Project Services BG

Data Processing Agreement

Roles and responsibilities of PS BG EOOD and its clients in the processing of personal data.

This Data Processing Agreement (the “Agreement”) sets out the roles and responsibilities of the parties with regard to the relevant processing of personal data and forms an integral part of all business terms agreed between the parties, including but not limited to the general terms and conditions of PS BG EOOD for the provision of hosting and colocation services, including any supplementary terms (the “Contract”). In the event of any conflict or inconsistency between this Agreement and the Contract, the provisions of this Agreement shall prevail.

1. Definitions

For the purposes of this Agreement, the following terms shall have the meanings set out below:

  • PS BG means “PS BG” EOOD, a company registered in the Commercial Register of the Registry Agency under UIC 204154997, with its registered office and address of management at 34 Dimitar Ikonomov Str., floor 3, apt. 5, 9010 Varna, Varna Municipality, Varna Region, Bulgaria, which may act as a controller or a processor of personal data depending on the services provided under the Contract.
  • Client means the company that is a party to the Contract, acts as a controller of personal data and may be, without limitation, a client using services from PS BG under a hosting or colocation contract.
  • Adequacy Decision means a decision of the European Commission confirming that a country outside the EU ensures an adequate level of data protection, as defined in the Data Protection Laws.
  • Adequate Country means a country outside the EEA for which the European Commission has decided that it ensures a level of protection of personal data essentially equivalent to that guaranteed within the EU/EEA.
  • Appropriate Safeguards means the standard of protection of personal data and of data subjects’ rights required under the Data Protection Laws when the parties transfer data to a third country by relying on the Standard Contractual Clauses and, where applicable, carry out a transfer risk or impact assessment in accordance with the applicable guidance.
  • Controller means the person which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processor means the person which processes personal data on behalf of the Controller.
  • Data Protection Complaint means a complaint or request relating to the obligations of either party under the Data Protection Laws applicable to the Agreement, including any complaint by a data subject or any notice, investigation or other action by a Supervisory Authority.
  • Data Protection Laws means all applicable laws and regulations relating to the protection of personal data and privacy, including Regulation (EU) 2016/679 (GDPR), Directive 2002/58/EC (ePrivacy), the Bulgarian Personal Data Protection Act, and all applicable guidance and recommendations of the competent supervisory authorities.
  • Data Subject Request means a request made by a data subject to exercise any of the data subject rights under the Data Protection Laws in relation to their personal data.
  • EEA means the European Economic Area.
  • Standard Contractual Clauses means the Standard Contractual Clauses of the European Commission under Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
  • Personal Data means any information relating to an identified or identifiable natural person.
  • Shared Data has the meaning given in Section 4.
  • Processed Data has the meaning given in Section 5.
  • Supervisory Authority means an independent public authority under the Data Protection Laws, including the Bulgarian Commission for Personal Data Protection.

Terms in lower case that are used but not defined in this Agreement, such as “personal data”, “personal data breach”, “processing” and “data subject”, shall have the meaning given to them in the Data Protection Laws.

2. Roles and responsibilities

When providing the services under the Contract and performing its obligations thereunder, PS BG may act as a controller or as a processor of personal data. This Agreement is divided into the following sections:

  • General Terms – general data protection principles that apply regardless of the parties’ roles.
  • Controller Terms – applicable to controller-to-controller relationships between the Client and PS BG.
  • Processor Terms – applicable to controller-to-processor relationships between the Client and PS BG.

3. General Terms

Purposes of processing. The parties shall process personal data solely for the purposes of providing and/or receiving the services under the Contract, including to comply with their applicable legal and regulatory obligations. Personal data shall be kept for no longer than is necessary to achieve those purposes, unless a longer retention period is required or permitted by applicable law.

Security of processing. The parties shall process personal data in accordance with general principles of confidentiality and in compliance with the Data Protection Laws and the terms of this Agreement. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the parties shall implement appropriate technical and organisational measures to ensure a level of security appropriate to that risk.

The parties shall maintain appropriate policies on data protection and privacy, information security and operational resilience and ensure that their personnel comply with them, with all staff bound by confidentiality obligations in relation to the processing of personal data.

