1. Parties and subject matter
This Data Processing Agreement (the Agreement) forms an integral part of the Terms of Use of the VONCON platform. It is concluded between the company using the Platform, as controller (the Controller), and VONITO d.o.o. Bihać, Muhsina Rizvića 25, 77000 Bihać, as processor (the Processor).
The Agreement governs the processing of personal data carried out by the Processor on behalf of the Controller in providing the Platform, in accordance with the Law on Personal Data Protection of Bosnia and Herzegovina (Official Gazette of BiH, No. 12/25) and, where applicable, Article 28 of the EU General Data Protection Regulation (GDPR).
2. Description of processing
- Purpose and nature: storage and processing of data on the Platform, calculation of configurations and prices, creation of quotes, orders and PDF documents, sending emails on behalf of the Controller, backups.
- Categories of data subjects: the Controller's end customers and their contact persons, the Controller's employees and associates, dealers.
- Categories of data: first and last name, email, telephone, address and location, customer company name, content of enquiries, configurations, quotes, orders, notes, quote acceptance data (name, time, IP address), consents.
- Special categories of data: the Platform is not intended for processing them and the Controller does not enter them.
- Duration: for the term of the Terms of Use, and until deletion in accordance with Section 9.
3. Controller's instructions
The Processor processes data only on documented instructions from the Controller. The instructions consist of this Agreement, the Terms of Use and the Controller's actions in the Platform (e.g. sending a quote, deleting a customer). If the Processor considers that an instruction infringes applicable law, it shall inform the Controller immediately.
The Controller is responsible for the lawfulness of processing, in particular for the legal basis and for informing end customers, including the consent text in the configurator.
4. Confidentiality
Access to data is granted only to those of the Processor's personnel who need it for provision, maintenance and support, and who are bound by confidentiality. Access for support purposes is recorded in the change log.
5. Security
The Processor implements the technical and organisational measures set out in Annex 2 and keeps them aligned with the state of the art.
6. Sub-processors
The Controller grants general authorisation for the engagement of the sub-processors listed in Annex 1. The Processor shall notify the Controller of any addition or replacement of sub-processors at least 30 days in advance; within that period, the Controller may object on reasonable grounds and, if the parties fail to reach agreement, may terminate the agreement. The Processor concludes with each sub-processor a contract imposing data protection obligations no less protective than those set out herein.
7. Assistance to the Controller
The Processor assists the Controller in responding to requests from data subjects exercising their rights: the Platform enables export of all of a customer's data, rectification and erasure (pseudonymisation in the change log). The Processor also assists with data protection impact assessments and cooperation with the supervisory authority, to the extent it has the necessary information.
8. Personal data breach
The Processor shall notify the Controller of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, providing the information known to it at that time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken.
9. Deletion and return of data
Following termination of the Terms, the Controller may export the data for 30 days. Thereafter, the Processor deletes the Controller's data; such data is removed from backups upon expiry of their 30-day retention period. Data that the Processor is required by law to retain is kept solely for that purpose.
10. Audit
Upon request, the Processor provides the Controller with the information necessary to demonstrate compliance with this Agreement. Once a year, with 30 days' prior notice and at its own expense, the Controller may carry out an audit or entrust it to an independent auditor bound by confidentiality, without compromising the data of other companies.
11. Data transfers
Data is stored in the European Union. Transfers to third countries are permitted only on the basis of an adequacy decision or standard contractual clauses.
12. Liability and governing law
Liability is governed by the provisions of the Terms of Use, unless otherwise provided by law. This Agreement is governed by the law of Bosnia and Herzegovina; where the GDPR applies, its mandatory provisions also apply.
Annex 1: Sub-processors
- Hostinger International Ltd., Larnaca, Cyprus; data centre in Germany: virtual server on which the Platform and the database run.
- Backblaze, Inc., San Mateo, USA; EU Central data centre (Amsterdam, Netherlands): storage of encrypted backups.
- Sendinblue SAS (Brevo), Paris, France: sending emails (confirmations, enquiries, quotes).
Annex 2: Technical and organisational measures
- Encrypted transmission (HTTPS/TLS) for the application, the API and emails where the recipient supports it.
- Separation of company data in the database (row-level security): each query sees only the data of its own company.
- Mandatory two-factor authentication, checking of passwords against known breaches, limited number of login attempts.
- Roles and permissions based on the principle of least privilege; an immutable change log.
- Secret keys and sensitive values encrypted in the database (AES-256-GCM).
- Rate limiting on public endpoints; the public configurator does not disclose rules or formulas.
- Daily full backup and continuous archiving of changes (maximum 15-minute lag), encrypted (AES-256), 30-day retention, monthly test restore.
- Software updates, a separate staging environment, review of changes before release.
- Server access only for authorised personnel of the Processor, with protected access credentials.