Data Processing Agreement

Version 2026-11-13, effective from 13 Nov 2026. Concluded under Article 28 of the General Data Protection Regulation (EU) 2016/679 (GDPR). The Croatian version is legally binding; this translation is provided for convenience.

Controller: the legal entity or individual that registered for the PencilCRM service and accepted this agreement (the "Customer").

Processor: [NAZIV TVRTKE], OIB [OIB], [ADRESA] (the "Provider").

This agreement forms part of the Terms of Service and takes effect when they are accepted.

1. Subject matter and duration

1.1. The Provider processes personal data on behalf of the Customer to provide the PencilCRM service: collecting and managing enquiries and contacts, communicating with them, tasks, appointments and reports.

1.2. Processing lasts for the duration of the service contract and until the data is deleted under section 9.

2. Types of data and data subjects

2.1. Data subjects: people whose data the Customer enters into the service or that the service collects on its behalf, in particular people who send enquiries to the Customer ("contacts"), and the Customer's staff and contractors who use the service.

2.2. Contact data: name, email, phone, country, language, enquiry source (e.g. web form, Meta ad), content of enquiries and correspondence, notes, tasks and booked appointments.

2.3. Special categories: the service is not designed for special categories of data under Article 9 GDPR. The Customer alone assesses whether the service is suitable for such data (e.g. health data). If it enters such data, the Customer warrants that it has a legal basis for processing it, enters only necessary data and complies with the rules of its sector. The service is not certified for HIPAA or similar sector-specific rules and must not be used for processing subject to them without a separate written agreement with the Provider.

2.4. Data of the Customer's authorised persons: name, email, phone, role, languages, login and activity records.

3. Provider's obligations

The Provider:

a) processes data only on the Customer's documented instructions. Instructions are this agreement, the Customer's settings and actions in the service, and written instructions sent to vas@email.com. The Provider immediately informs the Customer if it considers an instruction to infringe the law;

b) ensures that persons authorised to process the data are bound by confidentiality;

c) implements the technical and organisational measures in Annex 1;

d) engages sub-processors only under section 4;

e) assists the Customer, as far as possible, in responding to data subject requests (access, rectification, erasure, portability). The service allows viewing, editing, deleting and exporting data for this purpose;

f) assists the Customer with its obligations under Articles 32 to 36 GDPR (security, breach notification, impact assessment, prior consultation);

g) deletes or returns data after the contract ends under section 9;

h) makes available all information necessary to demonstrate compliance with this Article and allows audits under section 8.

4. Sub-processors

4.1. The Customer gives a general authorisation to engage sub-processors. The list at the time of conclusion is in Annex 2.

4.2. The Provider informs the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable grounds within that period and, if no agreement is reached, terminate the contract without cost.

4.3. The Provider imposes the same data protection obligations on sub-processors and remains liable to the Customer for their performance.

4.4. Services the Customer itself connects to the CRM (e.g. its own business mailbox, Meta Lead Ads) are not the Provider's sub-processors. The Customer has its own contractual relationship with those providers.

5. Location of processing

5.1. Data is processed and stored in the European Union (main servers: Hetzner Online GmbH, Njemačka / Germany). Transfers to third countries are permitted only with appropriate safeguards under Chapter V GDPR.

6. Personal data breach

6.1. The Provider notifies the Customer without undue delay, and no later than 48 hours after becoming aware, of a personal data breach affecting the Customer's data.

6.2. The notice describes the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed. Information not immediately available is provided later.

7. Customer's obligations

7.1. The Customer is responsible for the lawfulness of processing, legal bases, informing data subjects and the accuracy of the data it enters.

7.2. The Customer is responsible for its authorised persons and for keeping their credentials safe.

8. Audits

8.1. On request the Provider supplies documentation of the measures applied. If that is not sufficient, the Customer may once a year, with at least 30 days' notice, carry out an audit itself or through an independent auditor bound by confidentiality, at its own cost and without disrupting the service.

9. Deletion and return of data

9.1. During the contract and for 30 days after it ends, the Customer can export all its data in a machine-readable format.

9.2. After that period the Provider permanently deletes the Customer's data from the live system within 30 days. Copies in backups are deleted by regular rotation no later than 14 days afterwards.

9.3. Data the Provider must keep by law (e.g. accounting records of the subscription) is kept only as long as required.

10. Liability and final provisions

10.1. Liability of the parties is governed by Article 82 GDPR and the Terms of Service.

10.2. In case of conflict between this agreement and the Terms of Service on data protection matters, this agreement prevails.

10.3. This agreement is governed by the laws of the Republic of Croatia.

Annex 1: Technical and organisational measures

• Data separation: each Customer's data is separated at application level (every record belongs to one Customer and every database query is automatically limited to the Customer of the logged-in person).
• Encryption: all traffic is encrypted (TLS). User passwords are stored as hashes (bcrypt). Integration credentials (mailbox passwords, tokens) are stored encrypted. Backups are encrypted.
• Access control: role- and permission-based access assigned by the Customer, immediate deactivation of authorised persons, email verification, login rate limiting.
• Provider access: authorised persons only, only when needed for support or maintenance, bound by confidentiality.
• Availability: daily encrypted database backups kept for 14 days, monitoring of availability and background jobs, error tracking without personal data.
• Maintenance: regular updates of the system and libraries, automated tests before every change.
• Deletion: procedure for permanently deleting all of a Customer's data and for exporting it in a machine-readable format.

Annex 2: Sub-processors