Version 1.1 · Published 22 October 2026 · English
Scope and instructions
This DPA forms part of the Order between Trimix Tech d.o.o. and the Customer. Before customer processing under a new agreement, complete private particulars identifying the parties, controller chain/appointment authority, instructions and incident contacts, duration, subjects/data, measures, suppliers, countries and transfer safeguards. This public edition alone appoints no supplier and does not replace those particulars. Mandatory law prevails; the DPA prevails for personal-data processing.
Where the Customer determines purposes and essential means, it is controller and Trimix processor. Where it acts for a client controller, Trimix is subprocessor with the required appointment authority. Roles follow actual activities. Trimix's own account/business purposes are described in the Data Notice.
Operations are instructed upload, storage/preparation, AI recognition, validation, review/approval, export, scoped support, return and deletion. Ordinary accounting data include business/sole-trader identities and contacts, identifiers, purchases, dates, amounts/taxes, payment references, originals and linked records. Special-category, criminal and payroll data require separate assessment/agreement. The Customer supplies lawful instructions, grounds/notices and access assignments.
Trimix processes only documented lawful instructions, including transfers; it promptly flags unlawful instructions. Legally required processing beyond instructions is notified beforehand unless prohibited by law. Customer content is not used for model training or cross-customer analytics. Confidential personnel access only what their duties require; case content access follows the permission limits in the Terms. Confidentiality survives termination.
Measures, suppliers and transfers
Appropriate Article 32 measures include server-side Tenant/Organization authorisation, private files, protected transport/storage, supported-input controls, proportionate audit, incident handling and controlled releases. Recovery and deletion controls must preserve scope and restrictions. No certification, universal MFA, zero retention or completed full restore is asserted. Measures must not silently fall below the agreed safeguards.
Current infrastructure uses Oracle Cloud for database, file storage and preparation in Frankfurt, Germany; OpenAI API for recognition/assistance with Global processing and Standard retention; and Neoserv / Avant.Si d.o.o. for support email and internal Help Desk. Supplier contracting entities, complete primary/backup/access countries, onward chains and safeguards must be identified in the applicable private schedule before appointment/transfer. Frankfurt storage does not establish EU-only AI or remote support. Public brand references do not prove that a particular account's DPA has been checked.
The completed schedule receives general written authorisation. Notify proposed additions/replacements at least 30 days in advance, supply relevant information and allow reasoned objections. Resolve the objection before a disputed appointment, using an agreed alternative or ending affected processing with safe return where no lawful solution exists. Equivalent duties bind subprocessors; Trimix remains responsible as GDPR requires. Outside-EEA processing requires documented instructions and a valid Chapter V mechanism, necessary assessment and supplementary measures; relevant safeguard information is available to the Customer.
Assistance, incidents and audit
Promptly route subject requests through the competent controller chain and assist rights, security, breach handling, DPIAs and prior consultation according to processing and available information. Verify authority without disclosing other-customer records; assistance must support legal deadlines.
Notify the Customer without undue delay after awareness of a personal-data breach, without waiting for a complete investigation. Supply known nature, categories/approximate scale, likely consequences, containment and contact; follow with updates. The controller's possible 72-hour deadline is not Trimix's notice allowance; support hours do not postpone notification.
Provide compliance information and allow/contribute to legally required audits and inspections by the Customer or authorised auditor. Reasonable secure arrangements may protect others' confidentiality but must not obstruct mandatory audits or regulator access.
Return, retention and deletion
On service end, return or delete personal data according to the competent controller's lawful choice, except legally required storage. The Terms define included full return, protected delivery, ordinary 24-month document/history retention, advance notices, 30-day exit access and active deletion in the next 30 days. Longer mandatory retrieval, earlier lawful erasure and scoped holds take precedence. Technical logs have a 90-day policy; contract/invoice/assent records follow their separate legal purpose.
Delete controlled originals, fragments, derivatives, all object versions and relevant supplier copies as well as active records. Record completion and justified exceptions without retaining erased content as proof. Residual backups expire within up to 60 days; isolate them from ordinary use and reapply subsequent erasures/restrictions before any restored data re-enter service. Automated purge and full restore verification remain implementation work, not certified capabilities of this publication.
Keep accepted versions and completed annexes privately. Material changes require authorised acceptance; supplier changes follow their notice route. Unresolved unlawful processing/material breaches require proportionate restriction/termination and safe return. Commercial liability limits cannot reduce mandatory GDPR rights. This DPA is not itself a transfer SCC instrument.