Data Processing Agreement
A data processing agreement (GDPR Art. 28) between the Client as controller and DigiSoov OÜ as processor. It is an integral part of the IT services agreement and does not require a separate signature.
Last updated: 13 November 2026
1. Parties and scope
This agreement supplements the services agreement (the "Agreement") between the Client and DigiSoov OÜ (registry code 11025977, K. Kärberi tn 50-159, 13919 Tallinn, info@digisoov.ee) and applies whenever DigiSoov OÜ (the "Processor") processes personal data on behalf of the Client (the "Controller") while providing IT services.
It takes effect together with the services agreement, that is, when the Client accepts the Offer or pays the first invoice, and remains in force as long as personal data is processed.
2. Subject, nature and purpose of processing
The Processor processes personal data only to provide IT services to the Client: administration of servers, workstations, networks, email and backup, monitoring and user support.
Types of data: data stored in or accessible through the Client's systems, such as user accounts, content and metadata of email, files, logs, and device and network data (identification and contact data). Data subjects: the Client's employees, customers, partners and other persons whose data is on the Client's systems.
The Processor does not intentionally process special categories of personal data. If such data is on the Client's systems, the Client informs the Processor in advance.
3. Instructions
The Processor processes personal data only on the Controller's documented instructions. The Agreement and the Client's written requests (including by e-mail) are instructions. If the Processor considers an instruction to infringe data protection rules, it informs the Client.
4. Confidentiality
Only those Processor staff who need access to provide the service, and who are bound by a duty of confidentiality, have access to personal data.
5. Security measures
The Processor applies technical and organisational measures appropriate to the risk (GDPR Art. 32). The measures are listed in the annex.
6. Sub-processors
The Processor does not engage sub-processors without the Controller's prior written authorisation (general or specific). A sub-processor is bound by the same data protection obligations, and the Processor remains liable for its actions. The list of sub-processors is provided on request.
7. Assistance with data subject rights and obligations
The Processor assists the Controller, to a reasonable extent, in responding to data subject requests, carrying out impact assessments and consulting the supervisory authority. Assistance outside the package is charged at the hourly rate set in the Agreement.
8. Personal data breach
The Processor notifies the Controller of a personal data breach without undue delay and in any case within 48 hours after becoming aware of it, providing the information available at that time.
9. Deletion and return of data
When the Agreement ends, the Processor deletes the personal data or returns it, at the Controller's choice, unless the law requires retention. Backup copies are deleted in the course of the regular retention cycle.
10. Audits
The Processor provides the Controller with the information necessary to demonstrate compliance and allows audits. An audit is announced in reasonable time, takes place during business hours, no more often than once a year and at the Controller's cost.
11. Transfers to third countries
The Processor processes personal data within the European Union / European Economic Area and does not transfer it to third countries without the Controller's prior authorisation and the safeguards required by the GDPR.
12. Liability and governing law
Liability is governed by the Agreement to the extent the law allows. Estonian law applies; in case of discrepancy the Estonian version prevails.
Annex. Technical and organisational measures
Measures appropriate to the risk, including:
- personal user accounts and the principle of least privilege; access only when needed
- multi-factor authentication for administrative access where the system supports it
- encrypted connections (TLS, VPN, SSH)
- regular updates and security patches of managed systems
- monitoring and backup according to the package or agreement
- secure storage of access details and passwords; access removed when staff leave
- confidentiality obligation of staff