Data Processing Agreement

This agreement applies only when a pack or project touches your own customers' personal data (for example the names and emails on invoices). It is accepted together with the order.

The parties: your company (the client) and ROEM NOSIS SRL, CUI 33063978, Cluj-Napoca.

1. 1.1. Roles. You are the controller; ROEM NOSIS SRL is the processor (art. 28 GDPR).

2. 1.2. Purpose and instructions. I process the data only to deliver the pack and its care, and only on your written instructions (the order and your emails).

3. 1.3. Confidentiality. Only I have access. I do not sell the data and do not use it for any other purpose.

4. 1.4. Security. Access protected by password and two-factor authentication, encrypted connections, API keys stored encrypted, least access needed.

5. 1.5. Sub-processors. The current list: Vercel (hosting), Supabase (database), Stripe (payments), Oblio (invoicing), Resend (email delivery). I tell you by email before adding a new one, and you can object.

6. 1.6. Transfers outside the EEA. Only with the safeguards GDPR provides (standard contractual clauses or the EU-US framework), as offered by the providers above.

7. 1.7. Incidents. I notify you within 48 hours of learning about a problem that affects your data.

8. 1.8. Assistance. On request, I help you answer data subject requests and provide the information needed for impact assessments.

9. 1.9. End of service. I delete or return the data within 30 days after the service ends, as you choose.

10. 1.10. Audit. On request, I provide the information that shows I comply with this agreement.

Version: 2026-10-21. Part of the Terms for fixed-price packs.