Data Processing Agreement and Subprocessor Annex (Article 28 GDPR)

This DPA applies when Delice processes personal data on your instructions as processor in connection with Smart Office Tools, hosted integrations, support portals, RaConnect/MicroAPI services where you are controller, or other Delice services identified in your order.

You are the controller for customer, employee, and end-user data you upload or cause to be processed. Delice Automatics Ltd acts as processor, except where Delice is an independent controller (for example its own billing, security logging, website operations, or compliance).

Delice processes personal data only on documented instructions, including those in the main service agreement, this DPA, configuration you apply in the service, and documented support tickets, unless required by EU or Member State law.

Delice shall process personal data only on your documented instructions unless required by Union or Member State law. If Delice believes an instruction infringes GDPR or other Union or Member State data protection provisions, Delice shall inform you without undue delay.

Delice ensures that persons authorised to process personal data on its behalf are bound by appropriate confidentiality obligations, whether by contract or statutory duty, and receive training appropriate to their role.

Where Delice engages subprocessors, Delice imposes on each subprocessor data protection obligations substantially equivalent to those in this DPA, including appropriate technical and organisational measures. Delice remains fully liable to you for the performance of a subprocessor's obligations.

Taking into account the nature of processing and information available to Delice, Delice shall assist you, where reasonably practicable, with: security of processing (Article 32); notification of personal data breaches (Article 33); communication of breaches to data subjects (Article 34); data subject rights requests (Articles 15–22); data protection impact assessments (Article 35); and prior consultation with supervisory authorities (Article 36).

You provide general written authorisation for Delice to engage subprocessors listed in Schedule 3, subject to the conditions below. Delice may engage additional or replacement subprocessors only with your specific written authorisation, or by giving you at least 30 days' prior notice of the intended change and an opportunity to object on reasonable grounds relating to data protection.

If you object on reasonable grounds, Delice will not engage the new subprocessor for your data or will offer an alternative arrangement. Material subprocessor changes are reflected in Schedule 3 with updated notice information.

Subject matter: provision of Delice software and hosted services per the main agreement. Duration: term of the service agreement plus deletion period in Schedule 4. Nature and purpose: hosting, synchronisation, support, automation, and related technical operations instructed by you. Categories of data subjects: your customers, employees, and end users you choose to process. Categories of personal data: contact details, account identifiers, content you upload, technical logs, and support materials. Special categories: not intended unless you instruct otherwise and appropriate safeguards are agreed.

Delice implements appropriate technical and organisational measures, including access control, encryption in transit where applicable, logging, backup, and staff confidentiality obligations proportionate to risk.

Measures include: role-based access; authentication for administrative access; encryption in transit (TLS) for remote access; segregation of customer environments where applicable; backup and restore procedures; vulnerability patching; incident logging; staff confidentiality undertakings; and subprocessors bound by written data-protection terms.

Detailed TOM descriptions and evidence requests are handled through security documentation and reasonable audits per the Audit section.

This schedule distinguishes Article 28 GDPR processors from independent controllers and data-source disclosures.

Article 28 processors (subprocessors)

Third-party disclosures (not Article 28 subprocessors under this DPA)

Delice operates Bulgarian-hosted infrastructure for core Delice platform services under its own operational control. Google Vertex AI and ElevenLabs are not subprocessors under this customer DPA.

Delice operates Bulgarian-hosted infrastructure for core Delice platform and related services and maintains an internal legacy CRM environment operated by Delice for historical business records. Personal data in those environments is processed under Delice's instructions and security policies; they are not marketed as third-party subprocessors but remain under Delice operational control.

Delice will assist you in responding to data subject requests using appropriate technical measures, to the extent legally permitted and considering the nature of processing.

Delice will notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide information reasonably required for your regulatory obligations.

Upon termination, Delice deletes active production copies of your personal data within 30 days after confirmed instructions, unless law requires retention. Encrypted backups may remain inaccessible for up to 90 days for disaster recovery, after which they are overwritten subject to legal hold or restoration duties.

You may export your data during the notice period where the service supports export.

You may request reasonable information necessary to demonstrate compliance. Routine on-site audits may be conducted with reasonable advance notice, subject to confidentiality, security, and minimal disruption constraints.

Following a personal data breach affecting your data or a substantiated compliance concern, you may request an additional audit without the routine annual frequency cap, provided notice is reasonable and scope is proportionate.

This DPA remains in effect for the duration of the service agreement and until deletion/return obligations are fulfilled.