{"id":5498,"date":"2026-06-23T13:35:20","date_gmt":"2026-06-23T11:35:20","guid":{"rendered":"https:\/\/andrea360.eu\/?page_id=5498"},"modified":"2026-06-23T13:40:38","modified_gmt":"2026-06-23T11:40:38","slug":"data-processing-agreement","status":"publish","type":"page","link":"https:\/\/andrea360.eu\/en\/legal\/data-processing-agreement\/","title":{"rendered":"Data Processing Agreement"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t
\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

DATA PROCESSING AGREEMENT<\/h1>

Version 1.0<\/b><\/p>

This Data Processing Agreement (\u201eDPA\u201c) forms part of and supplements the agreement governing the use of the Andrea360 platform and related services (the \u201eServices\u201c) provided by Andrea Technologies DOO Novi Sad, Republic of Serbia (\u201eAndrea Technologies,\u201c \u201eProcessor\u201c) to the customer identified in the applicable service agreement (\u201eCustomer,\u201c \u201eController\u201c).<\/span><\/p>

This DPA sets out the terms under which Andrea Technologies processes Personal Data on behalf of the Customer in connection with the provision of the Services.<\/span><\/p>

1. DEFINITIONS<\/span><\/h2>

For the purposes of this DPA:<\/span><\/p>

Controller means the entity that determines the purposes and means of processing Personal Data.<\/span><\/p>

Processor means the entity that processes Personal Data on behalf of the Controller.<\/span><\/p>

Personal Data means any information relating to an identified or identifiable natural person.<\/span><\/p>

Customer Data means any data, including Personal Data, submitted, uploaded, stored, transmitted, or otherwise processed through the Services by or on behalf of the Customer.<\/span><\/p>

Data Subject means an identified or identifiable natural person whose Personal Data is processed.<\/span><\/p>

Applicable Data Protection Laws means all applicable laws and regulations relating to privacy, data protection, and the processing of Personal Data, including the General Data Protection Regulation (EU) 2016\/679 (\u201eGDPR\u201c), where applicable.<\/span><\/p>

Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.<\/span><\/p>

2. SCOPE AND PURPOSE OF PROCESSING<\/span><\/h2>

Andrea Technologies shall process Personal Data solely for the purpose of providing, maintaining, securing, supporting, and improving the Services in accordance with the Customer\u2019s documented instructions and the terms of the applicable agreement.<\/span><\/p>

Andrea Technologies shall not sell, disclose, or transfer Customer Data containing Personal Data to third parties except as required to provide the Services or comply with applicable law.<\/span><\/p>

Aggregated, anonymized, de-identified, and non-identifiable information derived from Customer Data may be used by Andrea Technologies for analytics, benchmarking, reporting, research, artificial intelligence, machine learning, service improvement, product development, and other lawful business purposes, provided such information cannot reasonably identify any individual or Customer.<\/span><\/p>

3. ROLES OF THE PARTIES<\/span><\/h2>

The parties acknowledge and agree that:<\/span><\/p>

\u2013 The Customer acts as the Controller.<\/span><\/p>

\u2013 Andrea Technologies acts as the Processor.<\/span><\/p>

The Customer determines the purposes and means of processing Personal Data through the Services.<\/span><\/p>

Andrea Technologies processes Personal Data solely on behalf of the Customer and in accordance with this DPA.<\/span><\/p>

4. CATEGORIES OF DATA SUBJECTS<\/span><\/h2>

Depending on how the Customer uses the Services, Data Subjects may include:<\/span><\/p>

\u2013 Members and customers of the Customer;<\/span><\/p>

Prospective customers and leads;<\/span><\/p>

Employees, instructors, trainers, contractors, and representatives of the Customer;<\/span><\/p>

Individuals whose Personal Data is uploaded or entered into the Services by the Customer.<\/span><\/p>

5. CATEGORIES OF PERSONAL DATA<\/span><\/h2>

Depending on the Customer's use of the Services, Personal Data may include:<\/span><\/p>

