Data Processing Agreement (ContractCube Cloud)

This Data Processing Agreement ("DPA") forms part of the Terms and License Agreement (the "Terms") between Vallentes Consulting SRL, with its registered office at Str. Principală nr. 67, Camera nr. 1, Sat Valea Dragului, Com. Valea Dragului, Giurgiu County, Romania, registered with the Trade Register under no. J2020004853233, fiscal code (CUI) 43196815, VAT no. RO43196815 (the "Provider"), and the customer that subscribes to ContractCube Cloud (the "Customer"). It applies only to ContractCube Cloud. The ContractCube desktop app and the ContractCube Server Edition store data on the Customer's own devices or servers, and the Provider does not process that data.

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given in Regulation (EU) 2016/679 (the "GDPR"). "Customer Personal Data" means the personal data that the Customer and its users store in, or send through, ContractCube Cloud. "Sub-processor" means a third party engaged by the Provider to process Customer Personal Data.

2. Roles

The Customer is the controller of Customer Personal Data (or a processor acting for its own controller, in which case the Customer confirms it has that controller's authorisation). The Provider is the processor. For account, billing and security data about the Customer's users that the Provider needs to run and secure the service, the Provider is an independent controller, as described in the Privacy Policy.

3. Subject matter, duration, nature and purpose

• Subject matter: hosting and processing of Customer Personal Data so that the Customer can manage contracts, documents, partners, obligations, registers, approvals, electronic signatures and e-invoices.
• Duration: the term of the Customer's subscription, plus the export and deletion periods in section 11.
• Nature: storage, organisation, retrieval, display, search and text extraction, sending of emails and reminders on the Customer's instructions, electronic signature workflows, backup and deletion.
• Purpose: providing ContractCube Cloud under the Terms. The Provider does not use Customer Personal Data for any other purpose, including advertising, profiling or training of artificial intelligence models.

The categories of data subjects and personal data are listed in Annex 1.

4. Instructions

The Provider processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use and configuration of the service are the Customer's complete instructions. If the Provider must process data because of EU or Member State law, it will inform the Customer first unless that law prohibits it. The Provider will tell the Customer if, in its opinion, an instruction infringes data protection law.

5. Confidentiality

The Provider ensures that persons authorised to process Customer Personal Data are bound by confidentiality. Staff access a Customer's workspace only when needed to provide support requested by the Customer, to maintain or secure the service, or when required by law.

6. Security

The Provider implements the technical and organisational measures described in Annex 2 and keeps them appropriate to the risk, taking into account the state of the art and the cost of implementation. The Provider may update these measures as long as the overall level of protection is not reduced.

7. Sub-processors

The Customer gives general authorisation for the Provider to engage Sub-processors. The current Sub-processors are listed in Annex 3. The Provider will give at least 30 days' notice by email to the workspace owners before adding or replacing a Sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the subscription and receive a pro-rata refund of prepaid fees for the remaining period. The Provider imposes on each Sub-processor data protection obligations equivalent to this DPA and remains liable for its Sub-processors.

Services that the Customer chooses to connect (for example its own email server, an artificial intelligence provider used with the Customer's own key, webhooks, ANAF SPV, or an identity provider for single sign-on) are not Sub-processors. Data sent to them is sent on the Customer's instruction and under the Customer's own agreement with that service.

8. International transfers

Customer Personal Data is stored in the European Union (OVH data centre in Hauts-de-France, France). Where a Sub-processor may process data outside the European Economic Area, the transfer is based on an adequacy decision (including the EU-U.S. Data Privacy Framework, where the recipient is certified) or on the Standard Contractual Clauses adopted by the European Commission, with supplementary measures where needed.

9. Assistance

Taking into account the nature of the processing, the Provider assists the Customer:

• with requests from data subjects, mainly through the functions of the service (search, export, correction and deletion of records and documents). The Provider forwards to the Customer any request it receives directly and does not answer it unless authorised;
• with data protection impact assessments and prior consultations, by providing the information in this DPA and reasonable further information on request;
• with the security obligations of Article 32 GDPR.

