Data Processing Agreement

This Data Processing Agreement (the Agreement) is entered into under Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council (the GDPR) between Petr Zeman - Forgmatic, registered at Orechov 88, 59452 Orechov, company ID No. (IČO) 07924925, the operator of the Forgmatic software service (the Operator or Processor), and the business that has set up the service (the Customer or Controller).

This Agreement supplements the service terms of use. The Customer enters into it electronically during registration, together with the service terms of use, by checking the consent box in the sign-up form, which links to both agreements. The Agreement takes effect when the shop is set up. The Customer confirms any new version of this Agreement in the service administration (Section 13.2). The Operator records the moment of acceptance, the exact wording and its fingerprint (hash).

1. Roles of the parties and scope

1.1 The Customer is the controller of the personal data of the persons whose data it enters into the service or whose data arise from the operation of its shop — in particular the data of its customers, enquirers and newsletter subscribers.

1.2 The Operator processes those data as a processor for the Customer, solely for the purpose of providing the service.

1.3 This Agreement does not apply to data for which the Operator itself is the controller — in particular the Customer's registration and billing data and the data of its users, operational records of service usage, and data processed to secure the platform. Their processing is described in the Operator's privacy policy.

2. Subject matter, nature and purpose of processing

2.1 The subject matter of the processing is the operation of an online shop and a custom-manufacturing configurator on the Operator's infrastructure: storing, displaying, transmitting in the course of order fulfilment, backing up and deleting personal data.

2.2 The purpose of the processing is the provision of the service to the Customer within the scope of the features the Customer has chosen. The Operator does not process the data for its own purposes, does not build profiles from them and does not disclose them to third parties beyond this Agreement.

2.3 A detailed description of the processing (categories of data subjects and categories of data) is set out in Annex 1.

3. Duration

3.1 The processing lasts for the duration of the service terms of use. Upon their termination, Section 9 applies.

4. Controller's instructions

4.1 The Operator processes personal data only on the Customer's documented instructions. Documented instructions means this Agreement, the service configuration made by the Customer in the administration, and the use of the service's features by the Customer or its users (including the API).

4.2 Where processing beyond those instructions is required by European Union or Member State law to which the Operator is subject, the Operator shall inform the Customer of that legal requirement before processing, unless that law prohibits it on important grounds of public interest.

4.3 If the Operator considers an instruction to infringe the GDPR or other data protection provisions, it shall inform the Customer without undue delay.

5. Confidentiality

5.1 Access to personal data is limited to persons who strictly need it to perform this Agreement. Those persons are bound to confidentiality by contract or are under an appropriate statutory obligation of confidentiality; the obligation survives the end of their relationship with the Operator.

6. Security of processing

6.1 The Operator has adopted and maintains technical and organizational measures appropriate to the risk within the meaning of Article 32 GDPR. Their current description is set out in Annex 2.

6.2 The Operator continuously evaluates and develops the measures. No change of measures may reduce the overall level of security agreed in this Agreement.

7. Sub-processors

7.1 The Customer grants the Operator a general authorization to engage further processors (sub-processors) for partial processing activities — in particular hosting of the website, application and database, file storage, email delivery, payment processing, bot protection for forms, error monitoring and availability monitoring.

7.2 The Operator maintains and publishes the current list of sub-processors, including the country of processing and the transfer tool for third-country transfers, on the Subprocessor list page (path /en/legal/subprocessors on the service website, also linked from the footer). For each sub-processor the list shows its status: active or removed. Removed sub-processors stay on the list. The date of the last change is shown below the list.

7.3 The Operator shall give notice of any intended addition or replacement of a sub-processor by publishing it on that list at least 14 days before the engagement. The Customer may object to the change on data protection grounds; if no agreement is reached, the Customer may terminate the service terms of use as of the day the new sub-processor is engaged. Continued use of the service after the notice period is deemed approval of the change.

7.4 The Operator imposes on every sub-processor, by contract, data protection obligations at least equivalent to those of this Agreement, and remains fully liable to the Customer for the sub-processor's performance as if it performed itself.

8. Assistance

8.1 Data subject rights. The Operator assists the Customer in fulfilling its obligation to respond to data subjects' requests (Articles 12–22 GDPR), primarily through the service's features: data export in a machine-readable format, rectification in the administration, and erasure or anonymization on request. If the Operator receives a data subject request concerning processing for which the Customer is the controller, it shall forward it to the Customer without undue delay and shall not respond on the merits itself.

8.2 Personal data breach. If the Operator becomes aware of a breach of security of personal data processed for the Customer, it shall notify the Customer without undue delay, together with the information available to it that the Customer needs to comply with Articles 33 and 34 GDPR (nature of the breach, categories and approximate scale affected, likely consequences, measures taken). The information may be provided in phases.

8.3 Impact assessment and consultation. Upon request, the Operator shall assist the Customer with data protection impact assessments (Article 35 GDPR) and with prior consultation of the supervisory authority (Article 36 GDPR), taking into account the nature of the processing and the information available to it.

9. End of processing

9.1 After the service terms of use end, the Customer's organization data stays stored for another 30 days. During that period, the Operator shall allow the Customer to download it through a machine-readable export.

