Data processing agreement

1. Parties

• Controller: the client that has an organisation in tarcus.
• Processor: TARCON OÜ, registry code 16487228, address Meruski tn 10-4, 51017 Tartu, Estonia.

2. Subject and duration

The processor processes personal data only to provide the tarcus service to the client, while the contract is in force and until the data is deleted after it ends.

3. Data and data subjects

• Data subjects: the client's employees and other users the client invites (for example subcontractors), people who report faults, people in photos, and people named in the content.
• Data: name, e-mail, role, sign-in data (IP address, browser), activity history, notes, comments and work orders, photos, and notification settings.
• Operations: storing, showing to users with the right permissions, sending notifications, backing up, deleting.

The service does not need special categories of personal data, and the client does not enter them.

4. The processor's obligations

• Processes the data only on the client's documented instructions; the instructions are the contract and the client's own use of the service.
• Makes sure that the people with access to the data are bound to confidentiality.
• Applies the security measures in Annex 1.
• Helps the client answer data subjects' requests; the software has a data export and erasure for this.
• Tells the client of a personal data breach without undue delay, and within 48 hours of finding it at the latest.
• Helps the client with an impact assessment and with the supervisory authority where it concerns the service.
• Gives the client the information that shows these obligations are met, and allows an audit at the client's cost on reasonable notice.

5. Sub-processors

The client allows the sub-processors in Annex 2. We give at least 30 days' notice of a new one; if the client reasonably objects and no solution is found, it may end the contract. The processor binds each sub-processor to the same data protection obligations by contract.

6. Where the data is

The data is kept in the European Union. Where a sub-processor is outside the European Economic Area, transfers rest on the European Commission's standard contractual clauses or another basis the GDPR allows.

7. When the contract ends

Until the contract ends, the client can download its data itself. When it ends, the organisation is closed and the data deleted 30 days later; in those 30 days the processor helps export it on request. It leaves the backups within the next 14 nights. Billing data is kept as long as the law requires.

Annex 1. Security measures

• Connections are encrypted (HTTPS, HSTS). The application has a content security policy and the other security headers.
• Passwords are kept as scrypt hashes; session, invitation and reset tokens only as hashes.
• Two-factor sign-in is required of administrators; the client can require it of everybody.
• Sign-in attempts are limited, and suspicious attempts are mailed to the user.
• Each organisation's data is kept apart from every other's, and automated tests check it.
• Roles (administrator, manager, technician, viewer) limit who sees and does what.
• An encrypted backup is made every night, off the server; restoring it is checked.
• Deleted files are kept for 30 days so they can be put back.
• Uploaded models are processed in a separate process with no access to any secret.
• Every business action and sign-in is logged; the provider joining a client's organisation is written into the client's own activity history.
• Only the provider's responsible staff have access to the servers and keys.

Annex 2. Sub-processors