10. Personal data breaches

The Provider notifies the Customer without undue delay, and in any case within 48 hours after becoming aware of a personal data breach affecting Customer Personal Data. The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. The Provider gives further information as it becomes available.

11. Return and deletion

The Customer can export its data at any time during the subscription. After the subscription ends, the workspace remains available for export for 30 days, unless the Customer deletes it earlier. The Provider then deletes Customer Personal Data from the live systems. Copies in backups are overwritten within 14 days after that. The Provider may keep data only where EU or Member State law requires it, and then only for that purpose.

12. Audits

The Provider makes available all information reasonably necessary to demonstrate compliance with Article 28 GDPR, including this DPA, the description of measures in Annex 2 and answers to reasonable security questionnaires. Once per year, or after a personal data breach, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality, with at least 30 days' notice, during business hours and without access to other customers' data. Each party bears its own costs, unless the audit reveals a material breach of this DPA by the Provider.

13. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms, except where the GDPR does not allow such a limitation. In case of conflict on data protection matters, this DPA prevails over the Terms. This DPA is governed by Romanian law, and the courts named in the Terms have jurisdiction.

14. Nature of the service

ContractCube is software for organising and tracking contracts and related documents and deadlines. The Provider does not provide legal advice. The Customer remains responsible for determining the purposes and legal bases of its processing, for the content it stores and for its compliance with data protection law; this DPA and the functions of the service do not replace professional advice.

Annex 1. Categories of data

Data subjects:

• the Customer's users (employees and other persons the Customer invites);
• contact persons of the Customer's partners, suppliers and clients;
• signers of documents sent for electronic signature;
• persons who submit or are named in documents recorded in the Customer's registers (for example petitioners);
• any other persons named in contracts, documents and e-invoices that the Customer uploads.

Categories of personal data:

• identification and contact data: name, job title, company, email address, phone number, postal address;
• contract and document content uploaded by the Customer, including text extracted from it;
• electronic signature evidence: name, email, typed or drawn signature, time, IP address, browser information, one-time code verification and consent text;
• register entries, approvals, comments, reminders and activity history;
• e-invoice data received from ANAF SPV or imported by the Customer;
• emails and attachments received in the Customer's contract inbox.

Special categories of data (Article 9 GDPR) and data about criminal convictions are not required for the service. If the Customer uploads such data, for example in register petitions, the Customer is responsible for having a legal basis, and the measures in Annex 2 apply.

Annex 2. Technical and organisational measures

• Encryption in transit: all access to the service uses HTTPS (TLS 1.2 or later).
• Encryption at rest: uploaded documents and attachments are encrypted with AES-256-GCM. Stored secrets (email server passwords, connection tokens, two-factor secrets) are encrypted.
• Passwords are stored only as salted scrypt hashes.
• Access control: four roles (owner, admin, editor, viewer); optional two-factor sign-in with an authenticator app, which owners can require; single sign-on with the Customer's identity provider; session list with remote sign-out.
• Separation: each workspace's data is separated by a workspace identifier enforced on every query, and covered by automated tests.
• Integrity: electronic signature and register event logs are hash-chained and cannot be changed or deleted through the database; signed documents carry their evidence and can be checked on a public verification page by hash.
• Administrative access to the platform is restricted by a secret token and a list of allowed network addresses, and is not reachable from the internet.
• Availability: daily database backups kept for 14 days; a documented procedure for restoring the service and moving it to another server.
• Logging: security-relevant actions (sign-ins, role changes, two-factor changes, exports, deletions) are recorded in an activity log.
• Abuse protection: rate limits on sign-in, one-time codes and public endpoints; outgoing connections from the service to private network addresses are blocked.
• Development: changes are tested automatically before deployment; production data is never used for testing.

Annex 3. Sub-processors

Sub-processor	Service	Location	Data
OVH SAS, Roubaix, France	Servers, storage and backups	Hauts-de-France, France	All Customer Personal Data
Google Ireland Limited (Google Workspace)	Delivery of emails sent by the service	EU, with possible transfers under the Standard Contractual Clauses	Recipient addresses and email content (for example reminders, signature requests, notifications)

The payment provider (Stripe Payments Europe, Ltd.) processes payment data as an independent controller and has no access to Customer Personal Data.