Data processing terms

These Data Processing Terms (DPT) form an integral part of the Agreement between Novafy and the Client and apply where Novafy processes personal data on the Client's behalf while providing the Services. They are drawn up under Article 28 of the General Data Protection Regulation (EU) 2016/679 (GDPR). Version 1.0.

1. Roles

1. The Client is the controller and MB "Novafy" (Novafy) is the processor.
2. The Client is responsible for the lawfulness of the processing (legal basis, informing data subjects); Novafy is responsible for processing the data only on the Client's instructions and in line with these DPT.

2. Subject matter and nature of processing

1. Subject matter and purpose: developing, testing, deploying, hosting, maintaining and supporting the Client's systems, websites and apps under the Agreement.
2. Duration: the term of the Agreement plus the time needed to return or delete the data (see section 8).
3. Processing operations: storage, structuring, viewing, copying (backups), transfer (migration), correction, deletion.
4. Data subjects: users of the Client's system, the Client's customers, employees and other persons whose data the Client processes in its system.
5. Categories of data: typically contact and account data (name, email, phone), order and transaction data, technical data (IP address, logs). Special categories of data are processed only if expressly stated in the Agreement.

3. Novafy's obligations

1. Process personal data only on documented instructions from the Client (the Agreement, Proposal, tasks in the Client portal or by email), unless required by EU or Lithuanian law, in which case Novafy informs the Client unless prohibited.
2. Immediately inform the Client if, in Novafy's opinion, an instruction infringes the GDPR or other data protection law.
3. Ensure that persons processing the data are bound by confidentiality.
4. Implement the security measures required by Article 32 GDPR (see section 5).
5. Assist the Client in responding to data subject requests (access, rectification, erasure, portability etc.) and with its obligations under Articles 32–36 GDPR, taking into account the nature of processing and the information available. Extensive assistance may be charged at the hourly rate.
6. Make available the information necessary to demonstrate compliance with these DPT and allow audits by the Client or its mandated auditor with at least 15 business days' notice, no more than once a year (except after a personal data breach). The Client bears the cost of the audit.

4. Sub-processors

1. The Client gives general authorisation to engage the sub-processors listed below. Novafy has contracts with each of them imposing data protection obligations no less protective than these DPT.
2. Novafy informs the Client at least 14 days before adding or replacing a sub-processor. The Client may object on reasonable grounds within that period; if no solution is found, the Client may terminate the affected part of the Services.
3. Novafy remains liable to the Client for its sub-processors as for itself.

Sub-processor	Purpose	Data location
Railway Corporation	Application and database hosting (EU region)	ES / EU (Nyderlandai), JAV įmonė / US company
Cloudflare, Inc.	DNS, CDN, R2 file storage (EU jurisdiction)	ES / EU, JAV įmonė / US company
Resend (Plus Five Five, Inc.)	Sending system emails	ES / EU (Airija), JAV įmonė / US company
Microsoft Ireland Operations Ltd.	Email and documents (Microsoft 365)	ES / EU
Stripe Payments Europe Ltd.	Card payments (only if used)	ES / EU (Airija)

Only the sub-processors needed for a given project are used. If the Client hosts the system on its own infrastructure, Novafy only connects to it for maintenance.

5. Security measures

• Data is hosted in the European Union; transfers are encrypted (TLS) and backups are encrypted.
• Access is limited to people who need it, using individual accounts, strong passwords and two-factor authentication where available.
• Production data is not used for development or testing unless necessary and agreed with the Client, and is pseudonymised where possible.
• Regular security updates, dependency vulnerability monitoring and access logs.
• Daily backups (where Novafy hosts the system) with the ability to restore them.
• Full-disk encryption and automatic screen locking on work computers.

6. Personal data breaches

Novafy notifies the Client by email without undue delay and in any case within 48 hours of becoming aware of a personal data breach, providing the information available (nature of the breach, categories and approximate number of records affected, likely consequences and measures taken) so the Client can meet its obligations under Articles 33–34 GDPR. Novafy immediately takes steps to contain the breach.

7. Transfers outside the EU

Novafy aims to process data within the EU/EEA. Where a sub-processor or its group company may access data outside the EEA, transfers take place only with the safeguards of Chapter V GDPR — an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or standard contractual clauses.

8. Return and deletion of data

When the Services end, at the Client's choice Novafy returns the Client's data in a common format (e.g. a database export) and/or deletes it within 30 days, including copies, unless storage is required by law. Data in backups is deleted in the normal backup rotation (no longer than 35 days).

9. Liability and term

The liability provisions of the Agreement apply insofar as they are consistent with Article 82 GDPR. These DPT remain in force for as long as Novafy processes personal data on the Client's behalf. Questions about data processing: [email protected].