This agreement forms part of the Terms of service between the customer (controller) and [Ime in priimek] s.p., GudWeb, [Ulica in hišna številka], [poštna številka in kraj], Slovenija (processor), under Article 28 GDPR. Version: 2026-10-01.
1. Subject, nature and purpose
The processor stores and processes personal data of buyers who use the configurator, send inquiries or accept quotes, and of the controller's users, solely to provide the Configli service.
2. Data subjects and categories
- Data subjects: the controller's buyers and prospects, staff and contractors (users, installers).
- Data: name, email, phone, address or town, message, configuration and price, IP address, device type, photos and signatures on work orders.
- No special categories of personal data.
3. Duration
For the subscription term. Afterwards the processor returns (export) or deletes the data within 60 days unless retention is required by law.
4. Processor obligations
- process only on documented instructions (this agreement and dashboard settings),
- bind authorised persons to confidentiality,
- apply the measures in Annex 2,
- assist with data subject requests, impact assessments and authority consultations,
- notify personal data breaches without undue delay and within 48 hours of becoming aware,
- keep records of processing and support audits.
5. Sub-processors
The controller authorises the sub-processors in Annex 1. Changes are notified at least 30 days in advance; the controller may object and terminate.
6. Transfers
Data is stored in the EU. Transfers outside the EEA only with Chapter V GDPR safeguards.
Annex 1: Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Server and database hosting (e.g. Hetzner Online GmbH) | hosting of application, database and files | EU (Germany or Finland) |
| Email delivery (e.g. Sendinblue SAS, Brevo) | notifications and confirmations | EU (France) |
| Stripe Payments Europe Ltd. | subscription payments (customer data only) | EU (Ireland) |
Annex 2: Technical and organisational measures
- encryption in transit (TLS 1.2+), HSTS, security headers,
- tenant isolation in every query, roles and least privilege,
- Argon2id password hashing; HttpOnly sessions stored hashed,
- rate limiting, CSRF protection, input validation, safe file uploads,
- daily EU backups kept 14 days with tested restores,
- audit log of admin actions; production access for authorised persons with two-factor sign-in,
- regular dependency updates and vulnerability scanning,
- one-click GDPR erasure of buyer data in the dashboard.
