Data processing agreement
When we host, build, maintain or market a website or application for you, we often handle personal data of your visitors, customers or staff on your behalf. This agreement sets out how, as Article 28 GDPR requires. It is part of every contract with us that involves such data. Last updated 3 October 2026.
1. Parties and roles
1.1 You, the client, are the controller. Tiaro Digital d.o.o. za usluge, Ulica Ivana Meštrovića 35, 10360 Sesvete, Croatia, OIB 50559636036, is the processor.
1.2 This agreement applies to all personal data we process on your behalf under any contract with you (the "main contract"). If the main contract and this agreement conflict on data protection, this agreement prevails.
2. Subject, duration, nature and purpose
2.1 Subject and purpose: providing the services in the main contract, for example hosting a website or application, maintaining and updating it, handling its forms and emails, running backups, fixing faults, migrating data, setting up and running marketing campaigns, and support.
2.2 Nature of the processing: storage, hosting, backup, transmission, organisation, retrieval, correction, deletion, and, only where the main contract says so, analysis.
2.3 Duration: as long as the main contract runs, plus the period needed to return and delete the data under section 9.
3. Types of data and data subjects
3.1 Data subjects: visitors of your website or application, your customers and prospects, people who contact you, your staff and other users with accounts.
3.2 Types of data, depending on what your site does: contact details (name, email, phone, address), content of messages and form entries, account and login data, order and invoice data, technical data (IP addresses, browser data, log files), and any other data you choose to store in the system.
3.3 Special categories of data (Article 9 GDPR), such as health data, are processed only if the main contract says so expressly and with the additional measures agreed there.
4. Instructions
4.1 We process the data only on your documented instructions: the main contract, this agreement, and any further instructions you give in writing (email is enough). This also applies to transfers to countries outside the EU/EEA.
4.2 If the law requires us to process data in another way, we tell you before we do, unless the law forbids that.
4.3 If we believe an instruction infringes data protection law, we tell you without delay and may wait to carry it out until you confirm or change it.
5. Confidentiality
Everyone at Tiaro Digital and at our subcontractors who can access the data is bound to confidentiality, by contract or by law, and receives only the access their work requires.
6. Security
6.1 We take appropriate technical and organisational measures under Article 32 GDPR, taking into account the state of the art, the costs, and the risks for the people concerned. They include:
- encrypted connections (HTTPS/TLS) for websites, administration and data transfers;
- access to servers and administration areas only for people who need it, with individual accounts and strong passwords;
- prompt security updates for operating environment, CMS, themes and plugins we maintain;
- backups that allow data to be restored after an incident, as agreed in the main contract;
- separation of client systems, so one client's data is not accessible from another's;
- logging and monitoring to detect attacks and faults;
- deletion of data that is no longer needed, and secure disposal of storage media.
6.2 We review and improve these measures as technology and risks develop. We may change them as long as the level of protection does not fall.
7. Subprocessors
7.1 You authorise us in general to engage subprocessors. The subprocessors in use today are:
- hosting.com (A2 Hosting, Inc., USA): server hosting, email hosting and backups, servers in the European Union;
- MailChannels Corporation (Canada): relay of outgoing email.
7.2 Further subprocessors named in the main contract or offer for a specific project (for example a payment provider or an advertising platform you choose) are authorised by your acceptance of it.
7.3 We inform you at least 30 days before adding or replacing a subprocessor. You may object for an important data protection reason within that time; if we cannot find a solution together, either side may terminate the affected service.
7.4 We bind every subprocessor to the same data protection obligations as in this agreement, and remain responsible to you for their work.
7.5 Transfers to countries outside the EU/EEA take place only where the requirements of Chapter V GDPR are met, in particular on the basis of an adequacy decision or the European Commission's Standard Contractual Clauses.
8. Assistance and data breaches
8.1 We help you, as far as we reasonably can, to answer requests from data subjects exercising their rights, to keep your systems secure, to carry out data protection impact assessments, and to consult the supervisory authority. If a data subject contacts us directly, we pass the request on to you without delay and do not answer it ourselves unless you instruct us to.
8.2 We inform you without undue delay, and where possible within 48 hours, after we become aware of a personal data breach affecting your data. We give you the information you need to assess it and to meet your own reporting duties under Articles 33 and 34 GDPR, and take the necessary steps to limit the damage.
8.3 Assistance beyond what the main contract includes, and that is not caused by a breach on our side, may be charged at the hourly rate in the main contract.
9. End of processing
When the main contract ends, we return all personal data to you (as a complete export of files and database) or delete it, at your choice, and delete existing copies, unless EU or Croatian law requires us to keep them. Without other instructions we keep the data for 30 days after the end of the contract so you can take it with you, then delete it; data in backups is deleted with their normal rotation.
10. Proof and audits
10.1 We give you the information needed to show that we meet the obligations in this agreement.
10.2 You may check this yourself or through an auditor bound to confidentiality, after giving at least 14 days' notice, during business hours and without unreasonably disturbing our work or breaching confidentiality towards other clients. Each side bears its own costs, unless the audit reveals a material breach on our side.
11. Liability and final provisions
11.1 Liability follows Article 82 GDPR and the main contract.
11.2 Croatian law applies. Changes need written form; email is enough.
11.3 If a provision is invalid, the rest of this agreement remains valid.
11.4 Need a signed copy for your records? Write to info@tiaro.eu and we send one with the details of your services filled in.