Data processing agreement

Last updated: [DATE]

Annex to the Contract between the Client and Magus Group Albania SHPK (SHPK, i.e. LTD), trading as Albmania (NIPT L92228018L, Linzë, Bldg. 30, Entr. 31, Apt. 52, Dajti, 1040 Tirana; the “Agency”), under the General terms of service.

This agreement (the “DPA”) applies whenever the Agency processes personal data on behalf of the Client in providing the Services. The Client is the controller and the Agency the processor. It sets out the terms required by Article 26 of Albanian Law No. 124/2024 “On personal data protection” and, where the processing falls under it, by Article 28 of Regulation (EU) 2016/679 (GDPR).

Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meaning given in Article 5 of Law No. 124/2024 and Article 4 GDPR. “Data Protection Law” means Law No. 124/2024 and, where it applies to the processing, the GDPR and the national laws that supplement it (for example the Italian Privacy Code). “Sub-processor” means another processor engaged by the Agency to carry out processing on behalf of the Client. Other capitalised terms have the meaning given in the General terms of service.

The Agency processes personal data only as needed to provide the Services described in the Contract. The DPA lasts as long as the Agency processes personal data for the Client and ends once the data has been returned or deleted under section 11.

Depending on the Services ordered, the processing consists of:

• hosting the Client’s sites, applications, databases and mailboxes, and storing their files;

• making and storing backups and restoring them on request;

• developing, testing and deploying sites and applications, including migrating existing data;

• maintenance and support, including access to systems to diagnose and fix problems;

• managing domains and DNS records;

• installing and configuring analytics, advertising and consent tools on the Client’s instructions;

• integrating payment services, where the Agency processes order and transaction data but never full card numbers, which are entered only on the payment processor’s pages.

The Agency processes the data only for these purposes and not for its own purposes.

The data subjects and categories of data depend on the Client’s sites and applications and are described for each project in Annex 1. Typically they are:

• data subjects: visitors and users of the Client’s sites and apps, its customers and prospects, newsletter subscribers, job applicants, and the Client’s staff and contacts;

• personal data: identification and contact data, account data (with passwords stored only as hashes), orders and transactions (without full card data), messages and form submissions, content uploaded by users, and technical data (IP addresses, logs, device and browser data, cookie identifiers).

Special categories of data (for example health data in solutions for dental clinics) or data on criminal convictions are processed only if Annex 1 says so and with the additional measures agreed there.

The Client:

• ensures that the processing it instructs is lawful, that it has a valid legal basis, and that data subjects are properly informed, including through the privacy and cookie notices of its sites;

• gives its instructions in writing (the Contract, this DPA and tickets or emails from its authorised contacts are documented instructions);

• tells the Agency in advance if it will process special categories of data or data of children;

• remains responsible for the configuration of consent on its sites, unless the Offer includes it as a service.

The Agency:

1. processes the personal data only on the Client’s documented instructions, including for transfers to other countries, unless the law it is subject to requires otherwise; in that case it informs the Client before processing, unless the law prohibits it. It informs the Client immediately if, in its opinion, an instruction infringes Data Protection Law;

2. ensures that the people authorised to process the data are bound by confidentiality (Article 30 of Law No. 124/2024) and process it only on instructions;

3. takes the security measures required by Article 28 of Law No. 124/2024 and Article 32 GDPR, described in Annex 2;

4. engages Sub-processors only as set out in section 7;

5. assists the Client, through appropriate technical and organisational measures, in responding to requests from data subjects exercising their rights, and forwards to the Client without delay any request it receives directly, without answering it unless authorised;

6. assists the Client in meeting its obligations on security, breach notification, data protection impact assessments and prior consultation (Articles 28, 29, 31 and 32 of Law No. 124/2024; Articles 32 to 36 GDPR), taking into account the nature of the processing and the information available to it;

7. returns or deletes the data at the end of the Services under section 11;

8. makes available the information needed to demonstrate compliance and allows audits under section 12;

9. keeps a record of the processing it carries out on the Client’s behalf, where required (Article 27(2) of Law No. 124/2024; Article 30(2) GDPR).

• The Client gives the Agency general written authorisation to engage Sub-processors. The current list is in Annex 3.

• The Agency informs the Client of any intended addition or replacement at least [TO CONFIRM: 30] days in advance [TO CONFIRM: notice channel, e.g. email to the Client's contact or a sub-processor page with subscription]. The Client may object within [TO CONFIRM: 14] days on reasonable grounds relating to data protection. If the parties find no solution, the Client may terminate the affected Services without penalty before the change takes effect.

• The Agency imposes on each Sub-processor, by contract, the same data protection obligations as in this DPA, and remains fully responsible to the Client for the Sub-processor’s performance (Article 26(4) of Law No. 124/2024; Article 28(4) GDPR).

• The Agency transfers personal data outside Albania and the European Economic Area only in accordance with Chapter IV of Law No. 124/2024 (Articles 39 to 42) and, where it applies, Chapter V GDPR.

• Clients in the EU/EEA. The Agency is established in Albania, for which there is no adequacy decision of the European Commission. Even when the data is hosted on servers in the EU, access to it by the Agency’s staff from Albania is a transfer. For these Clients the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), apply as set out in Annex 4, together with a transfer impact assessment [TO CONFIRM: transfer impact assessment for Albania to be prepared and attached].

• Onward transfers to Sub-processors outside the EEA rely on an adequacy decision (for the United States, the EU–US Data Privacy Framework for certified companies, recognised also by the Albanian Commissioner’s Decision No. 1 of 30 April 2025) or on standard contractual clauses, as shown in Annex 3.

