This Data Processing Agreement ("DPA") is entered into between:
The Processor agrees to process personal data on behalf of the Controller in connection with the Services described in the Master Agreement / Terms of Service. The Parties agree to comply with Art. 28 GDPR and other applicable data protection laws.
The Processor will process personal data solely for:
• Provision of Hazelbit certificates and NFT Services.
• Customer account creation, authentication, wallet access.
• Transaction processing and blockchain notarization.
• Communication and customer support.
• Security, anti-fraud and compliance (incl. AML/KYC if required).
No other processing is permitted unless documented by the Controller.
• Customers (individuals purchasing trees/NFTs).
• Employees or representatives of corporate customers.
• Website and app users.
Note: Special categories of data (sensitive data) are not expected to be processed.
The Processor shall:
• Process personal data only on documented instructions from the Controller.
• Ensure confidentiality by binding staff with data protection obligations.
• Implement appropriate technical and organizational security measures.
• Assist the Controller with data subject requests (access, deletion, portability).
• Assist the Controller with DPIAs and consultations with authorities if required.
• Notify the Controller of any personal data breach without undue delay.
• Maintain records of processing activities.
• Make available information to demonstrate compliance.
The Controller shall:
• Ensure that the processing instructions comply with applicable law.
• Provide lawful basis for processing under GDPR (Art. 6).
• Inform and obtain valid consents from data subjects where necessary.
• Not instruct the Processor to process special categories of data unless explicitly agreed.
The Processor may engage sub-processors for hosting, storage, payments, analytics, blockchain and related services. Current sub-processors include:
Hosting, EU region
CDN, security
Payments
Blockchain notarization
Email CRM
The Processor will notify the Controller of any intended changes to sub-processors and give the Controller the right to object.
Where data is transferred outside the EEA, Processor will ensure safeguards:
• Adequacy decision (e.g., UK, Switzerland).
• Standard Contractual Clauses (SCCs).
• Supplementary technical measures (encryption, access controls).
Upon termination of the Services, the Processor shall, at Controller's choice:
• Return all personal data, or
• Delete personal data, except where retention is required by law.
Important: Blockchain data (transaction IDs, wallet addresses) may remain permanently recorded on chain and cannot be erased; this limitation will be disclosed to data subjects.
The Controller may audit Processor's compliance once per year, with reasonable notice and during business hours. The Processor may provide certifications or third-party audit reports (e.g., ISO, SOC 2) in lieu of onsite audit.
Each Party remains responsible for its own compliance under GDPR. Liability follows the terms of the Master Agreement.
This DPA is governed by Romanian law and applicable EU data protection law.
Disputes shall be subject to the competent courts of Iași, Romania, unless mandatory consumer/jurisdiction law applies.