Data Processing Agreement (DPA)

Between User (Data Controller) and 971 International s.r.o. (Data Processor)
Last Updated: [07-07-2023]

This Data Processing Agreement (“Agreement”) is between:

1.1 Data Controller (User)

Any individual or entity that uses services provided by CzechArabia.cz and provides personal data for processing.

1.2 Data Processor

971 International s.r.o , Czech Republic | Email: [email protected]

This Agreement governs the processing of personal data on behalf of the Data Controller according to the GDPR (Regulation (EU) 2016/679).

The Data Processor may process personal data solely for:

• Digital services
• User interactions
• Analytics
• Communication
• Platform operations
• Future platform features including user accounts, submissions, or directories

No processing may occur outside the defined scope without written authorization from the Data Controller.

Depending on future features, processed data may include:

• Contact information (name, email)
• Account details (if accounts are introduced)
• Uploaded content (if UGC features added)
• Device and usage data
• Communication logs

The Data Processor will not intentionally process special categories of data (GDPR Art. 9).

971 International s.r.o. shall:

✔ 4.1 Process data ONLY under written or documented instruction

✔ 4.2 Maintain confidentiality

✔ 4.3 Implement technical & organizational security measures

✔ 4.4 Assist the Controller in fulfilling GDPR rights

✔ 4.5 Delete or return data upon request

✔ 4.6 Not subcontract processing without written approval

✔ 4.7 Notify the Controller of data breaches without undue delay

The User (Controller):

• Provides lawful instructions
• Ensures a legal basis for all submitted data
• Ensures accuracy and compliance
• Is solely responsible for user consent, policies, and legality of the data provided

The Data Processor is NOT responsible for illegal data submitted by the Controller.

The Data Processor implements:

• SSL encryption
• Secure hosting
• Firewall and anti-malware
• Access controls
• Limited access to authorized personnel
• Regular security updates

No system is 100% secure. The Processor is not liable for external attacks or breaches beyond reasonable control.

The Processor may use third-party services for:

• Hosting
• Backup
• Analytics
• Email services

A list of sub-processors can be provided upon request.

The Controller grants general authorization to use sub-processors.

Data may be transferred outside the EU using:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions
• GDPR-aligned protections

In case of a personal data breach, the Processor will:

• Notify the Controller without undue delay
• Provide details of the breach
• Provide assistance in fulfilling reporting obligations

The Processor is not responsible for damages caused by third-party failures.

The Processor will assist in:

• Responding to GDPR rights requests
• Data deletion
• Data access
• Rectification
• Data portability
• Data restriction

Assistance requests must be reasonable and not excessive.

Upon termination of services:

• The Processor will delete or anonymize all personal data, unless legal retention applies
• The Controller may request data export

The Controller may request audits once per year, with:

• 30 days’ notice
• Reasonable scope
• Fees paid by the Controller
• Non-disruption to Processor operations

The Data Processor shall not be liable for:

• Errors caused by incorrect instructions
• Illegal content submitted by the Controller
• Third-party failures
• Internet or hosting outages
• Incorrect or outdated data
• Indirect or consequential damages

The Controller indemnifies the Processor against claims arising from unlawful or incorrect data processing instructions.

This Agreement is governed exclusively by:

Czech law
and interpreted in accordance with the GDPR.

Disputes shall be resolved by:

1. Written negotiation
2. Binding arbitration in the Czech Republic
3. Czech courts as final jurisdiction

This Agreement is valid:

• From the moment the Controller uses any service
• Until services are terminated
• Terms survive termination unless otherwise required by law

By using CzechArabia.cz or by submitting data to 971 International s.r.o., the Controller acknowledges and accepts all terms of this Data Processing Agreement.