Data-processing addendum

1. Application and instructions

Where Fisemarco OÜ processes personal data solely on a business customer’s instructions, the customer is controller and Fisemarco is processor for that activity. These obligations apply with an agreed written processing schedule identifying the customer, services, duration, purposes, data types, data subjects, locations, authorised subprocessors, transfers and deletion/return instructions. General account signup does not complete that schedule. Do not begin such processing until it is agreed.

Fisemarco will process those data only on documented lawful instructions, including transfer instructions, unless Union or Member State law requires processing. It will inform the customer of that requirement before processing unless legally prohibited, and immediately inform the customer if an instruction appears to infringe applicable data-protection law. The customer is responsible for lawful collection, transparency, scope and instructions.

2. Confidentiality and technical measures

Fisemarco will restrict access to authorised persons bound by confidentiality duties and implement risk-appropriate measures under GDPR Article 32. Measures include applicable access control, authentication, encryption in transit, scoped runtime permissions, isolation, audit evidence, vulnerability management and incident handling. The actual security/backup/availability requirements must be stated in the schedule; this addendum does not claim end-to-end encryption, EU-only infrastructure or a guaranteed recovery time.

3. Subprocessors and international transfers

No subprocessor is authorised for customer-directed processing merely by appearing on a marketing page. The agreed schedule must identify the authorised legal entities and relevant functions/locations. Fisemarco will obtain specific or general written authorisation before appointing a subprocessor and impose obligations providing the same data-protection level, remaining responsible under Article 28(4). With general authorisation, it will provide advance notice of additions/replacements and an opportunity to raise a reasonable data-protection objection and resolve or terminate the affected processing before use.

Transfers outside the EEA require an applicable Chapter V mechanism and any necessary assessment and supplementary safeguards. An Article 28 addendum is not a substitute for a transfer safeguard. The parties must record the actual mechanism and how supporting terms may be obtained; no SCC execution or adequacy eligibility is presumed.

4. Assistance, incidents and audit

Taking account of the nature of processing and available information, Fisemarco will assist the customer with data-subject requests, security, breach assessment, DPIAs and prior consultation. It will refer requests concerning customer-controlled data to the customer and not respond substantively without instruction except where legally required.

Fisemarco will notify the controller without undue delay after becoming aware of a personal-data breach involving the covered data, providing available incident facts, affected data and subjects, contact details, likely effects and containment measures, with phased updates when needed. The customer remains responsible for its regulator/data-subject notifications; Fisemarco’s own controller duties remain separate.

Fisemarco will make available information necessary to demonstrate compliance and permit and contribute to audits, including inspections, by the customer or a mandated independent auditor, subject to proportionate confidentiality and security arrangements that do not frustrate Article 28 rights. Costs or scheduling must not remove mandatory audit rights. Records, instructions, subprocessors, transfers and remediation evidence must be maintained.

5. End of processing and priority

On termination of covered processing, Fisemarco will, at the controller’s choice, return or delete covered personal data and delete copies unless applicable law requires retention. The schedule must set practical export formats, completion dates, backup expiry and controls to prevent erased data being restored into active use. Legally retained data remain restricted to their lawful purpose and are deleted when that purpose ends.

If these obligations conflict with general service terms, this addendum governs customer-directed personal-data processing; applicable mandatory law and any binding transfer clauses prevail. Changes to the processing scope require documented instructions and an updated schedule. This addendum does not convert Fisemarco’s independent controller processing into processor activity.