Transfers to third countries. The parties shall not transfer personal data to a country or territory that is not recognised as adequate under the Data Protection Laws unless Appropriate Safeguards are in place. Each party warrants that the personal data it discloses or otherwise transfers is accurate and that it has a valid and applicable legal basis for such disclosure or transfer.

Data minimisation. The parties undertake not to disclose to or share with each other any excessive, irrelevant or unnecessary personal data that is not required for providing or receiving the services under the Contract.

4. Processing of personal data as independent controllers

Where the parties process personal data as independent controllers under or in connection with the Contract, the provisions of this Section 4 apply in addition to Section 3 (General Terms).

Each party, acting as an independent controller, is responsible for complying with the Data Protection Laws in relation to the processing of personal data that it carries out. Each party warrants that it:

  • has a valid legal basis for processing the Shared Data under applicable law;
  • provides data subjects with all required notices and information about the processing of personal data in a transparent and lawful manner;
  • implements appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, loss, destruction or damage; and
  • fulfils all of its obligations in relation to the exercise of data subject rights and notification of supervisory authorities, where required.

If the Client or PS BG receives or becomes aware of any of the following, it shall notify the other party without undue delay and provide reasonable assistance to the other party in complying with its notification obligations under the Data Protection Laws:

  • any security breach or unauthorised access to personal data;
  • any complaint, enquiry or request from a data subject or a supervisory authority concerning Shared Data, unless such notification is prohibited by applicable law.

Each party shall respond to Data Subject Requests relating to its own processing of Shared Data.

5. Processing of personal data on behalf of the Client

Where PS BG acts as a processor in respect of the Processed Data in connection with the performance of the Contract, the provisions of this Section 5 apply in addition to Section 3 (General Terms). In the event of any conflict between Section 5 and Section 3, the provisions of Section 5 shall prevail.

Documented instructions. Unless otherwise required by applicable law, PS BG shall process the Processed Data only in accordance with the Contract and any other documented instructions of the Client.

Confidentiality and security. PS BG shall implement and maintain appropriate technical and organisational measures to ensure a level of security of the Processed Data appropriate to the risk, in accordance with the Data Protection Laws. PS BG shall treat the Processed Data as confidential and shall ensure that its personnel and Sub-processors are bound by the same confidentiality obligations.

Audits and assistance. PS BG shall provide reasonable assistance to the Client in fulfilling its obligations under the Data Protection Laws, including by:

  • forwarding to the Client without undue delay all Data Subject Requests relating to the Processed Data;
  • providing information reasonably necessary for data protection impact assessments, audits and inspections, and for fulfilling obligations towards supervisory authorities.

Upon written request and prior notice, PS BG shall assist the Client in carrying out audits or inspections to the extent reasonably necessary to demonstrate PS BG’s compliance with its obligations as a Processor, provided that such audits or inspections may be carried out no more than once in any twelve (12) month period, unless otherwise required by applicable law or by a binding order of a competent supervisory authority.

When carrying out an audit or inspection, the Client undertakes to act in a manner that does not cause unreasonable disruption, damage or interruption to PS BG’s equipment, personnel, systems and operations, and to comply with all reasonable security and confidentiality requirements of PS BG.

Personal data breach notification. In the event of a personal data breach affecting the Processed Data, PS BG shall notify the Client without undue delay after becoming aware of the breach. The notification shall contain at least: (i) a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and records concerned); (ii) the likely consequences of the breach; (iii) the measures taken or proposed to address the breach, including, where appropriate, measures to mitigate its possible adverse effects; and (iv) contact details from which further information about the breach can be obtained.

Sub-processors. The Client hereby authorises the use of the Sub-processors listed in Annex 1. The Client authorises the use of additional sub-processors. PS BG shall notify the Client in advance of any intended change concerning the addition or replacement of a Sub-processor.

The Client may object to the intended change. If no response is received from the Client within 7 calendar days of the notification, the change shall be deemed accepted.

PS BG may terminate the Contract with immediate effect if, in PS BG’s reasonable judgement, the Client objects to the appointment of a Sub-processor without good reason, or if it becomes impossible for PS BG to provide the services without the rejected Sub-processor.

When engaging a sub-processor, PS BG shall impose on it the same data protection obligations as those set out in this Agreement.

