Data Processing Agreement

Parties and applicability

This Data Processing Agreement (“DPA”) forms part of the agreement for the Markyard software service (“Service”) between (i) the organization that holds the Markyard workspace, as identified in its account (“Customer”), acting as controller or, where it processes personal data on behalf of another controller, as processor; and (ii) Dušan Milićević PR štamparija FOILIFY Valjevo, a sole proprietorship (preduzetnik) registered in the Republic of Serbia, Dokmirska 4, 14000 Valjevo, Serbia, Serbian Business Registers Agency (APR) registration number 68171008, tax identification number (PIB) 115192838, also using the shortened name Dušan Milićević PR FOILIFY and trading as Markyard (“Markyard”), acting as processor or, where Customer is a processor, as subprocessor.

This DPA takes effect when it is accepted electronically in the Service by a person authorized to act for Customer, or when it is signed by both parties, whichever happens first.

1. Definitions and precedence

“Personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in Regulation (EU) 2016/679 (“GDPR”). Where the Serbian Law on Personal Data Protection or another data protection law applies, references to the GDPR include the corresponding provisions of that law.

“Customer Personal Data” means personal data that Markyard processes on behalf of Customer in providing the Service: the inquiries and customer conversations received from Customer’s connected mailboxes and their attachments; the customer records, quotes, jobs, tasks, files and artwork that Customer and its users put into the workspace; and the record of what Customer’s users do in the workspace. “Subprocessor” means a third party that Markyard engages to process Customer Personal Data. “SCCs” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.

Personal data for which Markyard is itself the controller, such as account, billing and agreement acceptance records, is governed by the Markyard Privacy Policy, not by this DPA.

This DPA prevails over the Terms of Service as regards the processing of Customer Personal Data. Where the SCCs apply under section 9, they prevail over this DPA and the Terms of Service.

2. Roles, instructions and purpose

Customer determines the purposes and means of processing Customer Personal Data. Markyard processes Customer Personal Data as Customer’s processor, only to provide the Service as described in Annex A.

Markyard processes Customer Personal Data only on Customer’s documented instructions. Those instructions are this DPA and the Terms of Service; Customer’s configuration and use of the Service, including the mailboxes its users connect and the features they turn on; and any further written instruction from Customer that is consistent with them. This applies also to transfers of Customer Personal Data to a third country. If a law of the European Union, of a Member State or of Serbia to which Markyard is subject requires other processing, Markyard informs Customer of that requirement before the processing, unless that law prohibits it.

Markyard informs Customer without delay if, in its opinion, an instruction infringes applicable data protection law.

Markyard does not sell Customer Personal Data, does not use it for advertising, and does not use it to train or improve artificial intelligence models, whether its own or a third party’s.

3. Confidentiality and access

Markyard ensures that every person it authorizes to process Customer Personal Data is bound by an obligation of confidentiality, by contract or by law.

People at Markyard access Customer Personal Data only where necessary: at Customer’s request, for example to investigate a specific inquiry, in which case Markyard keeps a record of the request; to investigate a security incident, a fault or abuse of the Service; or where the law requires it.

Each Customer’s workspace is kept separate from every other customer’s, and Markyard does not give one customer access to another customer’s data.

Customer is responsible for the users it admits to its workspace, the roles it gives them, the confidentiality of their credentials, whether it requires two-step verification, and the mailboxes it connects.

4. Security of processing

Markyard implements and maintains the technical and organizational measures described in Annex B to ensure a level of security appropriate to the risk, as required by Article 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing.

Markyard reviews these measures regularly and may update them, provided an update does not lower the overall level of protection. Annex B describes the measures in place. Markyard does not hold a security certification and has not commissioned an independent penetration test; if that changes, Annex B will say so.

5. Subprocessors

(a) Customer gives Markyard general written authorization to engage subprocessors. The subprocessors in use are listed in Annex C.

