Data Processing Agreement — OAZEE

This Data Processing Agreement (DPA) forms part of the OAZEE Terms of Service between Arti Group s.r.o., Company ID (IČO) 27930432, VAT ID (DIČ) CZ27930432, registered office Schulhoffova 793/3, Háje, 149 00 Prague 4, Czech Republic (OAZEE), and the customer using OAZEE to process personal data on the customer's behalf (Customer).

It applies where OAZEE processes personal data in website content, visitor inquiries, or associated hosting and delivery solely for the Customer. The Customer is normally the controller; if the Customer is an agency acting for a controller, OAZEE acts as its subprocessor. The Customer must have authority to give the relevant instructions.

The GDPR meanings of controller, processor, personal data, processing, and personal data breach apply. This DPA takes priority over conflicting general terms for the processing within its scope. It does not govern OAZEE's separate controller purposes for accounts, billing, security, or support, described in the Privacy Policy. Applicable data-protection law prevails over any contractual limitation.

• Subject matter: hosting and operating the Customer's website and handling the personal data the Customer chooses to include or collect through the supported functions.
• Nature and purpose: storage, retrieval, display and publication of instructed website content; receipt, spam screening, storage, and email delivery of visitor inquiries; technical support, security, and deletion or return necessary to provide those functions.
• Data subjects: the Customer's website visitors, prospective and existing customers, contact persons, personnel, and other persons whose data the Customer lawfully supplies.
• Data types: instructed website text and images, names, business contact details, email addresses, phone numbers, messages, service or appointment details when used, submission times, hashed IP information, browser/user-agent information, and relevant security or spam flags. Infrastructure and protection providers may process connection data needed for delivery and security.
• Duration: while the relevant processing service and lawful retention instructions continue, followed by return or deletion under section 10. Continued account storage is not authority for unrelated reuse.

The standard service is not designed to collect special-category data, criminal-offence data, identity documents, or other highly sensitive information through general-purpose forms or AI prompts. The Customer must not instruct such processing without a lawful basis and an expressly agreed appropriate arrangement. An unsolicited sensitive message is still protected personal data and does not become available for independent use.

The Customer instructs OAZEE to process data only to provide the functions selected under the contract, the Customer's recorded settings and requests, and this DPA. A request to publish website content is an instruction to make that content public; a private form inquiry is not an instruction to publish it.

OAZEE processes data only on lawful documented instructions, including instructions concerning international transfers, unless applicable EU or Member State law requires otherwise. In that case OAZEE informs the Customer before processing unless legally prohibited. OAZEE promptly informs the Customer if an instruction appears to infringe applicable data-protection law and may suspend the affected instruction while it is clarified.

OAZEE does not use Customer-controlled visitor data for its own advertising, independent model training, sale, or unrelated product development. Permission to host a form does not authorise sending its messages to an AI provider for that provider's independent purposes. AI processing within this DPA requires an applicable Customer instruction and a provider arrangement consistent with this DPA.

The Customer determines the lawful basis, supplies the required visitor notices, limits collection to necessary data, and provides lawful retention instructions. Those responsibilities do not release OAZEE from its own processor obligations.

OAZEE ensures that persons authorised to process data are bound by confidentiality and receive access only as needed for their duties. OAZEE applies appropriate technical and organisational measures under article 32 GDPR, taking account of the risks, scope, context, state of the art, and cost of implementation.

The measures include access restriction and authentication, protection of data in transit, secure handling of credentials, separation of customer access, proportionate abuse and spam protection, appropriate logging and incident handling, and measures to maintain availability and restore data where appropriate. Managed infrastructure protections and retention are assessed for the relevant processing. No particular certification, exclusive storage region, fixed backup recovery time, or absolute security guarantee is claimed by this DPA.

OAZEE provides the Customer with information reasonably necessary to assess the applicable measures and does not materially reduce the overall protection required by law during the processing service.

The Customer gives general written authorisation for the subprocessors properly identified for the relevant processing. The provider schedule in section 12 must identify the actual providers, functions, locations, and applicable transfer arrangements before the relevant processing is entrusted to them. An unused software integration is not itself a statement that the provider receives the Customer's data.

Before adding or replacing a subprocessor for Customer data, OAZEE provides information about the proposed change to the Customer's registered contact at least 30 days in advance, where practicable, so the Customer has a meaningful opportunity to object on reasonable data-protection grounds. A genuinely urgent security or legal change is notified as early as possible and does not waive the requirement for lawful authorisation and protection.

The Customer may object during the notice period. The parties will seek a reasonable alternative or protective measure. If the objection cannot be resolved and no lawful alternative is available, the Customer may end the affected processing service before the change takes effect without an early-termination charge and receive any refund legally or contractually due for the affected unused service. This does not promise continued use of an unlawful or unavailable supplier.

OAZEE imposes written obligations on subprocessors that provide the same relevant data-protection protection as this DPA and remains responsible to the Customer for their performance as required by article 28 GDPR. A downstream AI model provider is not exempt merely because access is routed through another platform.

The Customer's instruction is not a waiver of GDPR restrictions on transfers outside the EEA. Before a restricted transfer, OAZEE must establish and document a valid mechanism for the actual recipient and processing, together with any required assessment and supplementary measures.

The processing in section 12 includes transfers to the United States. These transfers rely on the EU-U.S. Data Privacy Framework (DPF) where the recipient and activity are covered by a current certification, and/or applicable Standard Contractual Clauses (SCC) under the relevant supplier DPA. The Privacy Policy, sections 8–9 sets out the locations, recipient entities, and links to their transfer terms. A European contracting entity does not exclude access or processing in the United States.

