Parties: (1) the Customer, the controller ("Controller"), and (2) PASO CLEANING EOOD, trading as IT bugsolutions, ul. Musala 8, 5138 Polikraishte, Bulgaria, BG202091716, contact@itbugsolutions.com ("Processor"). Terms such as "personal data", "processing" and "personal data breach" have the meaning in the GDPR.
1. Subject matter, duration, nature and purpose
1.1 The Processor processes personal data on behalf of the Controller as far as needed to perform the Assignment or Care Plan: diagnosis and repair of the website or software, creating and storing backups, updates, monitoring and security checks (Annex 1).
1.2 Duration: equal to the term of the Assignment or Care Plan, plus the period needed for return or deletion (clause 9).
1.3 The Processor does not determine the purposes or means of processing beyond what is needed to deliver the service. If it does, it becomes a controller itself for that processing.
2. Instructions
2.1 The Processor processes personal data only on documented instructions from the Controller: the Quote, the terms and conditions, this agreement and later written instructions (e-mail suffices).
2.2 The Processor informs the Controller if it believes an instruction infringes the GDPR or other rules, and may suspend carrying out that instruction until the matter is resolved.
2.3 Processing required by law: the Processor informs the Controller beforehand, unless the law prohibits this.
2.4 The Controller ensures a legal basis, any information duties towards data subjects and the right to give the Processor access.
3. Confidentiality
Persons acting for the Processor who have access to personal data are bound by confidentiality (contractual or statutory) and have access only as far as needed for the Assignment.
4. Security
The Processor takes appropriate technical and organisational measures (GDPR Art. 32), at least those in Annex 2, and keeps them up to date. The Controller remains responsible for the security of its own systems and for the credentials it provides (clause 6 of the terms).
5. Sub-processors
5.1 The Controller gives general authorisation to engage sub-processors listed in Annex 3 or added to it under this clause.
5.2 The Processor notifies intended additions or replacements at least 14 days in advance (e-mail or website list). Within that period the Controller may object in writing with reasons. If no solution is found, the Controller may end the affected service free of charge for the remaining part.
5.3 The Processor imposes on the sub-processor the same data protection obligations as in this agreement and remains liable to the Controller for the sub-processor's performance.
6. Assistance
The Processor assists the Controller, taking into account the nature of processing and the information available, with: (a) data subject requests (access, erasure, etc.): if the Processor receives such a request it forwards it without undue delay and does not answer it itself; (b) security, personal data breach notification, data protection impact assessments and prior consultation (GDPR Arts. 32 to 36). Reasonable assistance is included; extensive assistance may be charged at a rate agreed in advance.
7. Personal data breaches
7.1 The Processor notifies a personal data breach affecting the Controller's data without undue delay and aims to do so within 48 hours of discovery, by e-mail.
7.2 The notice contains, as far as known: nature of the breach, categories and numbers concerned, likely consequences, measures taken and proposed, contact person. Missing information follows as soon as possible.
7.3 The Controller decides on notification to the supervisory authority (GDPR Art. 33) and to data subjects. The Processor cooperates.
8. Transfers outside the EEA
8.1 The Processor and its sub-processors preferably process personal data within the EEA. Transfers to a country outside the EEA take place only with an appropriate mechanism: an adequacy decision, or standard contractual clauses (SCCs) of the European Commission with supplementary measures where needed. For the sub-processor list and locations: Annex 3.
8.2 If the Controller is established outside the EEA, the parties cooperate to establish a valid transfer mechanism, signing SCCs where needed.
9. Return and deletion
9.1 After the Assignment or plan ends, the Processor deletes the personal data, or returns it at the Controller's request, as follows: credentials within 7 days; working files and copies within 30 days; backups within 30 days after the end (or the earlier expiry period of the plan), unless the Controller asks for return earlier or the law requires retention.
9.2 On request the Processor confirms deletion in writing.
9.3 Data the Processor keeps as controller (such as file and invoices) is covered by the privacy policy.
10. Audit and information
10.1 The Processor makes available on request the information necessary to demonstrate compliance, and allows for audits (including inspections) by the Controller or an auditor it appoints.
10.2 Audits are announced at least 30 days in advance, take place during office hours, at most once a year (unless after a breach or at the order of a supervisory authority), without unreasonably disrupting the service, under confidentiality and at the Controller's cost. The Processor may first offer a questionnaire or its own reporting.