9.2 After that period, or earlier at the Customer's express request, the Operator shall delete the personal data from the production database and from file storage.

9.3 Copies in database backups are not edited after the fact; they expire with the backup. Daily backups are kept for 30 days, and the first backup of each calendar month for 90 days. The data is therefore gone from backups no later than 90 days after deletion. Backups are encrypted and used only to restore the service after a failure. If the Operator restores the database from a backup, it repeats the deletions made after the backup date before the service goes back online.

9.4 The periods in this Section are the same for all plans.

9.5 Section 9.2 does not apply to data whose storage is required by European Union or Member State law (in particular accounting and tax documents); the Operator shall retain those only for the statutory period and to the necessary extent, anonymizing data beyond that extent.

10. Demonstrating compliance and audits

10.1 The Operator shall make available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR, in particular the description of technical and organizational measures, the sub-processor list, and the records of export operations on the Customer's organization data.

10.2 The Operator keeps records of sign-ins, administrative actions and exports in an audit log for every customer, whatever the plan, and retains them for 24 months. A Customer whose plan includes the Audit log feature according to the price list views and exports these records in the administration; how far back depends on the plan. For other customers, the Operator provides an extract of the records concerning their organization on request.

10.3 The Customer may audit compliance with this Agreement at most once every 12 months (except in the case of a documented security breach, where this limit does not apply), upon written notice of at least 30 days, during normal business hours and in a manner that does not disrupt the operation of the service or the security of other customers' data. The auditor must not be a competitor of the Operator and is bound by confidentiality. The Customer bears the costs of the audit.

10.4 The Operator may satisfy an audit primarily by providing reports of independent reviews or certifications covering the subject of the audit, where available.

11. Transfers to third countries

11.1 The service's production database and uploaded files are stored within the European Economic Area (Frankfurt, Germany). Some sub-processors (in particular email delivery, monitoring and website hosting) also process data outside the EEA, mainly in the United States. Where a sub-processor processes data outside the EEA, it does so solely on the basis of an adequacy decision under Article 45 GDPR or appropriate safeguards under Article 46 GDPR (in particular Standard Contractual Clauses), as stated for each of them on the list referred to in Section 7.2.

12. Liability

12.1 The parties' liability is governed by Article 82 GDPR and the liability provisions of the service terms of use, including the limitation of damages agreed there.

12.2 That limitation does not apply in two cases:

• when the damage is owed to a person whose data was processed (a data subject); their claim cannot be limited,
• when one party breaches this Agreement and a supervisory authority fines the other party because of it; the party in breach then reimburses the other party for the full fine.

13. Final provisions

13.1 This Agreement is governed by the laws of the Czech Republic and by the GDPR.

13.2 The Operator may amend this Agreement by issuing a new version. It shall notify the Customer of the new version through the service or by email at least 14 days before it takes effect; if the Customer does not agree, it may terminate the service terms of use as of the effective date of the new version. The Customer confirms the new version in the service administration; until it does, the organization data export is unavailable. The version and the fingerprint of the accepted wording are recorded.

13.3 If any provision of this Agreement is or becomes invalid, the validity of the remaining provisions is not affected. In case of conflict between this Agreement and the service terms of use, this Agreement prevails in data protection matters.

Annex 1 — Description of processing

Categories of data subjects

• customers and enquirers of the shop operated by the Customer, including guests with an in-progress cart,
• contact persons of the Customer's business buyers,
• subscribers to the Customer's newsletter,
• senders of messages via the contact forms of the Customer's shop,
• users invited into the service by the Customer (to the extent the Customer is their controller).

Categories of personal data

• identification and contact data (name, email, phone),
• delivery and billing addresses,
• data on orders, enquiries and quotations, including their history and related communication,
• tax documents and the data they contain,
• files uploaded to the configurator (drawings and manufacturing inputs) and any data they may contain,
• records of consents given,
• technical data necessary to provide the service (truncated IP address, session identifier).

Special categories of data (Article 9 GDPR) are not required by the service, and the Customer undertakes not to enter them into the service or allow them to be entered.

Annex 2 — Technical and organizational measures

• encryption of data in transit (TLS, enforced HTTPS),
• passwords stored exclusively as a strong cryptographic hash, never in readable form,
• role-based access control; privileged roles with mandatory two-factor authentication,
• application-level separation of individual customers' data, with tenant isolation verified by automated tests,
• an audit log of sign-in events, administrative actions and export operations, kept for every customer and retained for 24 months (customer access under Section 10.2),
• redaction of tokens and personal data in operational logs and error reports,
• daily automated encrypted database backups stored outside the hosting provider (daily backups kept for 30 days, monthly for 90 days); a documented database recovery procedure with a recovery time objective of 4 hours and a maximum data loss of 24 hours,
• continuous automated security checks of dependencies and code within the development process,
• documented key and secret rotation procedures,
• automated retention jobs deleting data after the defined periods expire.

Annex 3 — Sub-processors

The current list of sub-processors under Section 7 of this Agreement is maintained on the Subprocessor list page (path /en/legal/subprocessors on the service website) and forms an integral part of this Agreement.