1. Parties, subject and duration
This is an addendum between SP10 DOO NOVI SAD (processor or subprocessor) and the contracting client/agency. It becomes binding when an authorized representative incorporates it into the service agreement. An individual's acceptance of account rules and public posting alone do not conclude an organization's DPA. Its subject is providing Biro features during the agreement and controlled return/deletion on termination. Where an agency acts as processor, it obtains controller authorization to engage SP10 as subprocessor.
2. Scope and instructions
Processing includes receipt, storage, classification, reading/OCR, authorized AI analysis, record keeping, output generation, delivery and deletion for contracted modules. Individuals include users, employees, representatives, partners and persons in documents; data includes identity, contact, financial, tax, legal and employment information, with sensitive data only where lawful and necessary. The processor acts only on documented instructions, including transfers, unless legally required otherwise, with notice where permitted. It warns of instructions it considers unlawful. Data is not used for its own advertising or its own model training.
3. Confidentiality and safeguards
The processor binds authorized personnel to confidentiality and limits access by task. A contractual annex must confirm actual safeguards: authentication and 2FA, client isolation, TLS, secret protection, audit, updates, backups, recovery and periodic checks. Encryption of all data at rest, certification or successful recovery testing is not confirmed without evidence. The controller is responsible for lawfulness, notices to individuals and its authority/instructions.
4. Subprocessors and transfers
Current subprocessors are Hetzner (application and database, Germany), Cloudflare (active documents and backups; backup region EEUR), Resend (email), Anthropic and OpenAI (active AI routes). Google Gemini is not enabled. Further engagement requires specific or general written controller authorization. Under general authorization, changes are notified at least 30 days in advance to allow reasoned objections; unresolved objections are addressed by an alternative or termination of the affected service before transfer. Subprocessors assume at least equivalent obligations; SP10 remains responsible for their performance. Transfers abroad require a valid legal mechanism and necessary assessment/supplementary safeguards.
5. Assistance, incidents and verification
The processor assists the controller with individual requests, security, impact assessments and regulatory consultation, taking account of processing and available information. It notifies the controller of a personal data breach without undue delay after awareness, providing known facts and later updates without waiting for the investigation to finish. The controller assesses authority and individual notification within statutory deadlines. The processor provides compliance information and permits proportionate audits/inspections by an authorized auditor while protecting other clients; this does not limit regulatory supervision.
6. Termination and required annexes
At the controller's choice, data is returned or deleted after the service ends, with copies deleted unless retention is legally required. The retrieval window is 30 days after contract termination; deletion of active data without a basis for further retention is completed by day 60 after termination. Where the client has the statutory retention duty, documented handover determines further custody; SP10 does not retain copies solely because the client has that duty. Backups use a rolling 60-day cycle; retained data remains protected and unused for other purposes. The return format is agreed based on reasonably available exports for the enabled modules. The DPA prevails over general terms on processing matters.
Provider data processing terms
Privacy and support: [email protected]