Data Processing Agreement (Outline)
This page summarizes the Data Processing Agreement under Article 28 GDPR that governs how Atiempo.Me SL processes personal data on behalf of a Tenant using the MAVORS platform. A signed order form or a dedicated DPA document prevails over this summary.
1. Roles
The Tenant is the data controller for the personal data of its own clients, contacts and staff that it stores in the platform. Atiempo.Me SL (“Processor”, “MAVORS”) processes that data solely on behalf of, and under the documented instructions of, the Tenant.
2. Subject matter, duration, nature and purpose
Processing covers the personal data the Tenant enters into or generates through the platform (client and site contacts, job and quote records, invoices, staff accounts) for the duration of the subscription, for the purpose of providing the Service.
3. Categories of data subjects and data
Data subjects may include the Tenant's clients, site contacts, employees and subcontractors. Data categories may include names, contact details, addresses, service and equipment history, and invoicing information.
4. Processing on instructions
MAVORS processes personal data only on the Tenant's documented instructions, including with regard to transfers, unless required to do otherwise by EU or Member State law.
5. Confidentiality
MAVORS ensures that persons authorized to process personal data are bound by confidentiality obligations.
6. Security measures
MAVORS implements technical and organizational measures appropriate to the risk, including access control, encryption in transit, logging and regular backups.
7. Sub-processors
MAVORS may engage sub-processors to provide the Service, including for infrastructure hosting. MAVORS will inform Tenants of any intended changes to sub-processors and give them the opportunity to object.
8. Assistance to the Tenant
MAVORS will assist the Tenant, taking into account the nature of the processing, in responding to data subject rights requests and in complying with obligations related to security, data protection impact assessments and prior consultation with supervisory authorities.
9. Personal data breach
MAVORS will notify the Tenant without undue delay after becoming aware of a personal data breach affecting the Tenant's data, and will provide reasonably requested information to help the Tenant meet its own notification obligations.
10. Deletion or return of data
On termination of the subscription, MAVORS will, at the Tenant's choice, delete or return all personal data processed on its behalf, and delete existing copies, unless EU or Member State law requires storage.
11. Audits and inspections
MAVORS will make available to the Tenant the information necessary to demonstrate compliance with this outline and will allow for, and contribute to, audits conducted by the Tenant or an auditor mandated by the Tenant, subject to reasonable notice and confidentiality.
12. International transfers
No transfers of personal data outside the European Economic Area currently take place. Should this change, it will be subject to an appropriate transfer mechanism under GDPR.