Data Processing Agreement

1. "Personal Data" refers to any information relating to an identified or identifiable natural person (‘Data Subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
2. "Data Subject" means the individual to whom Personal Data relates.
3. "Processor" refers to Remotek Retail Ltd., who processes Personal Data on behalf of the Controller.
4. "Controller" refers to any client of Remotek Retail Ltd. that owns the Personal Data and determines the purposes and means of processing.
5. "Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The Processor commits to storing all Personal Data of European clients within data centres located in Europe. This is to ensure compliance with the General Data Protection Regulation (GDPR) and other relevant data protection laws.

The Processor utilizes two service providers for data storage: Hetzner and Amazon Web Services (AWS). Both providers operate data centres based in Europe, and these facilities are used exclusively for the storage of Personal Data from our European clients.

• This Agreement applies to the Processing of Personal Data by the Processor, on behalf of the Controller, in accordance with the Controller’s instructions.
• The Processor shall process Personal Data for the purpose of providing tax consultancy and related Software as a Service (SaaS), including but not limited to generating invoices, preparing reports, and fulfilling compliance requirements for VAT returns.
• The Processing activities under this Agreement involve Personal Data which may include, but are not limited to, names, addresses, and other identifiers of the Data Subject, as provided by the Controller in accordance with their use of the Processor’s services.
• The Processor shall process Personal Data in compliance with the requirements of the General Data Protection Regulation (GDPR) and any other applicable data protection laws.
• The Processor acknowledges that the Personal Data may originate from various jurisdictions within Europe, and therefore may be subject to varying data protection and retention requirements.

Encryption: All Personal Data, whether at rest or in transit, shall be encrypted using industry-standard encryption technologies.

Access Control: Measures shall be in place to ensure that access to Personal Data is limited to authorized personnel only. This includes the use of secure passwords, two-factor authentication, and access logging.

The Processor processes Personal Data exclusively for the purpose of delivering its tax consultancy and Software as a Service (SaaS) offerings. This includes the issuance of invoices for every order processed by the Controller’s (Client’s) business.

The generation of invoices is a fundamental step in the service delivery, as it enables the accurate compilation of VAT returns. These VAT returns are subsequently filed with the relevant European jurisdictions, as required by the Controller’s business operations and in compliance with applicable tax laws.

The processing of Personal Data, specifically in the form of generating invoices and compiling VAT returns, is essential for ensuring the Controller’s compliance with the varied tax regulations across different European jurisdictions.

This processing activity is also crucial for the preparation of accurate financial reports, facilitating both transparency and compliance in the Controller’s financial and tax obligations.

The Processor undertakes these processing activities under the legal basis of contractual necessity, as the processing is essential for the fulfillment of the service agreement with the Controller.

Additionally, such processing aligns with legal compliance obligations, as it is necessary for the Controller to fulfill its tax reporting and compliance requirements under the law.

The Processor shall process Personal Data in accordance with the terms set forth in this Agreement and in compliance with applicable data protection laws, including but not limited to the General Data Protection Regulation (GDPR).

The Processor shall process Personal Data only on documented instructions from the Controller, unless required to do so by European Union or Member State law to which the Processor is subject; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The Processor agrees to adhere to the principles relating to the processing of Personal Data under the GDPR, which require that Personal Data shall be:

• Processed lawfully, fairly, and in a transparent manner.
• Collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
• Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
• Accurate and, where necessary, kept up to date.
• Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
• Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures.

The Processor shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk of the processing activities, including measures to protect data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

These measures shall include, but are not limited to, encryption of Personal Data during transmission and while at rest, regular security assessments, and using secure methods for data storage and transfer.

The Processor shall assist the Controller in fulfilling its obligations to respond to data subjects’ requests to exercise their rights under the GDPR. The Processor shall provide timely assistance, considering the nature of the Personal Data and the processing performed.

The Processor shall implement necessary measures and systems to enable and facilitate the Controller’s response to such requests from data subjects.

In the event a data subject contacts the Processor directly regarding their Personal Data, the Processor shall promptly forward such requests to the Controller without responding to the data subject, unless otherwise instructed by the Controller or required by law.

The Processor shall not disclose any Personal Data to a data subject without the explicit instruction or authorization from the Controller, except as required by law.

The Processor commits to storing all Personal Data of European clients within data centres located in Europe. This is to ensure compliance with the General Data Protection Regulation (GDPR) and other relevant data protection laws.

The Processor utilizes two service providers for data storage: Hetzner and Amazon Web Services (AWS). Both providers operate data centres based in Europe, and these facilities are used exclusively for the storage of Personal Data from our European clients.

Any transfer of Personal Data outside the European Economic Area (EEA) shall be conducted in compliance with the provisions of the GDPR and other applicable data protection laws. Such transfers shall only occur under necessary circumstances and with appropriate safeguards in place.

In cases where data transfer is required, the Processor shall implement standard contractual clauses, as approved by the European Commission, or rely on other suitable GDPR-compliant mechanisms to ensure an adequate level of data protection.

The Processor shall ensure that Hetzner and Amazon Web Services (AWS) comply with high standards of data security and adhere to relevant data protection regulations.

Regular audits and assessments shall be conducted to verify the compliance and security standards of Hetzner and AWS, ensuring that they align with the Processor’s obligations under the GDPR and this Agreement.

Upon termination of this Agreement, the Processor shall, at the choice of the Controller, delete or return all Personal Data processed on behalf of the Controller. This process shall be completed within a reasonable period following termination, unless European Union or Member State law requires storage of the Personal Data.

The Processor shall also delete existing copies of the Personal Data unless European Union or Member State law requires storage of the data.

The Processor commits to regularly monitoring changes in data protection laws and regulations and adapting its data processing practices accordingly to remain in compliance.

The Processor shall inform the Controller of any significant changes in law or regulation that may affect the processing of Personal Data under this Agreement.