Data Processing Agreement (DPA)

This is the standard version of our data processing agreement (DPA). It applies when "GARM INC" SRL (ITCore), under an IT outsourcing contract, manages a client's infrastructure and in doing so gains access to personal data: administering servers, networks and VPNs, providing information security, setting up backups and monitoring, supporting 1C and UNA, Microsoft 365 and Active Directory, maintaining workstations, running the helpdesk, servicing CCTV and access control systems and IP telephony, and acting as a virtual IT director (vCIO).

In these cases the client is the controller and we are the processor. We do not decide what data the client keeps or why; we keep the systems that hold it running.

The agreement is signed as an annex to the main contract. The parties' details, the contract number, the description of processing (Annex 1) and the list of sub-processors (Annex 3) are filled in at signing. The text published here is what we offer by default.

Controller ("Client") — the company named in the main contract.

Processor ("Provider") — "GARM INC" SRL, IDNO 1017600028014, registered office: MD-2043, mun. Chișinău, bd. Traian 2, of. 135, Republic of Moldova. Data protection officer (DPO): dpo@itcore.md; general email: info@itcore.md.

"Personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given in Regulation (EU) 2016/679 (GDPR) and Law of the Republic of Moldova No. 195/2024 on Personal Data Protection.

Sub-processor — a third party engaged by the Provider to process the Client's data. Client Systems — the servers, networks, workstations, accounts, cloud services, accounting systems and other hardware and software that the Client has entrusted to the Provider for support. EEA — the European Economic Area.

The Provider processes personal data only to deliver the services under the main contract and only on the Client's documented instructions. Instructions are the main contract, this agreement, and requests sent by the Client's authorised persons from the email addresses named in the contract or through the agreed ticketing system (helpdesk).

Routine helpdesk requests from the Client's users (password resets, workstation setup, restoring a file) are handled as set out in the main contract. Instructions that change the scope or fate of data — exports, bulk deletion, passing data to a third party, giving anyone access to another person's mailbox, files or CCTV footage — are accepted by the Provider only in writing from an authorised person of the Client. Verbal requests do not count as such instructions.

The Provider does not use the Client's data for its own purposes: it does not build products on it, train models on it, analyse it outside the Client's tasks or pass it to third parties other than the sub-processors in section 8.

As controller, the Client is responsible for the lawfulness of processing: the legal basis and data subjects' consent where required, informing its staff and other data subjects (including about CCTV and access control), the lawfulness of its instructions, the accuracy of the data, and giving the Provider access only to the systems and data the service needs.

The Client appoints the persons authorised to give instructions under section 4 and informs the Provider of any change in good time.

If the Provider believes an instruction infringes the GDPR or Law No. 195/2024, it tells the Client immediately and may suspend that instruction until the Client clarifies it in writing.

The Provider shall:

• process data only on the Client's instructions, unless processing is required by law; in that case it informs the Client in advance unless the law prohibits this;
• give access to data and Client Systems only to staff who need it for the service, through personal accounts with the minimum necessary rights, and revoke access when it is no longer needed;
• ensure that staff with access are bound by a duty of confidentiality;
• access the contents of data (mailboxes, files, 1C and UNA databases, CCTV footage, access control and telephony logs) only to the extent needed for a specific request or to fix a fault;
• apply the security measures in Annex 2;
• assist the Client with Articles 32–36 GDPR, taking into account the nature of processing and the information available to the Provider, including by providing information for data protection impact assessments;
• keep a record of processing carried out on the Client's behalf as required by Art. 30(2) GDPR;
• return or delete the data and hand over at the end of the services under section 12.

The Provider accesses Client Systems remotely, over encrypted channels, and on site at the Client's premises. The remote access and monitoring tools the Provider installs in Client Systems are listed in Annex 1 or in the documentation to the main contract.

Accounts and passwords for Client Systems, whether handed over by the Client or created by the Provider for its work, are kept in a secure vault and are never sent in plain text. Administrative accounts of Client Systems belong to the Client: on request, the Provider hands over the current credentials at any time.

Services the Client has contracted directly (for example Microsoft 365, hosting, telecom services, 1C or UNA support from the vendor) are the Client's processors, not the Provider's sub-processors. The Provider administers them on the Client's behalf within the rights the Client has granted.

The Client gives general written authorisation to engage the sub-processors listed in Annex 3.

The Provider notifies the Client in writing at least 30 calendar days before engaging a new sub-processor or replacing an existing one. The Client may raise a reasoned objection related to data protection within 15 calendar days. If the parties cannot find a solution, the Client may terminate, without penalty, the part of the services that requires that sub-processor. Absence of an objection means consent.

If an existing provider fails and the availability of the services is at risk, the Provider may engage a replacement immediately and notifies the Client within 3 business days with an explanation.

The Provider signs with each sub-processor a contract with data protection obligations no less protective than this agreement and is liable to the Client for each sub-processor as for itself.

The Provider is a company from the Republic of Moldova, and its staff work with Client Systems from the Republic of Moldova. If the Client is in the EEA or its data falls under the GDPR, this access is a transfer outside the EEA, so the parties conclude the European Commission's standard contractual clauses (Decision (EU) 2021/914, Module 2 "controller to processor"). They are attached to this agreement and prevail in case of conflict.