First name;<\/span><\/p>

\u2013 Last name;<\/span><\/p>

Email address;<\/span><\/p>

\u2013 Phone number;<\/span><\/p>

\u2013 Date of birth;<\/span><\/p>

Gender;<\/span><\/p>

\u2013 Address;<\/span><\/p>

Profile pictures;<\/span><\/p>

\u2013 Membership and subscription information;<\/span><\/p>

\u2013 Booking and attendance records;<\/span><\/p>

\u2013 Purchase and transaction records;<\/span><\/p>

\u2013 RFID card identifiers;<\/span><\/p>

\u2013 Employee information;<\/span><\/p>

\u2013 Documents and attachments uploaded by the Customer;<\/span><\/p>

\u2013 Any other Personal Data submitted through the Services by the Customer.<\/span><\/p>

6. CUSTOMER RESPONSIBILITIES<\/span><\/h2>

The Customer is solely responsible for:<\/span><\/p>

\u2013 Determining the lawful basis for processing Personal Data;<\/span><\/p>

\u2013 Obtaining any necessary consents;<\/span><\/p>

\u2013 Providing privacy notices where required;<\/span><\/p>

\u2013 Ensuring that Personal Data entered into the Services is processed in accordance with Applicable Data Protection Laws.<\/span><\/p>

The Customer represents and warrants that it has all rights, permissions, and legal bases necessary for Andrea Technologies to process Personal Data in accordance with this DPA.<\/span><\/p>

The Customer acknowledges that documents, attachments, and files uploaded to the Services may contain sensitive or special categories of personal data. The Customer is solely responsible for determining whether such uploads are lawful and for obtaining any required consents, notices, authorizations, or legal bases for such processing.<\/span><\/p>

7. CONFIDENTIALITY<\/span><\/h2>

Andrea Technologies shall ensure that personnel authorized to process Personal Data are subject to appropriate confidentiality obligations.<\/span><\/p>

Access to customer data by Andrea Technologies personnel shall be limited to individuals who require such access for the provision, maintenance, support, security, or improvement of the Services.<\/span><\/p>

8. SECURITY MEASURES<\/span><\/h2>

Andrea Technologies maintains appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.<\/span><\/p>

Such measures may include:<\/span><\/p>

\u2013 Secure authentication mechanisms;<\/span><\/p>

Password hashing;<\/span><\/p>

Role-based access controls;<\/span><\/p>

Encryption of data in transit using TLS;<\/span><\/p>

\u2013 Monitoring and logging systems;<\/span><\/p>

\u2013 Regular backup procedures;<\/span><\/p>

\u2013 Security updates and maintenance practices.<\/span><\/p>

Andrea Technologies may modify or enhance its security measures from time to time, provided that such modifications do not materially reduce the overall level of protection.<\/span><\/p>

9. SUBCONTRACTORS<\/span><\/h2>

The Customer authorizes Andrea Technologies to engage subprocessors as reasonably necessary for the provision of the Services.<\/span><\/p>

Current subprocessors may include:<\/span><\/p>

Subprocessor and purpose:<\/span><\/p>

  1. Hetzner \u2013 Hosting infrastructure and storage<\/span><\/li>
  2. Firebase \u2013 Mobile services and notifications<\/span><\/li>
  3. OneSignal \u2013 Push Notifications<\/span><\/li>
  4. Postmark \u2013 Delivery of transactional emails<\/span><\/li>
  5. Stripe \u2013 Payment processing (when enabled by Customer)<\/span><\/li>
  6. Payspot \u2013 Payment processing (when enabled by Customer)<\/span><\/li>
  7. Google Analytics \u2013 Usage Analytics<\/span><\/li><\/ol>

    Andrea Technologies may engage additional subprocessors from time to time as reasonably required for operation and improvement of the Services.<\/span><\/p>

    Andrea Technologies shall use reasonable efforts to ensure that subprocessors engaged in connection with the Services provide an appropriate level of protection for Personal Data.<\/span><\/p>

    10. PERSONAL DATA BREACHES<\/span><\/h2>

    Andrea Technologies shall notify the Customer without undue delay and, where feasible, within seventy-two (72) hours after becoming aware of a Personal Data Breach affecting Customer Data.<\/span><\/p>

    Such notification shall include information reasonably available to Andrea Technologies regarding:<\/span><\/p>

    The nature of the incident;<\/span><\/p>

    \u2013 The categories of data affected;<\/span><\/p>

    \u2013 The likely consequences of the incident;<\/span><\/p>

    \u2013 Measures taken or proposed to address the incident.<\/span><\/p>

    11. INTERNATIONAL DATA TRANSFERS<\/span><\/h2>

    Andrea Technologies shall not intentionally transfer Personal Data outside of jurisdictions permitted under Applicable Data Protection Laws unless appropriate safeguards are implemented.<\/span><\/p>