Transfers of personal data to third countries. PS BG may transfer data to third countries to the extent necessary to provide the services under the Contract. Where the processing of the Processed Data involves a transfer to Sub-processors or other business partners located outside the EEA, the parties agree that the Processed Data may be transferred only if: (i) the transfer is to a jurisdiction covered by a relevant EU Adequacy Decision and in accordance with the terms of that decision; or (ii) in the absence of an Adequacy Decision, Appropriate Safeguards are in place.

Liability. Each party shall be liable for damage caused by the processing of personal data only to the extent that it has not complied with its obligations under the GDPR or has acted outside or contrary to the lawful instructions of the other party, where applicable.

A party that has paid full compensation shall be entitled to claim back from the other party that part of the compensation corresponding to the other party’s share of responsibility.

Nothing in this Agreement limits or excludes liability towards data subjects under the GDPR.

Deletion or return of data. Upon termination of the Contract and upon written request from the Client, PS BG shall, at the Client’s choice, return all Processed Data to the Client or securely delete or destroy it, to the extent permitted by applicable law. Where applicable law requires part or all of the Processed Data to be retained for a certain period, PS BG may retain it only for the period required by law and subject to the applicable data protection and security requirements, after which the data shall be permanently deleted or destroyed.

Notwithstanding the above, PS BG may delete Processed Data before termination of the Contract where this is required or necessary to comply with applicable law (for example, retention of candidate data in an employer profile for up to six (6) months), after which such data may be deleted or anonymised.

For the avoidance of doubt, PS BG provides the Client with the technical means to delete personal data, and the Client is responsible for and undertakes to delete data relating to job applications after six (6) months from their initial storage. After that period, PS BG may delete the relevant data in order to comply with applicable law.

Annex 1 – Details of processing

Categories of data subjects

  • End users and customers of the Controller (website visitors, users of applications and platforms hosted on the infrastructure).
  • Employees, contractors and authorised persons of the Controller (technical staff with access to the hosting control panel, the servers or the colocated equipment).

Types of personal data

  • Traffic data and system logs: IP addresses, browser type, access times, cookies, and log files for access to the web server and mail protocols.
  • User content (all data stored by the Controller): texts, databases, email correspondence, photos, audio and video files, customer profiles (including names, telephone numbers and delivery addresses, where the Controller operates an online shop).
  • Access and security data: usernames, passwords (in encrypted form), SSH keys, digital certificates, and physical access logbook data (for colocation).

Nature and purpose of processing

  • Shared hosting: providing shared disk space, system resources and a software environment for deploying and running websites and databases; maintaining mailboxes; performing automatic backups to ensure service continuity.
  • Colocation: providing physical space (server cabinets/rack units), guaranteed uninterruptible power supply, air conditioning, internet connectivity and physical security/access control for the Controller’s equipment in the data centre.
  • Note: For both services, the Processor does not review, modify or use the personal data contained in the hosted content for its own purposes, but only provides the technical means for its storage and transmission on the Controller’s instructions.

Duration of processing

  • For the term of the main hosting and colocation contract, together with the statutory retention periods for system information under Bulgarian law.
  • Archives and backups are retained according to the rotation cycle set out in the contract (e.g. up to 30 days after expiry or termination of the service, after which they are permanently deleted).

Frequency and duration of processing. Processing is carried out continuously for the term of the Contract and/or for a specific period where required by applicable law.

Processing by Sub-processors – subject matter, nature and duration of processing. As set out above.

Technical and organisational measures, including data security measures:

Technical measures

  • Physical protection of the infrastructure
  • Network protection
  • Data redundancy (backups)
  • Secure protocols for remote administration (SSH, HTTPS)
  • SSL/TLS certificates for data transmission and encryption
  • Uninterruptible power supply
  • User isolation (account isolation)
  • Automated backups
  • Network security
  • Email security

Organisational measures

  • Access control policy
  • Staff confidentiality
  • Incident response plan
  • Staff training
  • Subcontractor management
  • Audit and risk assessment
  • Regular updates (patching)
  • Restriction of internal access
  • Vulnerability management policy
  • Monitoring
  • Password policy

List of Sub-processors:

Sub-processor Services
Varna Data Center Hosting and colocation
SuperHosting.BG Hosting services

This English version is provided for convenience. In the event of any discrepancy, the Bulgarian version shall prevail.