Data is transferred to sub-processors outside the Republic of Moldova and the EEA only with an appropriate legal mechanism under Law No. 195/2024 and Chapter V GDPR; the mechanism is stated in Annex 3. Any other international transfer takes place only on the Client's instruction.

If an authority of a foreign state requests disclosure of the Client's data, the Provider notifies the Client before disclosure where the law allows, discloses only the minimum necessary and challenges the request where there are reasonable grounds.

The Client handles data subject requests. If a request reaches the Provider, it does not answer on the merits but forwards it to the Client within 3 business days and tells the requester it has done so.

On the Client's instruction, the Provider exports, corrects or deletes a data subject's data in Client Systems, or restricts its processing, within 10 business days, so that the Client can meet the one-month deadline of Art. 12(3) GDPR.

The Provider notifies the Client of a breach affecting the Client's data without undue delay and no later than 48 hours after becoming aware of it, at the incident address given in the main contract. This also applies to incidents in Client Systems that the Provider detects through monitoring or support work, even if they were not caused by the Provider.

The notice contains what is known at the time: what happened, which systems, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken and proposed, and a contact person. Missing details follow as they become known; the first notice is not delayed to complete the picture.

The Provider helps the Client contain the incident and deal with its consequences within the scope of the services under the main contract, and preserves the logs and other information needed for the investigation.

The Client decides whether to notify the CNPDCP, another supervisory authority and data subjects. The Provider does so itself only on the Client's written instruction or where the law requires it. The Provider records all breaches and gives the records to the Client on request.

At the end of the services, the Provider returns or deletes the data it holds, as the Client chooses. The Client states its choice before the services end or within 30 calendar days afterwards; if there is no answer, the Provider sends a written reminder and then deletes the data.

At the end of the services the Provider also:

• hands over to the Client, or to a new contractor the Client names, the current credentials for Client Systems, configurations and technical documentation;
• hands over backups of the Client's data if they are held by the Provider;
• disables its own accounts and removes its remote access and monitoring tools from Client Systems, or transfers them to the Client if the Client asks.

Deletion from the Provider's systems takes place within 30 calendar days after return or after the choice period expires. Data remaining in the Provider's backups is deleted at the scheduled backup rotation and is used until then for nothing but disaster recovery. On request, the Provider confirms deletion in writing.

The Provider may keep data to the extent and for the period required by law, informing the Client and keeping it protected.

First, the Provider gives the Client documentation: a description of the measures in Annex 2 and the current list of sub-processors. As of this version, the Provider holds no independent certifications (such as ISO/IEC 27001) and no external penetration test reports.

If the documentation is not enough, the Client may carry out an audit itself or through an independent auditor who is not a competitor of the Provider — no more than once every 12 months, with 30 calendar days' notice. After a breach affecting the Client's data, or at the request of a supervisory authority, the notice period is 5 business days. The audit must not disrupt the Provider's operations or touch other clients' data; the auditor signs a non-disclosure agreement. The Client bears the costs unless the audit reveals a material breach of this agreement by the Provider.

The parties' liability under this agreement is governed by the main contract, including its limitations, unless the law prohibits applying them. Each party is liable for damage caused by its own breach of data protection requirements; a party that has compensated a data subject beyond its share may claim the difference from the other.

This agreement takes effect on signing and lasts until the Provider stops processing the Client's data, including return, deletion and handover under section 12. The sections on confidentiality, liability and deletion survive the end of the main contract.

This agreement is governed by the law of the Republic of Moldova unless the parties agree otherwise in writing; this does not limit data subjects' rights or the powers of supervisory authorities under the GDPR and Law No. 195/2024. On data protection matters, this agreement prevails over the main contract. Changes are made in writing, except for Annex 3, which is updated as described in section 8.

Filled in at signing for the specific services:

• subject matter — which services under the main contract are provided and which Client Systems are supported;
• categories of data subjects — for example, the Client's staff, its customers and business partners, visitors to its premises, telephony users;
• categories of data — for example, staff accounts and contact details, the contents of email and files, data in 1C and UNA (including HR and payroll data), CCTV footage, access control entry logs, call logs and recordings, technical logs and monitoring data;
• special categories under Art. 9 GDPR, including biometric data in access control systems — not processed by default; if present in Client Systems, they are listed here together with additional safeguards;
• where the data is held — in the Client's infrastructure, with its providers or with the Provider (for example, backups and monitoring data) — and which remote access and monitoring tools the Provider installs;
• duration — the term of the main contract plus return, deletion and handover under section 12.

Nature of processing: storage, structuring, modification, retrieval, backup, restoration, migration between systems, deletion — to the extent the services require. The Provider views the contents of data only at the Client's request and when fixing faults.

The measures are reviewed at least once every 12 months and after material changes to the services or infrastructure.

The list of sub-processors the Provider engages for work for the Client is set out in an annex to the main contract: name, country, role, the data it can access and the transfer mechanism. The list is updated as described in section 8; the Provider gives the Client the current version on request.

Services contracted directly by the Client are not on the list (section 7).

Questions about this agreement or data protection: dpo@itcore.md.