(b) Markyard engages a subprocessor only under a written contract that imposes data protection obligations offering at least the same level of protection as this DPA, including sufficient guarantees of appropriate technical and organizational measures. Markyard remains fully responsible to Customer for the performance of each subprocessor’s obligations.

(c) Markyard notifies Customer at least 14 days before adding or replacing a subprocessor, by email to the owners of Customer’s workspace, and updates Annex C.

(d) Within that period Customer may object in writing on reasonable grounds relating to data protection. The parties will discuss the objection in good faith. If it cannot be resolved, Customer may terminate the Service with effect from the date of the change, without any termination fee.

6. Assistance and data subject requests

Taking into account the nature of the processing, Markyard assists Customer by appropriate technical and organizational measures, insofar as possible, in responding to requests from data subjects exercising their rights under Chapter III GDPR. Customer can find, correct and delete inquiries, customer records and files itself in the Service; for anything else, Markyard acts on Customer’s written request.

If Markyard receives a request from a data subject about Customer Personal Data, it does not answer it on the merits, refers the data subject to Customer where it can identify Customer, and informs Customer without undue delay.

Taking into account the information available to it, Markyard also assists Customer in ensuring compliance with Articles 32 to 36 GDPR: security of processing, notification of personal data breaches, data protection impact assessments and prior consultation of the supervisory authority.

7. Personal data breaches

(a) Markyard notifies Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice is sent by email to the owners of Customer’s workspace.

(b) The notice describes, as far as is then known: the nature of the breach, including the categories and approximate number of data subjects and of personal data records concerned; its likely consequences; the measures taken or proposed to address it and to mitigate its possible adverse effects; and the contact point for further information. Where not all of this can be given at once, Markyard gives it in phases without further undue delay.

(c) Markyard takes the steps reasonably necessary to contain and investigate the breach, to mitigate its effects and to prevent it from recurring, cooperates with Customer in its assessment, and keeps a record of the breach, its effects and the remedial action taken.

(d) As controller, Customer decides whether the breach must be notified to a supervisory authority or communicated to data subjects, and does so. Markyard does not notify them on Customer’s behalf unless Customer instructs it to or the law requires it.

(e) A notice under this section is not an acknowledgement of fault or liability.

8. Return and deletion

(a) While the Service is in use, Customer can delete Customer Personal Data with the controls in the Service. Customer may also ask Markyard at any time for an export of its workspace data in a common machine-readable format.

(b) When the Service ends, or when an owner of Customer’s workspace asks Markyard to delete the workspace, Markyard returns Customer Personal Data by such an export, deletes it, or both, as Customer chooses. Markyard completes the deletion within 30 days of a verified request. The deletion covers the workspace’s records and stored files, and the tokens of its connected mailboxes, for which Markyard also asks Google to revoke access.

(c) Markyard keeps Customer Personal Data after that only where a law of the European Union, of a Member State or of Serbia requires it to, only for as long as that law requires, and only for that purpose.

(d) Copies that remain in the backups and operational logs of Markyard’s providers are not restored into the Service and are removed in the ordinary course of those providers’ retention cycles.

9. International transfers

(a) Markyard is established in Serbia, which is not the subject of an adequacy decision of the European Commission. Customer Personal Data is stored with Supabase in the European Union (Ireland), and the Service’s application servers run with Vercel in Frankfurt, Germany. Markyard accesses Customer Personal Data from Serbia, and some subprocessors process it outside the European Economic Area, as stated in Annex C.

(b) Where Customer is established in the European Economic Area, or its processing of Customer Personal Data is otherwise subject to the GDPR, the SCCs are incorporated into this DPA by reference and apply between Customer as data exporter and Markyard as data importer: Module Two (controller to processor) where Customer is a controller, and Module Three (processor to processor) where Customer is a processor.

(c) For the SCCs: clause 7 (docking clause) applies; in clause 9, option 2 (general written authorization) applies, with the notice period in section 5; the optional wording in clause 11(a) does not apply; under clause 13, the competent supervisory authority is the one determined by clause 13(a) for Customer; under clause 17, the SCCs are governed by the law of the Member State in which Customer is established or, if that law does not allow for third-party beneficiary rights or Customer is not established in a Member State, by the law of Ireland; and under clause 18, disputes are resolved by the courts of that same Member State.