An adequacy decision may be used only where its conditions apply. Reliance on the EU-U.S. Data Privacy Framework requires the relevant recipient and activity to be covered by a current certification. Where Standard Contractual Clauses are used, the appropriate parties, module, annexes, processing description, and measures must be completed; a general reference in this DPA is not an executed set of transfer clauses.

OAZEE supplies information about the actual mechanism and access to the safeguards on request, subject to lawful protection of confidential information and third-party personal data. If a transfer cannot be lawfully maintained, the affected transfer must be stopped or another lawful arrangement adopted.

Taking account of the processing, OAZEE assists the Customer with appropriate measures to answer requests for access, correction, erasure, restriction, objection, and portability where applicable. Requests can be coordinated through Show email address.

If OAZEE receives a request concerning Customer-controlled data, it forwards it to the Customer without undue delay and does not independently decide the Customer's response, except where legally required. The Customer remains responsible for assessing the request; OAZEE provides assistance in time to support the applicable legal deadline. Return of data may be handled on request and is not limited to information visible in a dashboard.

OAZEE notifies the Customer without undue delay after becoming aware of a personal data breach affecting data processed under this DPA. The notice includes, as available, the nature of the incident, affected categories and approximate numbers, a contact point, likely consequences, and measures taken or proposed.

Information may be provided in stages without undue delay while facts are investigated. OAZEE cooperates on containment, remediation, and the Customer's assessment and notification duties. The controller's possible 72-hour supervisory notification deadline is not a contractual period during which OAZEE may delay informing the Customer.

Taking account of the nature of processing and information available, OAZEE assists the Customer with security obligations, breach notifications, data-protection impact assessments, and prior consultation where required.

OAZEE makes available information necessary to demonstrate compliance with article 28 GDPR and permits and contributes to audits, including inspections by the Customer or a mandated independent auditor. The parties arrange reasonable notice, scope, confidentiality, and protection of other customers' data; these arrangements cannot nullify a statutory audit right or obstruct a competent authority. Existing independent reports may be used where suitable but are not falsely represented as certifications OAZEE holds.

Routine cooperation is part of the relevant legal obligations. A separately agreed charge for genuinely additional work must be reasonable and must not obstruct mandatory rights or correction of OAZEE's own non-compliance.

At the end of the relevant processing service, the Customer may choose return or deletion of Customer personal data, including copies, unless EU or Member State law requires storage. Requests are made through Show email address; OAZEE assists without undue delay and supplies a usable, commonly used format appropriate to the data when return is requested. After return, OAZEE deletes remaining copies unless EU or Member State law requires retention, subject to the limited backup cycle below.

If the Customer keeps an account and instructs continued storage for restoration, that defined storage purpose may continue under this DPA. Ending paid hosting and keeping recoverable content is not the same as instructing deletion of all stored content. The operational retention periods in the Privacy Policy remain subject to lawful Customer instructions and GDPR necessity.

Legally required retained records are isolated to the required purpose. Backup copies awaiting the applicable deletion cycle remain protected, are not used for new purposes, and are deleted or anonymised when that limited retention is no longer necessary. OAZEE explains a relevant retention exception or cycle on request.

The contact for processor instructions and data-protection matters is Show email address. Notices relating to Customer data are directed to the Customer's current account contact unless another contact is agreed. The Customer must keep that contact current.

This DPA follows the Czech-law provision in the Terms of Service without restricting the GDPR, competent supervisory authorities, rights of individuals, or other non-excludable protections. It does not force a consumer to use an exclusively Czech court contrary to applicable law.

The Privacy Policy, section 8 identifies relevant service-provider brands and functions. For the Customer's actual processing, the schedule must distinguish:

• Vercel Inc. (United States): hosting, Blob storage, and BotID-related protection, including any relevant Kasada processing;
• Neon: database storage; current public terms identify Databricks, Inc. and its affiliate Neon, LLC (United States);
• Resend / Plus Five Five, Inc. (United States): delivery of inquiries and service emails, including U.S. storage of message data;
• configured AI or voice providers, where Customer data is lawfully included: Google (including Google Cloud EMEA Limited, Ireland, for Gemini API Paid Services with a Czech billing address), OpenAI, OpenRouter with the relevant downstream provider, or Recraft;
• other providers only to the extent actually used on the Customer's behalf under the required authorisation.

Stripe's independent payment processing, registry disclosures to Gransy / Subreg or the relevant domain registry, and OAZEE's own support notifications are assessed by their actual roles; they are not all automatically subprocessors for visitor form data.

The database region is AWS US East 1, Northern Virginia, United States (us-east-1). Vercel's default function region for OAZEE is Washington, D.C., United States (iad1), with static content delivered through a global CDN. Logos, photos, and uploads use Vercel Blob; the function region does not determine every Blob, cache, backup, or remote-access location. Resend stores email data in the United States; selecting a sending region does not change that storage location.

The recipient and transfer terms in the Privacy Policy, sections 8–9 form part of this schedule. For each active subprocessor, OAZEE supplies the relevant contractual entity, function, data categories, applicable processing and remote-access locations, and transfer safeguards at Show email address, and notifies changes under section 5. Additional or downstream providers must be identified for the actual processing; the listed infrastructure regions do not imply that all processing is confined to those regions.