Data Processing Agreement (DPA)

This agreement applies only if you use Arvis Loft in your professional activity and enter personal data about other people into the app. In that case you are the controller and we are the processor, and Art. 28 GDPR requires us to have a written contract with a minimum content. This document is that contract.

If you use the app strictly for personal, hobby purposes, you do not need it: your relationship with us is fully described in the Privacy Policy.

You do not need to sign anything separately. The agreement is concluded automatically, by accepting the Terms and Conditions, and takes effect for the whole duration of your contract. If you need a signed copy for your compliance file, write to privacy@arvis.ro and we will send you one.

1. The parties

Controller: you, the professional user (sole trader, individual enterprise, company or other entity), identified by your account details.

Processor: COMEXIM ELECTRONIX SRL, Suceava, Str. Tineretului nr. 2, bl. 33, sc. A, ap. 4, Suceava County, Romania, VAT ID RO41380985, Trade Register J2019001287330, privacy@arvis.ro.

2. What we delimit: where you are controller and where we are

The distinction matters and is easy to miss.

This agreement covers exclusively the second row.

3. Subject matter, duration, nature and purpose of the processing

• Subject matter and purpose: providing you with the Arvis Loft service, as described in the Terms.
• Nature of the processing: storage, organisation, structuring, consultation, extraction from uploaded files or documents, display, generation of documents (PDF pedigrees, exports), backups and erasure.
• Duration: for the whole duration of your contract, plus the grace period after account closure.
• Categories of data subjects: breeders, previous or current owners of the birds, people named in the documents you upload.
• Categories of data: name, loft name, locality, any contact details, and any other information appearing in the documents you upload. We neither ask for, nor permit, the upload of special categories of data within the meaning of Art. 9 GDPR (racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, data concerning health, sex life or sexual orientation). The prohibition also covers photographs or scanned documents that might contain images of identifiable people. If you upload such a document by mistake, write to us at privacy@arvis.ro so we can delete it.

4. Your instructions

We process the data only on your documented instructions. The Terms, the Privacy Policy and your use of the app's features constitute those instructions.

We depart from this only where Union or Romanian law obliges us otherwise; in that case we inform you before processing, unless the law prohibits such information.

If we consider that an instruction of yours infringes the GDPR or another data protection rule, we inform you immediately and may suspend its execution.

5. Confidentiality

The people who have access to your data are bound by confidentiality, contractually or by law, and have access only to the extent strictly necessary for their tasks.

6. Security of processing

We apply appropriate technical and organisational measures, in accordance with Art. 32 GDPR: traffic encryption (HTTPS), passwords stored as hashes, data isolation between accounts at the database level, private storage accessible through temporary links only, access control, an audit trail, error monitoring and backups. Details are in section 8 of the Privacy Policy.

Measures may evolve; we will not reduce them below the level of protection existing at the date of acceptance.

7. Sub-processors

You give us general authorisation to use sub-processors. The current list and each one's purpose are published in section 4 of the Privacy Policy, which forms part of this agreement.

We impose on each sub-processor, by contract, data protection obligations at least equivalent to those in this agreement, and we remain fully liable to you for their activity.

When we add or replace a sub-processor, we inform you in advance, by updating the list and by e-mail. You may object within 30 days, by writing to privacy@arvis.ro. If your objection is well founded and we cannot find a reasonable solution, you may terminate the contract, with a refund of the amount paid and not consumed.

8. Transfers outside the EU

Only one transfer outside the Union may take place: to Anthropic, PBC (US), and only if you use the optional pedigree scanning feature. It takes place on the basis of the European Commission's Standard Contractual Clauses (Art. 46 GDPR), with a transfer impact assessment carried out. If you do not use scanning, data does not leave the EU through this channel.

If you want to avoid this transfer entirely, do not use the scanning feature; the rest of the app works normally.

9. Assistance with data subject rights

If a data subject contacts us directly about data we process for you, we do not answer on your behalf: we tell them to contact you and inform you without delay.

We assist you, by appropriate technical and organisational measures, in responding to requests for access, rectification, erasure, restriction, portability and objection. In practice, the app gives you the tools directly: you can edit, export and delete the data at any time, yourself.

10. Assistance with your obligations

We assist you, within the limits of the information available to us, with:

• ensuring the security of processing (Art. 32);
• notifying personal data breaches to the authority and to data subjects (Art. 33 and 34);
• data protection impact assessments and prior consultation (Art. 35 and 36).

Security incidents. If we become aware of a security breach affecting your data, we inform you without undue delay, with the information available at that time, and keep you updated as we learn more.

11. Deletion or return of data

When the service ends, at your choice:

• you export your data at any time, directly from the app (Settings → Your data), in commonly used, machine-readable formats; or
• you request its erasure.

We delete the data after the grace period, including uploaded files. Deletion propagates to backups at the next rotation. We retain only what the law requires us to retain (for example fiscal documents), for as long as it requires.

The exact deadlines, including those imposed by Regulation (EU) 2023/2854, are in section 19 of the Terms.

12. Audits and information

At your reasonable written request, we make available the information necessary to demonstrate compliance with the obligations in this agreement.

For audits, we offer documentation and questionnaire responses in the first instance. An on-site audit, carried out by you or by an independent auditor bound by confidentiality, may take place at most once a year, with reasonable notice, during working hours, without disrupting operations and without access to other customers' data. Reasonable additional costs may be borne by you, unless the audit reveals non-compliance on our part.

13. Liability

Each party's liability follows Art. 82 GDPR. The liability limitations in the Terms apply to the extent permitted by law, but they do not limit liability towards data subjects or towards the supervisory authority.

14. Duration, changes and governing law

The agreement enters into force upon acceptance of the Terms and ends when data deletion is complete.

We may update it to align it with legislative changes or decisions of authorities, with 30 days' notice, under the conditions of section 15 of the Terms.

Romanian law and the GDPR apply. The competent supervisory authority is ANSPDCP.

Questions? Write to us at privacy@arvis.ro.