Data Processing Agreement
Data Processing Agreement (DPA) in compliance with the General Data Protection Regulation (GDPR) and applicable Romanian law
Regio Development SRL
Tax ID: 44161343
Reg. No.: J26/706/2021
Str. Dealul Rotund no. 5
Sovata, Romania
contact@regio-development.net
Regulations Followed
Guaranteed Rights
"Controller" = Regio Development SRL, in its capacity as a SaaS digital signage service provider.
"Processor" = Regio Development SRL, in its capacity as processor of personal data on behalf of its customers.
"Personal data" = any information relating to an identified or identifiable natural person.
"Processing" = any operation performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
"GDPR" = Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
This Agreement sets out the obligations and responsibilities of the parties in connection with the processing of personal data within the provision of SaaS digital signage services.
The Agreement governs processing carried out by the Processor on behalf of and for the Controller, in line with the latter's documented instructions.
Purpose of processing: provision of digital signage services, including content management, screen performance monitoring and platform usage analytics.
Categories of Data Processed
Purposes of Processing
Categories of Data Subjects
Confidentiality and Security
Subprocessing
Data-Subject Rights
Technical Measures
Organisational Measures
The Processor will notify the Controller of any personal data breach within 24 hours of becoming aware of it.
The notification will include: the nature of the breach, the categories and approximate number of data subjects, the categories and approximate number of records affected, and the measures taken to remedy the breach.
The Processor will cooperate with the Controller in investigating the incident and implementing remedial measures.
A detailed incident report will be issued within 72 hours, including causes, impact and preventive measures implemented.
Personal data is stored and processed exclusively within the European Economic Area (EEA).
Servers are located in certified data centres in Romania and other EU member states.
If a transfer of data outside the EEA becomes necessary, the Processor will:
• Obtain prior written authorisation from the Controller
• Ensure adequate safeguards through Standard Contractual Clauses approved by the European Commission
• Implement supplementary protection measures in line with EDPB recommendations
The Processor will make available to the Controller all information necessary to demonstrate compliance with the obligations set out in this Agreement.
The Controller, or an auditor mandated by the Controller, has the right to carry out audits, including inspections at the Processor's premises, with at least 30 days' notice.
Audits will take place during normal business hours and will not unduly affect the Processor's activities.
Audit costs are borne by the Controller, except where major non-conformities are identified.
The Processor will remedy any non-conformity identified within the agreed timeframe, but no later than 90 days.
Retention Periods
| Data Type | Retention Period | Action |
|---|---|---|
| Authentication and user account data | Duration of the contract + 30 days for closing activities | Automatic deletion on expiry |
| Access and security logs | 12 months from generation | Anonymisation or deletion |
| Billing data | 10 years per Romanian accounting law | Secure archival, then deletion |
| Backups | 30 days for daily, 90 days for monthly | Automatic deletion with overwrite |
Deletion Process
The Processor is liable for damage caused by processing only where it has failed to fulfil its obligations under this Agreement or has acted outside or against the Controller's lawful instructions.
The Processor's liability is limited to direct damages up to the value of the annual contract, except for:
• Wilful or grossly negligent breaches
• Breaches of confidentiality and data security
• Sanctions imposed by supervisory authorities
In the event of a joint action against the Controller and Processor, each party will be liable in proportion to its degree of responsibility.
Amendments and Updates
This agreement may be amended only by written agreement of both parties.
Legislative updates will be incorporated automatically, with at least 30 days' prior notice.
The current version is permanently available at:regiodisplay.net/legal/dpa
DPO Contact
Sovata, Romania