Data processing agreement (B2B)

1. Subject and duration

We process personal data on behalf of the business only to provide the chosen service, for the duration of the contract and up to 30 days afterwards (for deletion or return).

2. Categories of data and data subjects

Company gifting programme – the company's employees: name, email (optional), birthday (optional), start date (optional), team, office; card text; for Group message, colleagues' messages.

Product passport – buyers of the company's products: name, email, registered piece, private feedback sent.

Review stand – the company's guests: rating given, private feedback text, optionally name and email or phone.

The company's admins: name, email.

We do not process special categories of data (Art. 9 GDPR); the company must not upload such data.

3. Nature and purpose of processing

Storage, organisation, display in the company dashboard, sending service emails (employee notice, reminders, invitations, thank-yous, care reminders), planning and delivering gifts, statistics for the company.

4. Our obligations

We process the data only on the documented instructions of the business (configuring the service in the dashboard constitutes an instruction), unless required otherwise by law.

We ensure confidentiality: our staff with access are bound by confidentiality.

We apply appropriate technical and organisational measures: encrypted connections, access control, hashed passwords, backups, hard-to-guess secret links.

We help the business respond to data subject requests (e.g. export or deletion) and forward any requests we receive directly without delay.

We notify the business without undue delay, and at the latest within 48 hours of becoming aware, of any personal data breach affecting it.

When the contract ends we delete or return the data, at the business's choice, within 30 days, except data we must keep by law (e.g. invoices).

We provide the information necessary to demonstrate compliance with these obligations and allow reasonable audits announced at least 30 days in advance.

5. Sub-processors

The business gives general authorisation for sub-processors: hosting and storage providers, transactional email providers and courier companies (the latter receive only the recipient's name and the office address). We impose the same data protection obligations on them. We provide the current list on request and announce changes at least 14 days in advance; the business may object on reasonable grounds.

6. The business's obligations

The business is responsible for the lawfulness of processing (legal basis, informing data subjects). For employees, the service offers a notice email with a link to opt out of the birthday gift – we recommend sending it before first use.

The business uploads only necessary data and keeps it up to date (e.g. archives employees who have left).

7. Transfers and final provisions

Data is transferred outside the European Economic Area only with appropriate safeguards (Art. 44–49 GDPR).

This agreement is governed by Romanian law. In case of conflict, this agreement prevails as regards data protection.