Data Processing Agreement

Technical template: 2026-07-31

1. Roles of the parties

The customer company acts as controller for the worker, contractor, supplier and document data it enters. iProdGest acts as processor when processing that data on behalf of and under thand thecumented instructions of the customer company.

2. Subject matter, duration and purpose

Processing covers hosting, organisation, consultation, authorised transmission, backup, expiry alerts, support and deletion of the data required to provide ObraDocs during the subscription term and agreed retention period.

3. Categories of data and data subjects

Identification and contact data, company relationship, project information, professional documentation and associated metadata may be processed. Data subjects may include users, workers, subcontractors, suppliers, representatives and other project participants.

4. Instructions and confidentiality

The processor processes data only on documented instructions, unless otherwise required by law. Authorised persons are bound by confidentiality and receive access according to their duties.

5. Security

The processor applies measures appropriate to the risk, including logical segregation by company, authentication, permission controls, audit logs, file protection, software updates, backups and incident management.

6. Sub-processors

Hosting, email, backup and payment providers may be used. Equivalent data protection duties must be imposed. The specific list of providers, locations and transfer mechanisms must be kept current and communicated under the contract.

7. Assistance to the controller

ObraDocs includes tools to record data subject requests, export data, restrict processing, perform approved erasures, maintain incident records and generate a record-of-processing template. The controller remains responsible for deciding how to respond and for any legal limitations.

8. Data breaches

The processor informs the controller without undue delay after becoming aware of a breach affecting data processed on its behalf and provides reasonable information for assessment, documentation and applicable notifications.

9. Return and deletion

At the end of the service, data is returned or deleted according to the controller’s instructions, the contract and legal obligations, including backups within their retention cycle.

10. Audit and information

The processor provides the information necessary to demonstrate compliance with applicable obligations and cooperates with reasonable audits while protecting security, confidentiality and the rights of other customers.