HEVU – Data processing agreement
Provider: Cahut Patricio Egyéni vállalkozó · 7624 Pécs, Mogyorós köz 6., Hungary · info@hevu.eu
https://hevu.eu/imprint.php?lang=en
This document originates in Hungarian; translations may differ. The Hungarian text governs interpretation, without reducing mandatory consumer rights or protections arising from information supplied at purchase and applicable language requirements. Magyar
1. Parties, scope and duration
The subscribing business is controller; the HEVU provider identified in the Legal Notice is processor for personal data HEVU handles online on the subscriber's behalf. Files that remain solely local and never reach the provider do not by themselves constitute remote processing. This agreement applies during the service contract and any necessary return or deletion period.
2. Data and operations
Data subjects are staff, customers, contacts and partners of the subscriber. Data include names, business contact details, customer and quotation identifiers, addresses or sites, quotation and technical content, necessary messages and attachments. Operations include receiving, transmitting, storing as needed for the selected online feature, organising, calculating, translating, displaying, backing up and deleting. Special-category data and official identity documents are outside the intended purpose.
3. Instructions and confidentiality
HEVU acts only on documented instructions within the selected feature and contract. Where law requires processing, it informs the controller beforehand unless prohibited. It flags instructions it considers unlawful. Access is limited to people who need it for their duties and are bound to confidentiality. The controller remains responsible for a lawful collection basis and informing data subjects.
4. Security
The parties use measures appropriate to risk: encrypted transport, access permissions, account and secret protection, logging, recovery and regular checks. The local workspace is encrypted; the subscriber protects its device, credentials and backups. The provider remains responsible for its own systems' security and cannot transfer that responsibility entirely to the customer.
5. Sub-processors
The controller gives general authorisation for disclosed sub-processors necessary for the features used. Identified infrastructure providers are Rackhost Zrt. (web hosting, Hungary) and Supabase (authentication and related database, eu-west-1, Ireland). Any actual translation provider and other sub-processors must be named in the current provider list before data are sent to them. Additions or replacements require written notice at least 15 days beforehand and an opportunity for a justified data-protection objection. Equivalent obligations must be imposed; HEVU remains responsible for its sub-processor's compliance. Paddle, acting as an independent controller, is not a sub-processor in that capacity.
6. Assistance and incidents
HEVU assists as reasonably necessary under GDPR with data-subject requests, impact assessments, regulatory consultation and Articles 32–36 obligations. It notifies the controller of a personal-data breach without undue delay after becoming aware, supplies available material information, supplements it and cooperates in mitigation. The controller responsible under law decides on notifications to authorities and individuals.
7. End of service and audit
When processing ends, personal data and copies must be returned or deleted at the controller's choice, except legally required retention. Backups expire securely on the documented cycle; isolated retained data are not used for other purposes. HEVU provides information needed to demonstrate compliance and permits lawful audits by the controller or a confidentially bound auditor. Scheduling arrangements must not obstruct urgent regulatory or incident-related checks.
8. Transfers and priority
Transfers outside the EEA require documented instructions and a GDPR Chapter V basis, such as a valid adequacy decision or appropriate contractual safeguards. This agreement prevails over general service terms for processing matters. It does not exclude GDPR data-subject claims, regulatory powers or legally non-limitable liability. Contact: info@hevu.eu.
This document originates in Hungarian; translations may differ. The Hungarian text governs interpretation, without reducing mandatory consumer rights or protections arising from information supplied at purchase and applicable language requirements.