Data Processing Agreement

1. Parties and subject matter

1.1. This Data Processing Agreement (the "Agreement") is entered into between the Client, as controller, and S.R.L. "BUSINESS PROCESE", IDNO 1019600047127, registered office: Bulevardul Iuri Gagarin 10, MD-2001, Chișinău (the "Provider"), as processor, and forms an integral part of the Terms and Conditions of the CookieYes platform.

1.2. This Agreement governs the processing of personal data of Visitors to the Client's websites, carried out by the Provider on behalf of the Client for the purpose of providing the Service, in accordance with Law No. 195/2024 on personal data protection.

1.3. This Agreement is deemed concluded on the date the Terms are accepted and remains in effect for as long as the Service is provided.

1.4. Terms used in this Agreement have the meaning given to them in the Terms and in Law No. 195/2024.

2. Description of the processing

2.1. Nature and purpose: recording, storing, displaying and exporting the choices expressed by Visitors through the banner, as proof of consent, and calculating aggregated statistics of those choices.

2.2. Categories of data subjects: Visitors to the Client's websites.

2.3. Categories of data:

• the consent identifier, randomly generated in the Visitor's browser;
• the accepted cookie categories and the way the choice was expressed;
• the version of the banner configuration at the time of the choice;
• the language of the banner;
• the address of the page and the domain on which the choice was made;
• the IP address;
• the browser and device type (user agent);
• the date and time of the choice.

2.4. The processing does not involve special categories of personal data.

2.5. Duration: for as long as the Site exists in the Client's account. Deleting the Site from the account deletes the corresponding Consent Log.

3. Obligations of the Provider

3.1. The Provider undertakes:

• to process the data only on the documented instructions of the Client, which are set out in this Agreement, in the Terms and in the configuration set by the Client in the panel, unless processing is required by law; in that case, the Provider shall inform the Client before processing, unless the law prohibits such information;
• to inform the Client immediately if, in its opinion, an instruction of the Client infringes personal data protection law;
• to ensure that persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality;
• to apply the technical and organisational measures set out in section 5;
• not to engage another processor except under the conditions of section 4;
• to assist the Client, by appropriate technical and organisational measures, in fulfilling its obligation to respond to requests from data subjects, including through the Consent Log export function;
• to assist the Client in ensuring the security of processing, in notifying personal data breaches and in carrying out data protection impact assessments, taking into account the nature of the processing and the information available to it;
• to notify the Client without undue delay after becoming aware of any personal data breach affecting Visitors' data;
• on termination of the Service, to delete the data processed on behalf of the Client, unless the law requires them to be kept;
• to make available to the Client all information necessary to demonstrate compliance with the obligations set out in this Agreement, and to allow for and contribute to audits conducted by the Client or an auditor mandated by it, subject to reasonable prior notice.

3.2. Before deleting Sites or closing the account, the Client may export the Consent Log from the panel.

4. Sub-processors

4.1. The Client gives the Provider general authorisation to engage sub-processors for hosting and operating the infrastructure of the Service.

4.2. The current list of sub-processors is made available to the Client on request. The Provider shall inform the Client of any intended change to that list, giving the Client the opportunity to object. If the Client objects, it may stop using the Service.

4.3. The Provider shall impose on sub-processors, by contract, data protection obligations equivalent to those set out in this Agreement and remains liable to the Client for their performance.

5. Technical and organisational measures

5.1. The Provider applies at least the following measures:

• transmission of data from the Visitor's browser to the Service over encrypted connections (HTTPS) only;
• keeping the Consent Log as append-only: existing entries are never modified, and each new choice is recorded separately;
• restricting access to the Consent Log to the account of the Client that owns the Site and to the Provider's authorised staff;
• panel login with passwords stored only as cryptographic hashes;
• rate limiting of requests received from Visitors' browsers.

6. Obligations of the Client

6.1. The Client warrants that it has a lawful basis for processing Visitors' data and that it informs Visitors, through its own privacy and cookie policies, of the processing carried out through the Service.

6.2. The Client is responsible for the lawfulness of the instructions given to the Provider and for the correctness of the Site configuration.

6.3. The Client handles requests from Visitors to exercise their rights. Requests received directly by the Provider are forwarded to the Client without delay.

7. Cross-border transfers

7.1. Data are transferred to a country that does not ensure an adequate level of protection only with the safeguards provided by Law No. 195/2024.

8. Liability

8.1. The parties are liable for failure to perform their obligations under this Agreement in accordance with the law and the Terms, including the limitation set out in section 8.3 of the Terms.

9. Final provisions

9.1. In the event of conflict between this Agreement and the Terms on matters of personal data protection, this Agreement prevails.

9.2. This Agreement ends when the provision of the Service ends. The obligations of confidentiality and data deletion survive until they have been fully performed.

9.3. This Agreement is amended in the manner set out for amending the Terms.

9.4. Notices under this Agreement shall be sent to the Provider at info@bpro.md and to the Client at the email address associated with its account.