Data Processing Agreement (DPA)

This Data Processing Agreement forms part of the agreement between COCOA 87 j.d.o.o. and the Customer.

1. Parties

Data Processor: COCOA 87 j.d.o.o., Glavani 17, 52207 Barban, Croatia, OIB: 20259303692

Data Controller: The Customer subscribing to NFC Employee Tracker.

2. Subject Matter

The Processor provides software and cloud services allowing Customers to manage workforce-related information.

3. Nature of Processing

Processing activities may include:

• Collection
• Recording
• Organization
• Storage
• Retrieval
• Consultation
• Transmission
• Deletion

Processing occurs solely as necessary to provide the Service.

4. Types of Personal Data

Depending on Customer use:

• Names
• Email addresses
• Telephone numbers
• Employee records
• NFC identifiers
• Attendance records
• GPS check-in locations
• Employee photographs
• HR documents
• System logs

5. Categories of Data Subjects

• Employees
• Contractors
• Temporary workers
• Managers
• Administrators

6. Controller Responsibilities

The Controller is solely responsible for:

• Determining lawful basis
• Providing employee notices
• Obtaining consent where required
• Labor law compliance
• GDPR compliance
• Accuracy of data

7. Processor Obligations

The Processor shall:

• Process data only on documented instructions
• Maintain confidentiality
• Implement security measures
• Assist where reasonably possible
• Notify Customers of relevant security incidents

8. Access to Data

The Processor does not routinely access Customer data. Access may occur only where necessary for:

• Technical support
• Security investigations
• Maintenance
• Customer-requested troubleshooting

9. Subprocessors

The Controller authorizes the use of subprocessors necessary to provide the Service. Current subprocessors may include:

• IONOS
• Stripe
• Let's Encrypt

The Processor may update subprocessors when reasonably required. See the full Subprocessor List.

10. Security Measures

Measures may include:

• Encryption in transit
• Authentication controls
• Access restrictions
• Logging
• Backup systems

11. Data Breaches

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer data.

12. Data Return and Deletion

Upon account termination, data may remain available during the grace period and may thereafter be permanently deleted.

13. Liability

Liability shall be governed by the Terms of Service.

14. Governing Law

Republic of Croatia.

15. Jurisdiction

Commercial Court of Rijeka, Croatia.