1. Parties and application
This standard addendum is for a business customer (“Customer”) appointing MB “Kryptingi projektai” (“KP”, “we”) to process personal data on its behalf under the GDPR. KP's details: company code 304844804; VAT code LT100013832013; Taikos g. 150-30, LT-05227 Vilnius, Lithuania; s@1d.works.
It forms part of a service agreement only when the parties accept its incorporation and the service-specific Processing Schedule described in section 11. Publishing this page does not identify a Customer, complete that schedule or establish agreement by a merchant. A separately accepted DPA may replace this standard.
The Customer is the controller and KP is its processor for the processing covered here. If the Customer itself acts for another controller, it must have authority to appoint KP as a subprocessor and give the relevant instructions. KP's independent controller activities, such as its own contracting and billing, are explained in the Privacy Policy. A provider acting as an independent controller is not made a subprocessor merely because it is connected to an app.
2. Scope and documented instructions
The accepted Schedule defines the processing's subject matter, duration, operations, purposes, personal-data types and categories of people. The Customer determines lawful purposes, provides required notices, establishes an appropriate legal basis and gives lawful instructions. It must identify any sensitive, criminal-offence or children's data and the necessary safeguards in the Schedule rather than assume that every service supports them.
KP processes covered data only on documented Customer instructions, including instructions about transfers, unless Union or Member State law requires otherwise. In that case we inform the Customer of the legal requirement before processing unless the law prohibits this on important public-interest grounds. We immediately tell the Customer if, in our opinion, an instruction infringes applicable data-protection law and do not carry out unlawful instructions.
Accepted service functions and written support requests can provide instructions within the Schedule. We do not reuse covered content for our own AI training or unrelated marketing without separate documented authorisation and a lawful basis; this DPA is not such authorisation.
3. Confidentiality and security
We restrict access to authorised people who need it for the service and are bound by confidentiality or an appropriate statutory duty. They process data only as authorised. These protections continue while we hold the data and for any longer period required by law.
KP implements the technical and organisational measures required by GDPR Article 32, appropriate to the processing and risks. These address confidentiality, integrity, availability, resilience, recovery and assessment of effectiveness, including encryption or pseudonymisation where appropriate. The Schedule documents the actual service-specific measures and any agreed certifications or response and recovery commitments.
4. Subprocessors
The Customer gives general written authorisation for subprocessors disclosed in the accepted Schedule, subject to this section. Before processing begins, KP supplies the relevant provider identities, processing functions, locations and transfer arrangements. We give at least 30 days' advance notice of an intended addition or replacement, allowing the Customer to object on reasonable data-protection grounds before the change.
We discuss a timely objection and seek a reasonable solution. If it cannot be resolved, either party may end the affected service and KP refunds unused prepaid fees for that service. We impose equivalent applicable data-protection obligations on each subprocessor by contract and remain responsible to the Customer for its performance as required by GDPR Article 28(4).
5. Rights and compliance assistance
Taking account of the processing and information available to us, KP assists the Customer with data-subject requests through appropriate technical and organisational measures insofar as possible, and with its obligations under GDPR Articles 32–36, including security, breach notifications, impact assessments and prior consultation. We forward relevant requests received directly and respond on the Customer's behalf only when authorised or legally required.
6. Personal data breaches
KP notifies the Customer without undue delay after becoming aware of a personal data breach affecting covered data. We provide available information about its nature, affected data and people, including categories and approximate counts where known, likely consequences, mitigation and a contact for follow-up. Further information follows without undue delay as it becomes available. We cooperate with investigation and remedial action so the Customer can meet its own notification duties. The Schedule identifies the operational incident contacts.
7. International transfers
Transfers requiring GDPR Chapter V safeguards occur only on documented instructions and with a valid legal mechanism, such as an applicable adequacy decision or appropriate safeguards, including the correct transfer clauses and supplementary measures where needed. The Schedule records the actual processing locations and transfer arrangements. This addendum alone does not constitute international-transfer standard contractual clauses.
8. Information and audits
KP provides the information necessary to demonstrate compliance with these processing obligations and allows and contributes to audits, including inspections, by the Customer or its appointed auditor. The parties arrange audits reasonably to protect security, confidentiality and other customers' data, without preventing effective verification or limiting a competent authority's powers. We maintain records and cooperate with supervisory authorities as applicable law requires.
9. Return, deletion and retention
When processing services end, the Customer chooses return or deletion of covered personal data; KP deletes remaining copies unless Union or Member State law requires retention. The Schedule records the return method, deletion arrangements and any legally required retention. Requests and instructions may be sent to our contact email.
Any residual backup handling must be documented for the service, with restricted use, protection and an erasure schedule. Restoring a backup must not permanently undo an applicable deletion instruction. There is no universal deletion, export or backup deadline in this standard. These processing protections continue for data retained until it is returned or deleted as required.
10. Relationship with other terms
This addendum prevails over conflicting service terms for the covered processing. Other commercial terms remain subject to mandatory law. Nothing limits data subjects' statutory rights, supervisory powers or liability that applicable law does not permit to be limited. Read the Terms of Service for the wider commercial arrangement. The English and Lithuanian versions are intended to have the same substance.
11. Service-specific Processing Schedule
Before covered processing starts, the accepted order, app-specific details or a separate appendix must identify and record:
- The Customer's legal identity, role, contact and, where relevant, upstream controller and authority; KP's contact; the agreed service and dated DPA version.
- The subject matter, purposes and operations; the processing term and end-of-service handling.
- The categories of people and personal-data types, including any specially protected data, and the limits on permitted processing.
- The documented instructions, technical and organisational security measures, and contacts for rights requests, incidents and further instructions.
- The current subprocessors, their tasks and relevant locations; applicable transfer mechanisms and safeguards.
- The retention criteria or periods, return format and method, deletion process and documented backup handling.
Details must reflect the particular service and be available to and accepted by the parties; a generic public description does not supply missing processing particulars. The governing framework is GDPR Article 28 and other applicable data-protection law.