Auftragsverarbeitungsvertrag

This Data Processing Agreement ("DPA") under Article 28 GDPR is concluded between the Customer as controller and Cyber in Systems Korlátolt Felelősségű Társaság (Cyber in Systems Kft.) (4183 Kaba, Baross Gábor utca 46., Hungary, company reg. no.: 09-09-029715, tax ID: 26328038-2-09) as processor (the "Processor") and forms an integral part of the Terms of Service for EHS Axis; it takes effect on registration and acceptance of the Terms. For personal data this DPA prevails over the Terms. Effective: 2026-09-29.

1. Subject matter, nature, purpose and duration

• Subject matter and purpose: storage and processing of personal data recorded by the Customer in the Service in order to provide the Service (record-keeping, display, notifications, reports and exports, backup, support).
• Nature: collection (through the Customer's input), storage, organisation, retrieval, display, transmission in e-mail notifications to Workspace users, backup, erasure.
• Data subjects: the Customer's employees, managers, contractors, visitors, Workspace users and persons appearing in non-conformities, audits and photos.
• Categories of data: name, e-mail, phone, job title, department, role, employee number, activity log; text of non-conformities, actions, audits and risks; training and equipment inspection records, certificates; photographs (which may show persons).
• Special categories: not a purpose of the Service. If the Customer records such data (e.g. health data related to an accident), the Customer is responsible for the legal basis under Article 9 GDPR and for data minimisation.
• Duration: the term of the contract and until deletion under Section 6.

2. Obligations of the Customer (controller)

The Customer is responsible for the lawfulness of processing, informing data subjects, the legal basis and the lawfulness of its instructions. Use of the Service's functions, the Terms and this DPA constitute the Customer's documented instructions.

3. Obligations of the Processor

The Processor shall (a) process personal data only on the Customer's documented instructions, including with regard to transfers to third countries, and inform the Customer without delay if an instruction in its opinion infringes the law; (b) ensure that persons with access are bound by confidentiality; (c) implement the technical and organisational measures under Article 32 GDPR (Annex 2); (d) engage sub-processors only under Section 4; (e) assist the Customer with appropriate measures in responding to data subject requests – forwarding requests received directly without undue delay – and in complying with Articles 32–36 GDPR (security, breach notification, DPIA, prior consultation); (f) act under Section 6 at the end of the contract; (g) make available all information necessary to demonstrate compliance with Article 28 and allow audits under Section 5.

4. Sub-processors

The Customer grants general authorisation for the sub-processors listed in Annex 1. The Processor imposes data protection obligations equivalent to this DPA on each sub-processor and remains liable for their performance. The Processor notifies the Customer by e-mail at least 30 days before engaging or replacing a sub-processor; the Customer may object on reasonable data protection grounds within that period. If no solution is found, the Customer may terminate free of charge before the change takes effect, and unused fees are refunded pro rata.

5. Personal data breaches, audits

The Processor notifies the Customer of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it, providing the information available under Article 33(3) GDPR (nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed, contact point), and supplements it as it becomes available. The Customer primarily verifies compliance on the basis of the Processor's written information, documentation and the hosting provider's certifications; in addition, at most once a year – and also after a breach or at the request of an authority – the Customer may carry out an on-site or remote audit at its own cost, agreed at least 30 days in advance, without disrupting operations and subject to confidentiality.

6. End of the contract

After the contract ends, the Workspace remains available read-only and exportable for 90 days (return of data at the Customer's choice). Thereafter the Processor deletes the personal data, and from backups within a further 14 days, unless Union or Member State law requires storage; on request the Processor confirms deletion in writing. On the Customer's request deletion takes place earlier.

7. Transfers, liability, miscellaneous

Customer Data are stored within the EEA. If a sub-processor accesses personal data from a third country, the transfer is subject to safeguards under Chapter V GDPR (adequacy decision, EU–US Data Privacy Framework, standard contractual clauses). Liability is governed by Article 82 GDPR and the liability provisions of the Terms. This DPA remains in force until the end of the contract or the deletion of the data.

Annex 1 – Sub-processors

Annex 2 – Technical and organisational measures (Art. 32 GDPR)

• Encryption: all connections over HTTPS/TLS; passwords with salted one-way hashes (bcrypt); signed session tokens.
• Isolation and access: logical per-Workspace data isolation in every query (verified by automated tests); role-based permissions (owner, administrator, approver, responsible, inspector, viewer); uploaded files only for Workspace members; separately authenticated operator interface.
• Availability and recovery: daily database and file backups kept for 14 days; process monitoring and automatic restart; EU data centre.
• Development and operations: version control, automated regression and permission tests before release; security updates; access limited to necessary personnel bound by confidentiality.
• Logging and incident handling: server and application logs for 30 days; incident procedure under Section 5.
• Abuse prevention: bot protection on public forms, e-mail verification required for ordering.