provide the information the Customer needs.
8. Deletion and return
8.1. The Customer can export its data at any time while the Workspace is active.
8.2. When the agreement ends, the Workspace and its data are deleted within the periods set out in the Terms, unless the law requires us to keep them.
8.3. Copies in backups are deleted when those backups expire, normally within 12 months.
9. Audits
9.1. On request, we provide the information needed to show that we meet this DPA.
9.2. The Customer may audit us once a year, with at least 30 days’ written notice, during business hours, without disrupting the Service and at its own cost.
10. Liability and precedence
The limitations of liability in the Terms of Service apply to this DPA. If this DPA and the Terms conflict on the processing of personal data, this DPA prevails.
11. Duration
This DPA lasts as long as we process personal data on the Customer’s behalf.
Annex I — Details of processing
Subject matter: providing, securing and supporting OFSKI EMS.
Duration: for as long as the agreement is in force, plus the deletion periods in section 8.
Nature and purpose: storing, organising, displaying, changing and deleting the data the Customer enters, so that the Customer can run its event business.
Categories of data subjects: the Customer’s staff and Users, artists and performers, crew, clients and contact persons of partners and venues.
Categories of personal data: names, contact details, job titles, contract and fee information, schedules, correspondence and files uploaded by the Customer.
Special categories: none, unless agreed in writing.
Annex II — Technical and organisational measures
- Each Workspace has its own separate database.
- Data is encrypted in transit (HTTPS).
- Passwords are stored only as hashes.
- Access rights inside a Workspace are set by the Customer; our staff access is limited to what is needed, through individual accounts.
- Actions in the Service are recorded in audit logs; logs are kept free of passwords and session tokens.
- Backups are taken regularly, encrypted and stored in the EU, and restores are tested.
- Updates and security patches are applied regularly.
Annex III — Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting servers and backups | EU (Germany/Finland) |
| Hostinger International Ltd | Sending emails | EU (Lithuania) |
Questions about this DPA: Ofski, MB · Naugarduko g. 26-13, LT-03225 Vilnius, Lithuania · info@ofski.dev