Data Processing Agreement (DPA)

1. Contracting parties

The data controller is the Client Company — the organization that creates the account and uses the Vecto HR application for human resources management, hereinafter referred to as the Controller.

The processor is APPVECTO S.R.L., CUI 54906519, registered office: Strada Agricultorilor nr. 18, Subsol Tehnic, Spațiu Tehnic 2, 707085 Lunca Cetățuii, Iași, România, which processes personal data exclusively on behalf of and in accordance with the Controller's instructions, within the meaning of Regulation (EU) 2016/679 (GDPR). Contact: contact@appvecto.com, support: contact@appvecto.com.

2. Subject and duration

Processing takes place through the Vecto HR platform, for human resources management: employee records, payroll, time tracking, personnel documents, reports, occupational health and safety (OHS), and related features.

Processing lasts for the active subscription period and, where applicable, for the archiving period required by law or the Controller's documented instructions.

3. Types of data and data subjects

• identification data (first name, last name, national ID/CNP, ID card series and number);
• contact data (address, phone, email);
• banking data (IBAN, bank) for salary transfers;
• professional data (job title, department, salary, seniority, time records);
• medical data only to the extent necessary for OHS (medical clearances, fitness certificates), upon the Controller's instruction;
• data subjects: employees, contractors, authorized users of the Controller.

4. Documented instructions

The Processor processes data only on the basis of the Controller's documented instructions, including through organization configuration in the application, the Terms and Conditions, this DPA, and reasonable written requests.

If the Processor considers that an instruction infringes the GDPR or other data protection provisions, it will inform the Controller without undue delay.

5. Confidentiality

The Processor ensures that persons authorized to process data are bound by confidentiality or are under an appropriate statutory obligation of confidentiality.

6. Technical and organizational measures

• AES-256-GCM encryption for selected sensitive data (e.g. CNP, IBAN) where used in the implementation;
• role-based access control (RBAC) and multi-tenant isolation between organizations;
• authenticated sessions (httpOnly cookies) and CSRF protection;
• audit log for relevant security and compliance actions;
• periodic backups according to the platform's technical configuration.

7. Sub-processors

The Controller generally authorizes use of the sub-processors listed below, with equivalent data protection contractual obligations. The Processor will inform the Controller of material changes to the list through documentation updates or reasonable notice, as applicable.

• Stripe (Stripe Payments Europe Ltd, Ireland; Stripe group, USA) — payment processing and subscription management (Controller billing data only);
• Vercel Inc. (USA) — application hosting; server functions in the Frankfurt region (EU);
• Neon, LLC (Databricks group, USA) — PostgreSQL database in the AWS Frankfurt region (eu-central-1, EU);
• Cloudflare, Inc. (USA) — file storage in Cloudflare R2 with EU jurisdiction (documents, backups);
• Resend (Plus Five Five, Inc., USA) — platform default transactional email delivery through the Ireland (EU) region; delivery logs may be processed in the USA.
• An email provider configured by the Controller (SMTP) may be used for notifications; it is chosen and administered by the Controller.

8. International transfers

Data processed on behalf of the Controller is hosted in the European Union (application: Vercel Frankfurt region; database: AWS Frankfurt; files: Cloudflare R2 with EU jurisdiction; platform email: Resend, Ireland region).

Sub-processors that are US companies may access or process data from outside the European Economic Area for operations, support, security or email delivery logs. Transfers rely on the adequacy decision on the EU–US Data Privacy Framework (Decision (EU) 2023/1795), where the provider is certified, and on the Standard Contractual Clauses (Decision (EU) 2021/914) in the providers' data processing agreements. If the adequacy decision (challenged in case C-703/25 P) ceases to apply, the Standard Contractual Clauses apply. On request, the Processor provides the Controller with information on the safeguards applicable to each sub-processor.

9. Assistance with data subject rights

The Processor provides reasonable assistance to the Controller in fulfilling obligations regarding data subject requests (access, rectification, erasure, etc.), to the extent technically feasible and within the platform's features.

Requests sent directly to the Processor will be redirected to the Controller, unless law or agreement permits a direct response.

10. Security incidents and breaches

The Processor notifies the Controller without undue delay and in any event within 48 hours after becoming aware of a personal data breach affecting data processed on behalf of the Controller, with the information available at that time (nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed), supplemented as it becomes available, to enable the Controller to meet its obligations under GDPR Articles 33 and 34.

11. Deletion, return, and export

Upon termination of the contract or at the Controller's documented request, the Processor deletes or returns data according to instructions, except categories under confirmed legal retention, categories for which the obligation to keep data is still under legal review, or categories covered by an active legal obligation to keep the data. On organization closure the 61-day rule below applies.

Eligible temporary and access data may be deleted immediately. On organization closure, the Controller's data is kept restricted, without access, for 61 days from the request and is then deleted permanently and automatically (unless there is an active legal obligation to keep the data). The Controller keeps its own legal archive (for example payroll registers and supporting documents for 5 years from 1 July of the following year, under Accounting Law 82/1991, art. 25); APPVECTO keeps only its own billing records, the subscription invoices and proof of the request, for its own legal duties. Backups expire on their normal cycle.

Backups are not selectively wiped mid-cycle; expiry follows the approved backup policy, and the operational restore procedure (not an automatic function) provides for re-applying the GDPR record of deletions before the application becomes usable.

Article 19 notices to recipients are recorded in the stage record of the existing GDPR request (no duplicate registry). Copies in third-party recipients' mailboxes may be outside technical control — documented as such.

If the Controller does not respond to a request to erase an employee's data, the Processor escalates and keeps the request in the status "waiting for the Controller" or "retained under a legal obligation" — it does not auto-erase HR data.

The Controller may export data through features available in the platform before termination.

12. Audit and cooperation

The Controller may request information necessary to demonstrate GDPR compliance. On-site audits or extended system access are conducted on reasonable terms, with prior notice, taking into account security of other clients and infrastructure.

13. Liability

The parties' liability regarding data protection is governed by the Terms and Conditions and applicable law. Nothing in this DPA limits data subject rights or mandatory obligations under the GDPR.

14. Electronic acceptance

This agreement is accepted electronically by the Controller upon registration in the application, by checking the mandatory DPA acceptance box. The date and user identifier are recorded in the organization's dpaAcceptedAt and dpaAcceptedBy fields.

15. Related documents

For additional details about privacy, terms, and data-subject rights, see Privacy Policy, Terms and conditions and GDPR rights.