(d) Annex I.A of the SCCs is completed by the parties section of this DPA and the details of Customer held in its account; Annex I.B by Annex A; Annex I.C by paragraph (c); Annex II by Annex B; and Annex III by Annex C.

(e) For Customer’s assessment under clause 14 of the SCCs, Markyard provides, on request, the information reasonably available to it on the laws and practices of Serbia that apply to the transferred data, including on access by public authorities, and informs Customer of any legally binding request for disclosure of Customer Personal Data it receives, where the law allows.

(f) Markyard transfers Customer Personal Data onward to a subprocessor outside the European Economic Area only where the transfer is covered by an adequacy decision or by appropriate safeguards under Chapter V GDPR.

(g) Where the SCCs apply, nothing in this DPA or the Terms of Service limits or contradicts them.

(h) Personal data whose transfer is subject to the law of the United Kingdom or of Switzerland is not covered by this section. Customer must contact Markyard before using the Service for such data, so that the parties can agree the transfer terms that law requires.

10. Information and audits

Markyard makes available to Customer, on request, the information necessary to demonstrate compliance with Article 28 GDPR and this DPA, including the current Annexes and the information referred to in section 9(e).

Markyard allows for and contributes to audits, including inspections, conducted by Customer or by an independent auditor mandated by Customer and bound by confidentiality. Customer first relies on the information Markyard provides. Where that is not reasonably sufficient, an audit may take place on at least 30 days’ written notice, no more than once in any 12 months except after a personal data breach or at the request of a supervisory authority, without access to other customers’ data, and in a way that does not put the security of the Service at risk. Each party bears its own costs.

Nothing in this section limits the powers of a supervisory authority or Customer’s rights under the SCCs.

11. Customer’s responsibilities

Customer is responsible for having a lawful basis for the processing it instructs, and for giving data subjects the information required by Articles 13 and 14 GDPR, including that their inquiries are processed with the help of the Service and its AI features.

Customer is also responsible for having the right to connect each mailbox it connects and to upload each file it uploads; for avoiding special categories of personal data in the Service unless their processing is lawful and necessary; for reviewing extracted details, drafts and quotes before approving them; and for the messages sent from its mailboxes, including automatic replies if it chooses to turn them on. Customer’s instructions must comply with data protection law.

12. Term, liability and changes

(a) This DPA applies for as long as Markyard processes Customer Personal Data. Its obligations on return, deletion and confidentiality continue until they are fulfilled.

(b) Each party’s liability under this DPA is subject to the limitations in the Terms of Service, except where mandatory law or the SCCs do not allow them to apply. Nothing in this DPA limits either party’s liability to data subjects under Article 82 GDPR or under the SCCs.

(c) Markyard may update this DPA, including its Annexes, to reflect changes in the law, in the Service or in its subprocessors. Each version is published at markyards.com/dpa with its version number and date. Changes of subprocessors are announced as described in section 5. A version that changes Customer’s rights or obligations applies to Customer once an owner of Customer’s workspace has accepted it in the Service.

(d) Notices under this DPA are given to Markyard at the email address shown on its legal notice page, and to Customer at the email addresses of the owners of its workspace.

(e) This DPA is governed by the law that governs the Terms of Service, except where the SCCs or mandatory data protection law provide otherwise.

Annex A — Description of Processing

Annex B — Technical and Organizational Measures

Annex C — Subprocessors

Markyard uses the following subprocessors for Customer Personal Data.

Not subprocessors: Resend delivers Markyard’s own account emails (sign-up confirmation, password reset and security notices) to Customer’s users, for which Markyard is the controller. PayPal processes payments for Markyard’s plans as an independent controller. Gmail and the optional Apps Script connector are Customer’s own Google services, used under Customer’s agreement with Google.