11. Liability
For liability under this agreement clause 16 of the terms applies, to the extent the law allows and without prejudice to the rights of data subjects and the statutory allocation of liability (GDPR Art. 82).
12. Final provisions
12.1 In case of conflict between this agreement and the terms, this agreement prevails as far as personal data is concerned.
12.2 Governing law and forum: as in the terms (clause 22), without prejudice to mandatory law.
12.3 This agreement applies from acceptance of the Quote and ends with the obligations under clause 9.
Annex 1 - Description of the processing
| Item | Description |
|---|---|
| Subject | Technical services on websites, apps and software of the Customer |
| Nature of processing | Viewing, reading, copying (backup), storing, changing and restoring files and databases; analysing logs; monitoring |
| Purpose | Diagnosis, repair, maintenance, backup and security of the Customer's Systems |
| Categories of data subjects | Users and visitors of the website; (end) customers, web-shop buyers, subscribers, staff and administrators of the Customer, as present in the Systems |
| Categories of personal data | Contact and account data (name, e-mail, address, username, hashed passwords), order data, IP addresses and logs, form and comment content, other data the Customer keeps in its Systems |
| Special categories / criminal data | Not intended. The Customer tells us beforehand if its Systems contain them. We do not ask for card data; payment data is normally managed by the Customer's payment provider. |
| Duration | See clause 1.2 |
| Place of processing | Remotely from Bulgaria and other locations where our staff work, and at the sub-processors in Annex 3 |
Annex 2 - Security measures (GDPR Art. 32)
- Access control: minimum rights, separate access keys per customer, 2FA where possible, individual accounts, access revoked after completion.
- Credentials: only in an encrypted password manager; never in chat or plain e-mail; deleted within 7 days after completion.
- Encryption: connections via TLS/SSH/SFTP; backups are stored encrypted.
- Backups: before changes and (care plan) daily; readability check; retention per plan; stored with a backup storage provider in the EEA.
- Devices: disk encryption, screen lock, updated operating systems and security software on staff devices.
- Log: who, when, which verification and change per Assignment; kept as evidence.
- Separation: customer data is not used for other customers or own purposes; no production data in test environments without need.
- AI tools: customer communication and first analysis may be assisted by AI (Anthropic Claude); work runs as automatically as possible within rules set by people; a person can step in and reviews exceptions; no passwords, no end-user personal data and as little data as possible; masking where possible; supplier contractually bound.
- Staff and subcontractors: confidentiality, data protection instruction.
- Incident procedure: detection, assessment, notice within 48 hours target (clause 7), recovery, evaluation.
- Deletion: secure deletion of working files and copies at the end (clause 9).
- Periodic review of these measures, at least annually.
Annex 3 - Sub-processors (general authorisation, clause 5)
| Sub-processor | Service / purpose | Location | Transfer mechanism | Status |
|---|---|---|---|---|
| Hosting and e-mail provider of IT bugsolutions (website hosting: Namecheap, web-hosting.com) | storage of working files, e-mail | Depends on the provider; details on request | Adequacy decision or SCCs where data leaves the EEA | Own administration and website |
| Backup storage provider in the EEA | storage of backups | EEA | Not applicable (EEA) | Care Plans |
| Anthropic (Claude) | AI assistance for customer communication and first analysis | US, possibly other locations | Adequacy decision (such as the EU-US Data Privacy Framework) or SCCs, as applicable | Only without passwords and without unnecessary personal data; see terms cl. 19 |
| Tawk.to | chat (only messages you yourself post in chat) | Depends on the provider | Adequacy decision or SCCs, as applicable | Our own lead channel only, no customer systems |
| Google (Tag Manager, Analytics) | statistics of our own website | US and elsewhere | Adequacy decision (such as the EU-US Data Privacy Framework) or SCCs, as applicable | Own website only, no customer data |
| Stripe / PayPal | payments | Depends on the provider | Adequacy decision or SCCs, as applicable | Payment data, no customer-system data |
| External monitoring service for uptime/scans, where used | availability and security checks | Depends on the provider | Adequacy decision or SCCs, as applicable | Where used |
Tawk.to, Google and Stripe/PayPal process data about our own contact with the Customer (we are then the controller), not customer-system data. They are listed for transparency. We make the current list available on request.