Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between:

Data Controller ("Customer")	Data Processor ("Processor")
Company name: ___________________________ IČO / Registration no.: _______________ Registered address: ___________________ Contact email: ________________________	Martin Havel IČO: 71677763 Košťálkova 1103/2, 182 00 Praha 8, Czech Republic Email: [email protected] Trading as: cz-agents.dev

together referred to as the "Parties".

1. Background and scope

The Customer uses the cz-agents API (the Service) to query Czech public registers (ARES company register, ISIR insolvency register, EU/OFAC sanctions lists) for the purpose of due-diligence, KYC/AML compliance, or business intelligence.

In providing the Service, the Processor retrieves and temporarily processes data that may include personal data of natural persons registered in those public registers (company directors, statutory representatives, beneficial owners, registered agents). This DPA governs such processing under GDPR Article 28.

2. Duration

This DPA is effective from the date both Parties sign it (or from the date the Customer first uses the Service, whichever is earlier) and remains in force for as long as the Customer holds an active subscription or API token. Upon termination of the service relationship this DPA terminates automatically.

3. Nature and purpose of processing

Item	Detail
Nature	Retrieval from public registers; API response delivery; short-term request logging; token-based authentication
Purpose	Enabling the Customer to perform due-diligence and compliance checks on Czech legal entities
Legal basis (Processor's own processing)	Legitimate interest (GDPR Art. 6(1)(f)) — public-register data republished for compliance use

4. Categories of personal data and data subjects

Category of data	Categories of data subjects
Name, address, date of birth (where public), role/function	Directors, statutory representatives, beneficial owners, and other natural persons listed in ARES
Insolvency proceedings details	Natural persons listed as debtors in the ISIR insolvency register
Sanctions-list entries (name, nationality, identifiers)	Natural persons listed on EU Consolidated Financial Sanctions List (FSF) or OFAC SDN list

The Processor does not process special categories of personal data (GDPR Art. 9) or data relating to criminal convictions (Art. 10).

5. Obligations of the Processor

The Processor shall:

1. Process personal data only on documented instructions from the Customer (i.e., API requests made using the Customer's token) and for no other purpose.
2. Ensure that persons authorised to process personal data are bound by confidentiality.
3. Implement appropriate technical and organisational security measures (see Section 7).
4. Inform the Customer if, in the Processor's opinion, an instruction infringes GDPR or other applicable law.
5. Assist the Customer in fulfilling its obligations regarding data subject rights (access, erasure, restriction, portability) to the extent technically feasible given that the underlying source data is public-register data controlled by third parties.
6. Notify the Customer without undue delay (and no later than 72 hours) after becoming aware of a personal data breach affecting Customer data.
7. Delete all Customer data (API tokens, usage logs, query logs) within 30 days of service termination, unless retention is required by applicable law.
8. Make available all information necessary to demonstrate compliance with this DPA, and allow for audits and inspections conducted by the Customer or a mandated auditor, upon 14 days' written notice.

6. Sub-processors

The Customer grants the Processor general authorisation to engage the following sub-processors. The Processor shall inform the Customer of any intended changes (addition or replacement) with at least 14 days' notice, giving the Customer the opportunity to object.

Sub-processor	Service	Location
Hetzner Online GmbH	Cloud hosting and storage	EU (Germany)
Cloudflare, Inc.	CDN, WAF, DDoS protection	EU PoPs; data stored EU
Resend, Inc.	Transactional email delivery	EU (Frankfurt)

7. Technical and organisational security measures

• All data in transit protected by TLS 1.2 or higher
• API tokens stored hashed or in access-controlled SQLite volumes on encrypted-at-rest Hetzner servers
• Access to production infrastructure restricted to named individuals; SSH key authentication only
• Request logs retained for a maximum of 90 days, then deleted
• No personal data exported to third-party analytics or advertising platforms
• Regular dependency updates and security patching

8. International data transfers

All processing takes place within the EU/EEA (Hetzner Germany). No transfers to third countries are made except as necessary for Cloudflare's network routing, which is covered by Cloudflare's standard contractual clauses with Hetzner as origin.

9. Customer obligations

The Customer shall ensure it has a lawful basis for each query submitted to the Service, and that its use of returned data complies with applicable law (including GDPR, AML regulations, and any sector-specific rules).

10. Liability

Liability of each Party for breach of this DPA is governed by the applicable service agreement between the Parties. Where no such agreement exists, each Party's total liability arising under or in connection with this DPA shall not exceed the total fees paid by the Customer in the 12 months preceding the event giving rise to liability.

11. Governing law

This DPA is governed by Czech law. Disputes shall be resolved before the courts of the Czech Republic.

12. Entire agreement

This DPA supplements the Terms of Service and, together with them, constitutes the entire agreement between the Parties regarding data processing. In case of conflict, this DPA prevails.