Data Processing Agreement
This page summarises the data processing terms between "Connectix" ood, UIC 205830094, Varna, Bulgaria (the "Processor") and the customer (the "Controller") under Article 28 of Regulation (EU) 2016/679 ("GDPR"). A countersigned copy of the full agreement is available to every customer on request at office@connectix.bg.
1. Subject matter and duration
The Processor processes personal data on behalf of the Controller solely for the delivery of Viber and SMS messages, related delivery reporting, contact management and risk-scoring services ordered by the Controller, for the duration of the service contract.
2. Nature and purpose of processing
Storage, structuring, transmission to telecommunications providers, and deletion of recipient data for the purpose of delivering messages initiated by the Controller and reporting their delivery status.
3. Categories of data and data subjects
Data subjects: the Controller's customers and contacts. Data categories: names, telephone numbers, message content (including template variables such as order references and amounts), delivery metadata and consent/opt-out state. The platform is not intended for special categories of data under Article 9 GDPR.
4. Obligations of the Processor
- process personal data only on documented instructions from the Controller;
- ensure persons authorised to process the data are committed to confidentiality;
- implement the technical and organisational measures described on the Security page;
- respect the conditions for engaging sub-processors (Section 6);
- assist the Controller in responding to data subject requests and in ensuring compliance with Articles 32–36 GDPR;
- at the Controller's choice, delete or return all personal data after the end of the provision of services;
- make available all information necessary to demonstrate compliance and allow for audits.
5. Personal data breach notification
The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, providing the information required by Article 33(3) GDPR as it becomes available.
6. Sub-processors
The Controller grants a general authorisation for the engagement of sub-processors for hosting, e-mail delivery and telecommunications routing. The Processor maintains a current list, imposes equivalent data protection obligations on each sub-processor, and informs the Controller of intended changes, giving the opportunity to object.
7. International transfers
Processing takes place within the European Union. Any transfer to a third country occurs only with appropriate safeguards under Chapter V GDPR and only where necessary for message delivery.
8. Liability and governing law
Liability follows Article 82 GDPR and the service contract. The agreement is governed by Bulgarian law; the competent supervisory authority is the Commission for Personal Data Protection (www.cpdp.bg).
9. Requesting the signed agreement
To receive the full agreement for countersignature, write to office@connectix.bg from your registered account e-mail, stating your company name and UIC.