← Back to the main page

Data Processing Agreement

under Art. 28(3) of Regulation (EU) 2016/679 (GDPR) and Section 34 of Slovak Act No. 18/2018 Coll. on Personal Data Protection

Effective from 20 October 2026

This is an English translation for information. The Slovak version is legally binding.

1. Introductory provisions
2. Subject matter, nature and purpose of processing
3. Duration of processing
4. Controller’s instructions
5. Obligations of the controller
6. Obligations of the processor
7. Sub-processors
8. Transfers to third countries
9. Data subject rights
10. Personal data breach
11. End of processing, return and deletion
12. Demonstrating compliance and audits
13. Liability
14. Final provisions
15. Annex 1 — Description of processing
16. Annex 2 — Technical and organisational measures
17. Annex 3 — List of sub-processors

1. Introductory provisions

1. The processor operates the online service Inventio supporting business development (the “service”). In providing it, the processor processes personal data on behalf of the controller.
2. This agreement sets out the rights and obligations of the parties regarding the processing of personal data and forms an integral part of the agreement, order or other arrangement under which the controller uses the service (the “main agreement”).
3. The agreement is concluded when signed by both parties, or when the controller orders the service or starts using it with reference to this agreement — whichever occurs first. On request, the processor will also sign it in paper or electronic form.
4. Terms (personal data, processing, controller, processor, data subject, personal data breach, etc.) have the meaning given in Art. 4 GDPR.

2. Subject matter, nature and purpose of processing

1. The subject of the agreement is the processing of personal data by the processor solely for the purpose of providing the service to the controller under the main agreement.
2. The nature and purpose of processing, the categories of personal data and the categories of data subjects are described in Annex 1.
3. The processor may not process personal data for its own purposes or disclose it to third parties, except for sub-processors under Article 7 and cases where required by EU or Slovak law.
4. The processor does not use the controller’s personal data to train artificial intelligence models and ensures that sub-processors do not use it for that purpose either.

3. Duration of processing

1. Processing lasts for the term of the main agreement and thereafter only for the time needed to return and delete the data under Article 11.

4. Controller’s instructions

1. The processor processes personal data only on documented instructions from the controller. Documented instructions are this agreement, the main agreement, settings and actions taken by the controller and its users in the service (e.g. importing lists, running lead search, AI analyses, creating a form or a tracked offer) and instructions sent by e-mail.
2. If the processor considers that an instruction infringes the GDPR or other data protection rules, it will inform the controller without undue delay and is not obliged to carry out the instruction until it is clarified.

5. Obligations of the controller

1. The controller is responsible for processing personal data in the service lawfully — having a legal basis (Art. 6 GDPR), fulfilling information obligations towards data subjects (Art. 13 and 14 GDPR) and entering or obtaining data in the service in compliance with the law.
2. This applies in particular to features where the service searches public sources on the controller’s instruction (lead search, company maps, decision-makers, signals), to the inquiry form on the controller’s website (link to the controller’s privacy policy) and to tracked offers (the service shows the recipient a notice that the sender can see when the offer is opened).
3. The controller does not enter special categories of personal data (Art. 9 GDPR) or data relating to criminal offences (Art. 10 GDPR) into the service unless the parties agree otherwise in writing.
4. The controller manages its users’ access and is responsible for protecting their sign-in credentials.

6. Obligations of the processor

1. The processor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality; confidentiality continues after the agreement ends.
2. The processor implements appropriate technical and organisational measures under Art. 32 GDPR. Their current description is in Annex 2. The processor may change the measures provided the level of protection is not reduced.
3. The processor maintains records of categories of processing activities under Art. 30(2) GDPR.
4. The processor provides the controller with reasonable assistance in fulfilling its obligations under Art. 32 to 36 GDPR (security, breach notification, impact assessment, prior consultation), taking into account the nature of processing and the information available to it.

7. Sub-processors

1. The controller gives the processor general written authorisation to engage sub-processors. Sub-processors engaged on the effective date are listed in Annex 3 and the controller agrees to them.
2. The processor will inform the controller of any intended addition or replacement of a sub-processor by e-mail or by publishing an updated list on the website at least 30 days in advance. The controller may object within this period on reasonable data protection grounds. If the parties do not find a solution, the controller may terminate the main agreement with effect from the date of the change and remains entitled to a pro rata refund of any prepaid fees.
3. The processor imposes on each sub-processor by contract the same data protection obligations as it has under this agreement and remains liable to the controller for their performance.

8. Transfers to third countries

1. Personal data is stored in the Slovak Republic. A transfer to a third country takes place only when AI features of the service are used, via the sub-processor Anthropic, PBC (USA), limited to the material needed for the specific task.
2. The transfer is safeguarded by Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914, which form part of this sub-processor’s data processing addendum. Under its terms, data sent via the API is not used to train models and is generally deleted within 30 days.
3. Any other transfer to a third country is possible only with the controller’s prior consent or where required by EU or Slovak law.

9. Data subject rights

1. The processor assists the controller with appropriate technical and organisational measures in responding to data subject requests. The service allows data to be searched, corrected, deleted and exported (CSV, JSON).
2. If a data subject contacts the processor directly with a request concerning the controller’s data, the processor forwards it to the controller without undue delay and does not respond on the merits unless the parties agree otherwise.

10. Personal data breach

1. The processor notifies the controller of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, to the e-mail address of the space owner or the controller’s contact address.
2. The notification contains the information under Art. 33(3) GDPR available to the processor (nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken and proposed, contact person). Where not all information can be provided at once, it may be provided in phases.
3. The processor takes measures to mitigate the consequences without undue delay and assists the controller in notifying the supervisory authority and data subjects.