• The Agency notifies the Client without undue delay, and in any case within [TO CONFIRM: 24 or 48] hours, after becoming aware of a personal data breach affecting the Client’s data (Article 29(2) of Law No. 124/2024 requires the processor to notify the controller immediately; Article 33(2) GDPR).

• The notification describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information not yet available is provided in phases as soon as possible.

• The Agency takes the measures needed to contain the breach and mitigate its effects, documents it, and helps the Client meet its obligation to notify the Commissioner within 72 hours (Article 29(1) of Law No. 124/2024; Article 33 GDPR) and, where required, the data subjects.

• The Agency does not notify authorities or data subjects on the Client’s behalf unless the Client asks it to or the law requires it.

Where the Client must carry out an impact assessment or consult the supervisory authority, the Agency provides the information about the Services and their security that the Client reasonably needs [TO CONFIRM: whether this assistance is free or charged at the rates in the Offer]. Under Albanian law, Articles 31 and 32 of Law No. 124/2024 apply from 17 January 2027.

• At the end of the Services the Client chooses whether the Agency returns or deletes the personal data. The Agency makes it available for export for [TO CONFIRM: 30] days in common formats (for example a database dump and the files).

• The Agency then deletes the data from its live systems within [TO CONFIRM: 30] days. Copies in encrypted backups expire as backups are replaced, within [TO CONFIRM: backup rotation period], and are not restored in the meantime except at the Client’s request.

• The Agency keeps data only where the law requires it, and confirms the deletion in writing on request.

• The Agency makes available to the Client the information needed to demonstrate compliance with this DPA.

• The Client, or an independent auditor bound by confidentiality and not a competitor of the Agency, may audit compliance [TO CONFIRM: once a year], with at least 30 days’ notice, during working hours, without disrupting the services or giving access to other clients’ data. Audits required by a supervisory authority or following a breach are not subject to the annual limit.

• The Client bears the costs of the audit, unless it reveals a material breach of this DPA by the Agency. Where possible, the Agency may answer with existing certifications or reports, including those of its Sub-processors.

Each party is liable for its own breaches of this DPA and of Data Protection Law. Liability between the parties is subject to the limitations in the General terms of service [TO VERIFY: whether the general liability cap should apply to data protection claims]. Nothing in this DPA limits the rights of data subjects to compensation (Article 88 of Law No. 124/2024; Article 82 GDPR).

• On data protection matters this DPA prevails over the other parts of the Contract. Where Annex 4 applies, the standard contractual clauses prevail over this DPA.

• This DPA is governed by the law that governs the Contract, except for Annex 4, which is governed as stated in it.

To be completed for each project or service.

[TO CONFIRM: each measure below as it applies to client hosting, not only to the agency's own website]

Encryption

• TLS (HTTPS) for all sites, admin panels and APIs; encrypted channels (SSH/SFTP) for server administration.

• Backups encrypted with AES-256 before they leave the server.

• Secrets, API keys and credentials stored encrypted in application settings; passwords stored only as hashes.

• Disk encryption at rest [TO CONFIRM].

Access control

• Staff sign in to the Agency’s systems through Magus ID, the company’s own identity service, with two-step verification.

• Role-based permissions and least privilege; access to a Client’s systems only for staff working on them; access removed promptly when no longer needed.

• Administrator panels reachable only on designated hosts; SSH access by key [TO CONFIRM].

Logging and monitoring

• Audit log of administrative actions; server and application logs retained for [TO CONFIRM].

• Error monitoring (Sentry) configured not to send personal data by default.

• Uptime and performance monitoring with alerts.

Availability and resilience

• Backups [TO CONFIRM: frequency] to storage in Europe, separate from the production servers (see Annex 3).

• Regular restore tests [TO CONFIRM: frequency].

• Containerised deployments (Docker/Coolify) with zero-downtime releases and the ability to roll back.

Application and network security

• Security headers and a content security policy; protection against cross-site request forgery; rate limiting and Cloudflare Turnstile on public forms; validation of uploads and sanitisation of SVG files.

• Dependency audits in continuous integration and timely security updates of server software [TO CONFIRM: patch cadence].

• Firewall and DDoS protection [TO CONFIRM: Cloudflare proxy or provider firewall]; separation of client environments [TO CONFIRM].

Organisation

• Confidentiality obligations for all staff and contractors.

• Incident response procedure, including breach notification under section 9.

• No production personal data in development or testing unless necessary and agreed with the Client [TO CONFIRM].

• Card data never stored by the Agency; card payments only on the payment processor’s hosted pages.

No AI provider receives personal data of the Client’s data subjects: we do not use personal data to feed AI tools.

The standard contractual clauses of Commission Implementing Decision (EU) 2021/914, Module Two, are incorporated by reference, with these choices:

• Clause 7 (docking clause): [TO CONFIRM: included or not].

• Clause 9(a): option 2, general written authorisation, with the notice period in section 7.

• Clause 11(a): the optional redress mechanism is [TO CONFIRM: not used].

• Clause 13: the supervisory authority of the Member State where the Client is established (for Clients in Italy, the Garante per la protezione dei dati personali) [TO VERIFY].

• Clause 17: governed by the law of [TO CONFIRM: an EU Member State, e.g. Italy or Ireland].

• Clause 18: the courts of [TO CONFIRM: the same Member State].

• Annex I.A: the parties as in the Contract; Annex I.B: Annex 1 of this DPA; Annex I.C: the authority under Clause 13; Annex II: Annex 2; Annex III: Annex 3.

• Transfer impact assessment for Albania: [TO CONFIRM: to be prepared and attached].