Data Processing Agreement

Data Processor

INUX Cloud s.r.o.
Company ID: 50103016
VAT: SK2120189005
Galvaniho 12B
Bratislava 82104
Slovakia
European Union
Contact: [email protected]

Data Controller

The customer or organization that has subscribed to FastStats services and who determines the purposes and means of processing personal data (if any) through the use of FastStats analytics.

For the purposes of this DPA, the following terms have the meanings set out below:

"Controller" means the entity that determines the purposes and means of the processing of Personal Data.

"Processor" means the entity that processes Personal Data on behalf of the Controller.

"Personal Data" means any information relating to an identified or identifiable natural person as defined in the GDPR.

"Processing" means any operation performed on Personal Data, such as collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, use, disclosure, or erasure.

"Data Subject" means an identified or identifiable natural person.

"Sub-processor" means any processor engaged by the Processor to process Personal Data.

"Services" means the FastStats web analytics platform and related services.

3.1 Processing Instructions

The Processor shall process data only on documented instructions from the Controller, unless required to do so by EU or Member State law. The Processor shall immediately inform the Controller if it believes an instruction infringes the GDPR or other data protection laws.

3.2 Confidentiality

The Processor shall ensure that persons authorized to process data are subject to confidentiality obligations.

3.3 Security Measures (Article 32 GDPR)

The Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption: All data in transit (TLS/SSL) and at rest (AES-256)
• Access Controls: Role-based access, multi-factor authentication
• Data Anonymization: Immediate anonymization at collection point
• Infrastructure Security: Secure EU-based data centers with ISO 27001 compliance
• Regular Testing: Security assessments, penetration testing, vulnerability scanning
• Incident Response: 24/7 monitoring and incident response procedures
• Data Backup: Regular automated backups with encryption
• Physical Security: Secure facilities with restricted access

3.4 Sub-processors

The Controller provides general authorization for the Processor to engage sub-processors. Current sub-processors:

The Processor shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors at least 30 days in advance, giving the Controller the opportunity to object.

3.5 Data Subject Rights

Given that FastStats does not collect personal data, requests from data subjects regarding access, rectification, erasure, restriction, or portability are typically not applicable. However, the Processor shall:

• Assist the Controller in responding to data subject requests within 7 business days
• Provide technical information about data processing practices
• Implement opt-out mechanisms if requested by the Controller

3.6 Assistance to Controller

The Processor shall assist the Controller with:

• Data protection impact assessments (Article 35 GDPR)
• Prior consultations with supervisory authorities (Article 36 GDPR)
• Compliance with security obligations (Article 32 GDPR)
• Notification of personal data breaches (Article 33-34 GDPR)

3.7 Data Breach Notification

In the unlikely event of a personal data breach, the Processor shall:

• Notify the Controller without undue delay and within 24 hours of becoming aware
• Provide detailed information about the nature of the breach
• Describe measures taken or proposed to address the breach
• Provide contact details for further information
• Assist the Controller in fulfilling notification obligations to authorities and data subjects

4.1 Data Location

All data processing and storage occurs exclusively within the European Union. Data centers are located in EU member states with high data protection standards.

4.2 No International Transfers

The Processor does not transfer data outside the European Economic Area (EEA). This eliminates the need for:

• Adequacy decisions
• Standard Contractual Clauses (SCCs)
• Binding Corporate Rules (BCRs)
• Derogations for specific situations

4.3 Commitment

The Processor commits to maintaining EU-only data residency and shall notify the Controller immediately if circumstances change that would require international data transfers.

5.1 Retention Period

Analytics data is retained for a maximum of 24 months from the date of collection, unless the Controller specifies a shorter retention period.

5.2 Automated Deletion

Data older than the retention period is automatically and permanently deleted from all systems, including backups.

5.3 Termination

Upon termination of services, the Processor shall, at the Controller's choice:

• Delete: Permanently delete all data within 30 days
• Return: Return data to the Controller in a structured, commonly used format

5.4 Certification

Upon request, the Processor shall provide written certification that all data has been deleted or returned.

6.1 Controller's Right to Audit

The Controller has the right to conduct audits and inspections to verify the Processor's compliance with this DPA, subject to:

• Reasonable advance notice (minimum 30 days)
• Execution of a confidentiality agreement
• Limitation to one audit per year unless there is suspicion of non-compliance
• Reasonable business hours

6.2 Third-Party Audits

The Processor maintains independent third-party security certifications and audit reports (ISO 27001, SOC 2 Type II) which may be provided to the Controller upon request.

6.3 Costs

The Controller shall bear all costs associated with audits, unless the audit reveals material non-compliance by the Processor.

7.1 Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service.

7.2 Indemnification

The Processor shall indemnify the Controller against claims arising from the Processor's breach of this DPA or applicable data protection laws, subject to:

• Prompt written notice of the claim
• Reasonable cooperation from the Controller
• Full control over the defense and settlement

8.1 Duration

This DPA remains in effect for the duration of the service agreement and any period necessary to fulfill data deletion or return obligations.

8.2 Survival

Sections relating to confidentiality, data deletion, liability, and dispute resolution shall survive termination.

9.1 Governing Law

This DPA is governed by the laws of Slovakia and the European Union, including the GDPR.

9.2 Jurisdiction

Any disputes shall be subject to the exclusive jurisdiction of the courts of Bratislava, Slovakia.

9.3 Supervisory Authority

The competent supervisory authority for the Processor is the Office for Personal Data Protection of the Slovak Republic.

This DPA may only be amended by written agreement between both parties. The Processor may update this DPA to reflect changes in data protection laws, provided that such changes do not:

• Reduce the Controller's rights
• Increase the Controller's obligations
• Weaken data protection standards

Controllers will be notified of material changes at least 30 days in advance.

Document Version: 1.0
Last Updated: January 17, 2026
Effective Date: January 17, 2026