Data processing agreement

You are the controller: it is your customer, employee or visitor data, and you decide what happens to it. We are the processor: we build and run software that handles that data on your instructions, and we do nothing else with it.

In that case Article 27 of Kosovo's Law No. 06/L-082 on the Protection of Personal Data requires a written contract between us; an electronic one counts. This applies even if we never look at a record, because maintaining a database or fixing a production bug means we could.

The agreement is governed by the law of the Republic of Kosovo. Kosovo's data protection law follows the European Union's General Data Protection Regulation, as its Article 1 states.

If your own law requires additional clauses in the agreement, we add them to your contract on request.

The agreement covers what Article 27 of the law asks for:

• Subject matter, duration, nature and purpose of the processing, the categories of data subjects and the types of personal data, all listed in an annex specific to your project.
• Processing only on your documented instructions, and a duty to tell you if an instruction looks unlawful to us.
• Confidentiality binding everyone who touches the data.
• Technical and organisational measures, listed below and annexed to the contract.
• Sub-processors named up front, with prior notice and a right to object before any new one is added.
• Assistance with data-subject requests, with breach notification, and with your data protection impact assessment where one is needed.
• Deletion or return of the data at the end of the engagement, at your choice.
• Information and audit rights, including the records you need to demonstrate compliance.

Our own systems run on European infrastructure: the server functions are pinned to Frankfurt and the database sits in eu-central-1. The engineer who works with the data does so from Prishtina.

Transfers of personal data out of Kosovo are governed by Articles 44 to 49 of the law. The annex to your agreement names every provider and every place your data is processed.

The annex lists only what is actually true of this stack. We do not claim certifications we do not hold, which is why this page shows no ISO or SOC 2 badge.

• Encrypted transport everywhere: HTTPS on every public endpoint, TLS to the database and to every provider API.
• Encryption at rest as provided by the hosting and database providers.
• Access limited to the engineer working on your project. There is no support pool and no offshore subcontractor chain.
• Two-factor authentication on the provider accounts that hold your environments.
• Least-privilege credentials: environment variables scoped per environment, production secrets never on a laptop in plain text, separate staging data wherever it can be synthetic.
• Backups run by the hosting and database providers, with point-in-time restore where the plan includes it.
• Deletion of working copies and revocation of our access at the end of the engagement, confirmed to you in writing.

These providers run our own systems. They appear in the annex unless your project runs entirely in your infrastructure. If your project adds a provider, we name it before it is used, never after.

We notify you in writing within 48 hours of becoming aware of a personal data breach; Article 33 of the law requires a processor to notify the controller without undue delay. The notice says what we know at that point: what happened, which data and roughly how many records are affected, what we have already done, and what we recommend you do. We do not wait for a complete picture, because a controller's own deadline for notifying the authority is 72 hours, and it starts before ours would finish.

You decide whether to notify the authority and the people affected. We give you the technical detail you need for that notification and stay available while it runs.

You may ask at any time for the information needed to demonstrate compliance, and you may audit us or appoint an auditor. In practice most clients accept a written questionnaire and a walkthrough call, which we do without charging for it. An on-site audit is arranged on reasonable notice.

When the work ends, you choose: we delete the personal data and every working copy, or we return it in a usable export first and then delete. Either way you get written confirmation, and our access to your systems is revoked the same week.

You get a signed copy on request. We send the agreement, the annexes and the sub-processor list before the first brief, so your review runs in parallel with the project rather than blocking it at the end.

Tell us who signs on your side and which entity is the controller, and the documents come back the same week.

Request the documents→