Data Processing Agreement

1. Parties

Data Processor: Malkovich MB (hereinafter – “Processor”), operating the Awarda platform at www.awarda.eu.

Data Controller: The legal or natural person using the Awarda platform (hereinafter – “Controller” or “Client”), whose data is processed in providing the Service.

This agreement is concluded pursuant to Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).

2. Subject and Purpose of Processing

The Processor processes personal data provided by the Controller only to the extent necessary for the following purposes:

• Providing the Service (Awarda) pursuant to the Terms of Service;
• User account management, authentication, and security;
• Subscription and payment administration;
• Technical support and error resolution;
• Sending email notifications (agreed alerts, billing).

3. Categories of Personal Data and Data Subjects

We do not process special categories of personal data (Article 9 GDPR), such as health, biometric, or political opinion data.

4. Duration of Processing

Personal data is processed for as long as the User's account and the Service agreement are in force. Upon termination of the agreement, data is retained for no more than 3 years, unless applicable law requires a longer retention period (e.g. accounting documents — 10 years under the Law on Accounting of the Republic of Lithuania). Thereafter, data is securely deleted or anonymised.

5. Processor Obligations

The Processor undertakes to:

• process personal data only on the basis of the Controller's documented instructions and this agreement, except where required by EU or Member State law;
• ensure that persons processing personal data have committed to confidentiality or are subject to a statutory confidentiality obligation;
• implement all required technical and organisational security measures pursuant to Article 32 GDPR;
• assist the Controller, taking into account the nature of the processing, in fulfilling the obligation to respond to data subjects' requests for the exercise of their rights;
• notify the Controller of personal data breaches no later than 72 hours after becoming aware of the breach;
• upon termination of the agreement, at the Controller's choice, delete or return all personal data and delete existing copies, unless applicable law provides otherwise;
• provide the Controller with all information necessary to demonstrate compliance with the obligations set out in Article 28 GDPR.

6. Security Measures

The Processor applies the following technical and organisational protective measures (Article 32 GDPR):

• Data transmission is encrypted using TLS 1.2 / 1.3 protocol;
• The database is secured with at-rest encryption;
• Access to systems is controlled based on multi-factor authentication;
• Regular database backups are created;
• Access rights are granted only to employees for whom they are necessary (need-to-know basis);
• Third-party service providers are selected only if they comply with GDPR requirements.

7. Sub-processors

The Controller grants general authorisation to use sub-processors. The following approved sub-processors are currently in use:

We will notify the Controller of any planned sub-processor changes no later than 14 days in advance, providing an opportunity to object.

8. Data Transfers to Third Countries

Data may be transferred to the USA or other non-EU countries in connection with sub-processor services. Such transfers are carried out only under one of the following mechanisms:

• EU-US Data Privacy Framework;
• Standard Contractual Clauses approved by the European Commission;
• An adequacy decision adopted by the European Commission for a specific country.

9. Data Subject Rights

The Processor assists the Controller in implementing the following GDPR data subject rights: the right to access data, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, and the right to object. The Controller is responsible for receiving data subject requests and providing responses; the Processor provides technical assistance within a reasonable time.

10. Disputes and Applicable Law

This agreement is governed by the law of the Republic of Lithuania. Disputes shall be resolved in the courts of the Republic of Lithuania. This agreement does not prejudice any GDPR obligations or rights.

11. Contact

For questions regarding data processing, contact: support@awarda.eu
Malkovich MB, Lithuania