Data Processing Agreement

This DPA forms part of the agreement between the customer (controller) and HIVE DYNAMICS DOO, Bulevar oslobođenja 30a, 4th floor, 21000 Novi Sad, Serbia (processor), and governs processing of personal data under Art. 28 GDPR.

Processing of personal data contained in the customer’s AI register, assessments, tasks, and evidence for the purpose of providing the Alframe service, for the duration of the service agreement. Data subjects: the customer’s employees and, where the customer stores them, its own customers’ personnel. Data categories: names, work contact details, role/ownership information, and any personal data the customer chooses to include in evidence files.

We process personal data only on the customer’s documented instructions — the agreement, this DPA, and the customer’s use of the service’s features — unless required by Union or Member State law, in which case we inform the customer before processing unless that law forbids it.

Persons authorised to process the data are bound by contractual or statutory confidentiality obligations.

We implement appropriate technical and organisational measures, including: EU-only hosting; per-tenant isolation enforced with database row-level security; encryption in transit (TLS); passwords hashed with argon2id; content-integrity-checked evidence storage with access via short-lived signed URLs; an append-only audit log; and nightly logical database backups, with a documented quarterly restore drill.

The customer grants general authorisation for the subprocessors listed on our Subprocessors page. We will give 30 days notice of intended changes, during which the customer may object on reasonable data-protection grounds.

Taking into account the nature of processing, we assist the customer with data subject requests (Arts. 15–22) and with its obligations under Arts. 32–36 (security, breach notification, DPIAs, prior consultation), including through the service’s export and deletion features.

We notify the customer without undue delay after becoming aware of a personal data breach affecting the customer’s data, and no later than 48hours, providing the information reasonably needed for the customer’s Art. 33 obligations.

On termination, the customer may export all data via the built-in exports. On the customer’s instruction, or at the latest one year after termination, we delete all personal data unless Union or Member State law requires longer storage.

We make available the information necessary to demonstrate compliance with Art. 28 and allow audits, including inspections, by the customer or its mandated auditor, with reasonable notice and at most once per year unless a supervisory authority requires otherwise or a breach has occurred.

Service data is stored in the EU with Hetzner Online GmbH. The processor is established in Serbia, a third country for which the Commission has issued no adequacy decision under Art. 45 GDPR, so the processor’s administration of the service is itself a transfer. The parties rely on the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), controller-to-processor module, which are incorporated into this DPA by reference.

Where a subprocessor entails a further third-country transfer, it is listed on the Subprocessors page with the safeguard relied on.