Data Processing Agreement (DPA)

1. Parties to the Agreement

2. Subject of the Agreement

This Data Processing Agreement ("Agreement" or "DPA") governs the terms and conditions under which the Processor processes personal data on behalf of the Controller in connection with the provision of the Helionix SaaS platform – a software solution for construction project management and workforce attendance tracking.

This DPA is prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – "GDPR"), in particular Article 28, and the Bulgarian Personal Data Protection Act.

3. Categories of Processed Data

3.1 Worker Data

*GPS coordinates are processed transiently for geo-fence validation only (comparing worker location against project boundaries). Coordinates are NOT stored in any database – only the boolean result (inside/outside geo-fence) is recorded.

3.2 Organization Data (Controller)

3.3 Categories Explicitly EXCLUDED from Processing

4. Purpose and Duration

4.1 Purposes of Processing

• Provision of the Helionix SaaS platform services
• Workforce attendance and working time management
• Financial calculations (payroll processing, billing)
• Technical support upon request by the Controller

4.2 Duration

*Except accounting documents retained for 10 years per legal requirements

5. Processor Obligations

5.3 Security Measures

5.4 Sub-processors

5.6 Data Breach Notification

6. International Data Transfers

The Processor ensures that all personal data is processed primarily within the European Economic Area (EEA). Where transfers to third countries are necessary, the following safeguards apply:

6.1 Primary Data Location

• Database: Supabase, EU West (Frankfurt, Germany)
• Application hosting: Vercel, EU (Amsterdam, Netherlands)
• Backups: Stored exclusively in EU data centers

6.2 Transfers to Third Countries

In the event data must be transferred outside the EEA (e.g., to US-based sub-processors for technical support), such transfers shall be conducted exclusively under one of the following mechanisms:

• Standard Contractual Clauses (SCCs) – as approved by the European Commission under Decision (EU) 2021/914
• Adequacy Decision – where the European Commission has determined that a third country provides an adequate level of data protection

All sub-processors with potential third-country access have signed the latest version of the SCCs and provide documentation of additional technical measures.

7. Audit Rights

In accordance with Article 28(3)(h) of the GDPR, the Controller has the right to verify the Processor's compliance with this Agreement.

7.1 Information Requests

The Controller may request the following information at any time:

• Documentation of implemented security measures
• List of authorized personnel with access to personal data
• Current list of sub-processors and their locations
• Copies of certifications and compliance reports

The Processor shall respond to information requests within fourteen (14) business days.

7.2 SaaS Audit Limitations

8. Controller Obligations

The Controller acknowledges and agrees to the following obligations under this Agreement and applicable data protection law:

8.1 Lawfulness of Processing

• The Controller warrants that it has a valid legal basis (e.g., legitimate interest, contract, consent) for all personal data provided to the Processor
• The Controller is solely responsible for obtaining any required consent from workers for attendance tracking and geolocation validation
• The Controller shall not upload or process any special categories of data (Article 9 GDPR) through the Platform

8.2 Transparency Obligations

• The Controller shall provide adequate privacy notices to data subjects (workers) before their data is processed through the Platform
• Such notices shall identify the Processor (DALINA GROUP EOOD / Helionix) as a sub-processor and describe the categories of data processed

8.3 Data Accuracy

The Controller is responsible for ensuring the accuracy and completeness of all personal data entered into the Platform. The Processor shall not be liable for any errors, omissions, or inaccuracies in the data provided by the Controller.

8.4 Instructions

The Controller's documented instructions to the Processor are deemed to be the standard use of the Platform as described in the Terms of Service. Any additional or non-standard processing instructions must be provided in writing and may be subject to additional fees.

9. Termination and Data Deletion

9.4 Statutory Retention Exceptions

10. Assistance with Data Subject Rights

In accordance with Article 28(3)(e) of the GDPR, the Processor shall assist the Controller in fulfilling its obligation to respond to requests from data subjects exercising their rights under Chapter III of the GDPR.

10.1 Supported Rights

10.2 Response Timeline

• The Controller is solely responsible for responding to data subject requests within the statutory 30-day period (Article 12(3) GDPR)
• The Processor shall provide technical assistance within 5 business days of receiving a written request from the Controller
• Requests from data subjects received directly by the Processor shall be forwarded to the Controller within 48 hours

10.3 Limitation of Liability

11. Governing Law and Jurisdiction

11.1 Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the Republic of Bulgaria, without regard to its conflict of law provisions. The GDPR (Regulation (EU) 2016/679) and the Bulgarian Personal Data Protection Act shall apply to all matters of data protection.

11.2 Supervisory Authority

11.3 Dispute Resolution

• The parties shall attempt to resolve any disputes arising from this Agreement through good-faith negotiations
• If negotiations fail, either party may submit the dispute to the competent courts in Sofia, Bulgaria
• For data protection matters, the data subject may also lodge a complaint with the supervisory authority in their country of residence

11.4 Limitation of Liability

Except in cases of gross negligence or intentional misconduct, the Processor's total liability under this Agreement shall not exceed the total fees paid by the Controller in the twelve (12) months preceding the claim. This limitation does not affect any mandatory statutory liability under the GDPR.

12. Electronic Acceptance

This Agreement is concluded electronically through the platform. The Processor's system maintains a record of:

• Timestamp of acceptance (UTC)
• IP address of the accepting party
• User agent (browser information)
• DPA version number
• Controller organization data

Electronic acceptance shall have the same legal validity and evidentiary value as a handwritten signature, in accordance with the Bulgarian Electronic Document and Electronic Certification Services Act (ЗЕДЕУУ) and Regulation (EU) No 910/2014 on electronic identification and trust services (eIDAS).