Data processing agreement

This Data Processing Agreement ("DPA") applies when a company uses VoltCards for its team. It is part of the agreement between the company ("you") and VORTEK INOVATIONS D.O.O., Njudelhiska 6/1-13, Karposh, Skopje, North Macedonia ("we", "us"), which consists of our Terms and conditions and, for a paid company plan, our Subscription terms. It meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR) and of North Macedonia's Law on Personal Data Protection.

If you need a signed copy for your records, write to hey@volt.cards.

1. Roles

For the company data described in section 2, you are the controller and we are your processor. You decide why and how that data is processed; we process it only to provide VoltCards to you.

For everything else, including each person's own account, their personal contact book and their billing with us, we are the controller, under our Privacy policy.

2. What we process for you

• Data subjects: your team members who hold company cards, and the people who leave their details through those cards.
• Personal data: on company cards, the name, job title, company, photo, contact details and links. In company leads, the name, email address, phone number, company, message and answers a visitor sends, the card and event it came through, and the town estimated from their connection. Team statistics, as counts of views and taps on company cards. Your team's roles and permissions in the company portal.
• Purpose: running your team's cards, collecting and managing your leads, showing your team statistics, and sending leads to the services you connect.
• Duration: for as long as you use VoltCards, and until the data is deleted under section 8.

No special categories of personal data are needed for any of this, and you must not collect them through your cards.

3. Your instructions

We process the data only on your documented instructions. Your instructions are this DPA, and the settings and actions your administrators choose in the company portal, such as your brand template, the questions on your lead form, the webhook you set up, deleting a lead or handing a card to a new team member. If we are required by law to process the data otherwise, we will tell you first unless the law forbids it.

If we think an instruction breaks data protection law, we will tell you.

4. Confidentiality

Everyone at VoltCards who can access the data is bound to keep it confidential, and only those who need it to run the service can access it.

5. Security

We protect the data with measures appropriate to the risk, including:

• VoltCards is reachable only over an encrypted connection;
• passwords are stored only as hashes, and sign-ins from new devices are reported to the account holder;
• each company's data is kept apart by the company it belongs to, and every portal request is checked against the permissions your administrators grant;
• keys we hold for other services are stored encrypted;
• repeated attempts are rate limited.

6. Sub-processors

You authorise us to use the sub-processors listed on Your data and GDPR, under "Who handles it for us". Each is bound by data protection terms at least as protective as this DPA. We will update that list before we add or replace a sub-processor that handles your data, and you can object by writing to us. If we cannot resolve your objection, you can end your company plan.

Some sub-processors are outside North Macedonia and the European Union. Where your data goes there, it goes under the safeguards they offer for it, such as the EU Standard Contractual Clauses.

7. Helping you

We help you meet your obligations under data protection law, taking into account what we process and the information we have:

• Requests from individuals. Your administrators can view, export (as CSV) and delete leads in the company portal, and edit or pause company cards. If a person contacts us about data we process for you, we will pass the request to you rather than answer it ourselves.
• Breaches. If we become aware of a personal data breach affecting your data, we will tell you without undue delay, with what we know about it and what we are doing about it.
• Assessments. We will give you the information you reasonably need for a data protection impact assessment, or for a consultation with a supervisory authority.

8. When it ends

When your company is removed from VoltCards, we delete your company leads, brand templates and webhooks. Each card stays with the account that holds it, which is no longer a company card. Before that, your administrators can export your leads from the company portal.

We keep data after that only where the law requires us to.

9. Audits

We will give you the information you reasonably need to show that we meet this DPA. If that is not enough, you may audit our compliance once a year, at your cost, with reasonable notice, by an auditor bound to confidentiality, in a way that does not put other customers' data at risk.

10. Liability and conflicts

Each party's liability under this DPA is subject to the Terms and conditions. If this DPA and the rest of our agreement disagree about personal data, this DPA prevails.

11. Contact

Write to hey@volt.cards about anything in this DPA.