11. End of processing, return and deletion

1. The controller can export its data at any time. After the main agreement ends, the processor will, at the controller’s request, hand over the data in a machine-readable format (CSV or JSON) and then, no later than 30 days after the end, delete the controller’s personal data from the service.
2. Copies in backups expire automatically at the end of the backup retention period (14 days). Data at the sub-processor Anthropic is deleted under its terms.
3. The deletion obligation does not apply to data whose retention is required by EU or Slovak law; such data is processed only for that purpose.

12. Demonstrating compliance and audits

1. On request, the processor provides the controller with the information necessary to demonstrate compliance with Art. 28 GDPR, in particular the current description of measures and the list of sub-processors.
2. The controller or an auditor mandated by it and bound by confidentiality may carry out an audit, including inspections, as a rule once a year with at least 30 days’ notice, during business hours and without unreasonable disruption. Audits of sub-processors are carried out through the reports and certifications they provide. The controller bears the cost of the audit unless it reveals a material breach of this agreement.

13. Liability

1. Each party is liable for damage caused by breach of its obligations under this agreement and the GDPR within the scope of Art. 82 GDPR. Where the main agreement limits liability, the limitation applies to the extent permitted by law.

14. Final provisions

1. The agreement is concluded for the term of the main agreement. Provisions on confidentiality, return and deletion of data survive its end.
2. In the event of a conflict between this agreement and the main agreement, this agreement prevails on matters of personal data protection.
3. The processor may amend this agreement where required by a change in law or in the service; it will notify the controller at least 30 days in advance. An amendment may not reduce the level of personal data protection. If the controller does not agree, it may terminate the main agreement as of the effective date of the amendment.
4. The agreement is governed by the law of the Slovak Republic. Disputes will be decided by the competent courts of the Slovak Republic.
5. The Slovak version of the agreement is binding; translations are for information only.

Annex 1 — Description of processing

Nature of processing

storage, organisation, retrieval, viewing, modification, analysis (including AI analysis), export, transfer and deletion of data within the service; obtaining data from public sources on the controller’s instruction; recording web form inquiries and tracked offer events; sending e-mail notifications

Purpose

providing the Inventio service: records of companies and contacts (CRM), search and analysis of potential customers, signals, meeting preparation, logging of communication, inquiry form, tracked offers, reports and export

Categories of data subjects

contact persons of the controller’s business partners, customers and prospects; persons submitting an inquiry via the controller’s form; recipients of tracked offers; users of the service on behalf of the controller; other persons mentioned in material the controller enters into the service

Categories of personal data

name, title, job position and role in the buying process, company, business e-mail and phone, LinkedIn profile link, content of communication and notes, content of inquiries and attached files, publicly available professional information; for tracked offers time and duration of viewing, attachment downloads, browser type and a pseudonymised hash of the IP address; for users sign-in data (password only as a hash), role, activity log including IP address at sign-in

Special categories of data

not processed (Art. 5(3) of the agreement)

Place of processing

Slovak Republic (hosting); USA only for AI features under Art. 8 of the agreement

Duration

for the term of the main agreement and no more than 30 days after it ends; backups 14 days

Annex 2 — Technical and organisational measures

Location and physical security

• The application, database and files are hosted by WebSupport s.r.o. in a data centre in Bratislava; hosting backups are stored in a different data centre, also in Bratislava.
• Data centre: access control, motion detection, fire alarm, smoke and water detection, fire suppression, 24/7 security guard; access only for authorised staff of the provider.
• The hosting provider is subject to Slovak Act No. 69/2018 Coll. on Cybersecurity and to regular cybersecurity audits.

Transmission and network

• Communication with the application is encrypted (HTTPS, TLS 1.2 and 1.3; TLS 1.0 and 1.1 are disabled).
• Web application firewall (WAF) and DDoS protection at the provider; continuous operations monitoring.
• Server access only via encrypted protocols (SFTP, SSH); customer accounts on the server are technically separated.

Access control in the application

• Each customer has its own separate space (workspace); users only see the spaces they have access to.
• Roles: owner (manages the team), editor (works with data), view only (no changes); administrators of the processor.
• Passwords are stored only as a one-way hash (bcrypt). After 8 failed sign-in attempts from one IP address, sign-in is blocked for 15 minutes.
• Session cookie with HttpOnly and SameSite attributes, plus Secure over HTTPS; forms are protected against cross-site request forgery (CSRF).
• Important actions (sign-in, changes, exports, deletion) are recorded in the activity log.

Protection of data and files

• The database and uploaded files are not directly accessible from the web; files are served only to signed-in users with access to the given space.
• For tracked offers, the recipient’s IP address is not stored — only a truncated cryptographic hash (pseudonymisation); nothing is stored on the recipient’s device.
• AI receives only the material needed for a specific task, not the whole database; each AI run is logged and a monthly limit can be set for each space.

Availability and recovery

• The hosting backs up all files daily to a different data centre; backups are kept for 14 days.
• The application creates its own consistent database copy daily and keeps it for 14 days; the administrator can store it outside the hosting.
• The whole database as well as individual files can be restored to a selected day.

Organisational measures

• Only authorised persons of the processor bound by confidentiality have access to data, to the extent necessary for operation and support.
• Security incidents are handled without undue delay, including risk assessment and notification to the controller under this agreement.
• Development takes place on a separate copy; customer data is not used for testing unless necessary to resolve an error reported by the customer.
• Measures are reviewed and updated regularly; application-level encryption of sensitive settings and two-factor sign-in are in preparation.

Annex 3 — List of sub-processors

Public registers (e.g. the Slovak register of legal entities, the Czech ARES) from which the service adds company data are not sub-processors — they are sources of publicly available data.