Data Processing Agreement

under Art. 28 of Regulation (EU) 2016/679 (GDPR). It forms part of the Terms of Service and is concluded by registering as an Issuer.

1. Parties and roles

The Issuer is the controller of personal data it provides while using the Service (in particular in seal titles and, for the Vír Foto app, data about photographers of its account). GP novum s.r.o., Company ID 28155483, Riegrova 1756/51, 370 01 České Budějovice, Czech Republic is the processor.

2. Subject matter, nature and purpose

The processor stores and makes available seal data for the purpose of issuing and verifying seals under the Terms of Service, for the term of the contract.

3. Categories of data and data subjects

Identification data contained in seal titles; account names and device public keys for Vír Foto; file fingerprints. Data subjects: the Issuer's employees and contractors and persons the Issuer names. The Service does not process special categories of data (Art. 9 GDPR) and the Issuer does not put them into it.

4. Processor obligations

• process data only on the Issuer's documented instructions (these terms and the Service settings);
• ensure confidentiality of persons with access to the data;
• implement appropriate technical and organisational measures (Art. 32): encrypted transfer (HTTPS), storing only fingerprints of API keys, separation of Issuers' data, access to the administration limited to authorised persons;
• engage only the sub-processors listed in the Privacy Policy, and inform the Issuer in advance of changes with the possibility to object;
• assist the Issuer with data subject requests and obligations under Arts. 32–36;
• notify a personal data breach without undue delay, at the latest within 48 hours of becoming aware of it;
• delete or return data at the end of the contract — except entries in the public log, which under the Terms of Service contain no personal data and cannot be deleted;
• make available the information needed to demonstrate compliance and allow audits to a reasonable extent.

5. Transfers outside the EU

Hosting is provided by Netlify, Inc. (USA) on the basis of the EU-US Data Privacy Framework (adequacy decision) and, where that does not apply, the European Commission's standard contractual clauses. E-mails are sent by Sendinblue SAS (Brevo, France) within the EU.

6. Contact

info@gpnovum.cz

The English version of this document is the governing version; any translation is for convenience only.