    12. DATA EXPORT<\/span><\/h2>

    Upon request and prior to termination of the Services, the Customer may obtain a copy of Customer Data in a commonly used electronic format.<\/span><\/p>

    Andrea Technologies will make commercially reasonable efforts to provide such export.<\/span><\/p>

    Exported data may include, where applicable:<\/span><\/p>

    Members;<\/span><\/p>

    \u2013 Employees;<\/span><\/p>

    Memberships;<\/span><\/p>

    \u2013 Attendance records;<\/span><\/p>

    Sales records;<\/span><\/p>

    \u2013 Other Customer Data maintained through the Services.<\/span><\/p>

    13. DATA RETENTION AND DELETION<\/span><\/h2>

    Following termination of the applicable agreement, Andrea Technologies may retain Customer Data for a transitional period not exceeding one hundred eighty (180) days.<\/span><\/p>

    After such period, Customer Data shall be deleted or permanently anonymized unless retention is required by applicable law.<\/span><\/p>

    The customer is responsible for requesting any required data exports before the expiration of the retention period.<\/span><\/p>

    The Customer is responsible for requesting any desired export of Customer Data before the expiration of the retention period.<\/span><\/p>

    14. AUDIT RIGHTS<\/span><\/h2>

    Upon reasonable written request, the Customer may request information regarding Andrea Technologies\u2019 security and privacy practices relevant to the Services.<\/span><\/p>

    Any audit, assessment, or review requested by the Customer shall:<\/span><\/p>

    Be reasonable in scope;<\/span><\/p>

    \u2013 Not to unreasonably interfere with Andrea Technologies\u2019 operations;<\/span><\/p>

    \u2013 Be subject to confidentiality obligations;<\/span><\/p>

    \u2013 Be conducted no more than once per calendar year unless required by law.<\/span><\/p>

    15. LIABILITY<\/span><\/h2>

    The parties' liability arising under this DPA shall be subject to the limitations of liability set forth in the applicable service agreement, unless prohibited by applicable law.<\/span><\/p>

    16. TERM<\/span><\/h2>

    This DPA shall remain in effect for as long as Andrea Technologies processes Personal Data on behalf of the Customer.<\/span><\/p>

    17. USE OF ANONYMIZED INFORMATION<\/span><\/h2>

    Nothing in this DPA shall restrict Andrea Technologies from creating, generating, analyzing, using, publishing, licensing, or otherwise commercializing aggregated, anonymized, de-identified, or non-identifiable information derived from Customer Data, provided that such information cannot reasonably identify any individual, Customer, or business operation.<\/span><\/p>

    18. GOVERNING LAW<\/span><\/h2>

    This DPA shall be governed by and construed in accordance with the laws of the Republic of Serbia.<\/span><\/p>

    19. CONTACT INFORMATION<\/span><\/h2>

    Questions regarding this DPA or privacy matters may be directed to:<\/span><\/p>

    Andrea Technologies DOO Novi Sad\u00a0\u00a0<\/span><\/p>

    Email: support@andrea360.com<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

    DATA PROCESSING AGREEMENT Version 1.0 This Data Processing Agreement („DPA“) forms part of and supplements the agreement governing the use of the Andrea360 platform and related services (the „Services“) provided by Andrea Technologies DOO Novi Sad, Republic of Serbia („Andrea Technologies“, „Processor“) to the customer identified in the applicable service agreement („Customer“, „Controller“). This DPA […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":5434,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-5498","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/andrea360.eu\/en\/wp-json\/wp\/v2\/pages\/5498","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/andrea360.eu\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/andrea360.eu\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/andrea360.eu\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/andrea360.eu\/en\/wp-json\/wp\/v2\/comments?post=5498"}],"version-history":[{"count":16,"href":"https:\/\/andrea360.eu\/en\/wp-json\/wp\/v2\/pages\/5498\/revisions"}],"predecessor-version":[{"id":5514,"href":"https:\/\/andrea360.eu\/en\/wp-json\/wp\/v2\/pages\/5498\/revisions\/5514"}],"up":[{"embeddable":true,"href":"https:\/\/andrea360.eu\/en\/wp-json\/wp\/v2\/pages\/5434"}],"wp:attachment":[{"href":"https:\/\/andrea360.eu\/en\/wp-json\/wp\/v2\/media?parent=5498"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}