Terms & ConditionsLicense TermsSupport TermsConsulting TermsDPADPA – License ManagementPrivacy Policy

Galeyo Data Processing Agreement

Last updated: October 30, 2026Download PDF
Background and Interpretation
1.1
In order to fulfil the agreement regarding Galeyo’s provision of any and all products, licenses and services (the “Agreement”), Galeyo may, when providing such products, licenses and services, process certain personal data for which the Customer is the controller, in the capacity of the Customer’s processor.
1.2
This data processing agreement (the “DPA”) forms an integrated part of the Agreement. This DPA is intended to ensure a secure, correct and legal processing of personal data, to comply with applicable requirements for data processing agreements, and to satisfy the requirements of Article 28 of the General Data Protection Regulation and applicable data protection laws, including the laws of Bosnia and Herzegovina.
1.3
Any terms used in this DPA, e.g. “controller”, “data subject”, “personal data”, “processing”, “processor”, and “supervisory authority”, shall have the meaning as stated in the GDPR. This DPA applies exclusively to processing where Galeyo acts as a processor. To the extent Galeyo independently determines the purposes and means of processing, Galeyo shall act as an independent controller. In addition, the definitions used in the Agreement shall have the same meaning in this DPA unless otherwise is expressly stated or indicated by the circumstances.
1.4
The GDPR and a supervisory authority's binding decisions, recommendations and guidelines, practices in the field of data protection, supplementary local adaptation and legislation (including Bosnia and Herzegovina law) as well as sector-specific legislation in relation to data protection are collectively referred to as the “Data Protection Rules”.
Responsibility and Instruction
2.1
The type of personal data and the categories of data subjects processed by Galeyo under this DPA and the purpose, nature, duration and objects of this processing, are described in the instructions on processing of personal data (see Appendix 1 A and 1 B). Customer shall ensure that Galeyo is not able to process additional categories of personal data or personal data in relation to other data subjects than those specified in Appendix 1B and 1A.
2.2
Customer is responsible for complying with the Data Protection Rules. Customer is solely responsible for ensuring that:
a) processing of personal data is lawful;
b) appropriate legal basis exists;
c) data subjects are informed in accordance with Articles 13 and 14 GDPR;
d) data minimisation principles are respected;
e) no unlawful or excessive personal data is transferred to Galeyo.
Customer represents and warrants that it has obtained all necessary rights, consents and authorisations required for the processing.
2.3
When processing personal data, Galeyo shall:
a) process personal data only on documented instructions from Customer or as required by law;
b) not be obliged to independently verify the legality of Customer’s instructions;
c) be entitled to rely on the completeness and accuracy of Customer’s instructions;
d) ensure confidentiality of authorised personnel;
e) implement security measures in accordance with Clause 3;
f) assist Customer subject to technical feasibility and reasonable compensation;
g) make information available subject to reasonable scope and without undue burden on Galeyo’s operations.
2.4
If, in Galeyo’s reasonable opinion, an instruction infringes Data Protection Rules or exposes Galeyo to legal, technical or reputational risk, Galeyo may, without liability: suspend execution; request modification; implement alternative measures; or terminate the affected processing.
Security
3.1
Galeyo shall implement technical and organisational security measures in order to protect the personal data against destruction, alteration, unauthorised disclosure and unauthorised access. Galeyo retains sole discretion to determine, implement and update such measures, provided that the level of protection is not materially reduced.
3.2
Galeyo shall notify Customer of any personal data breach without undue delay. Such notification shall not constitute admission of liability or fault.
3.3
Customer acknowledges that no system is completely secure and that residual risks remain inherent in all data processing.
3.4
If Customer requires additional measures, such measures shall be implemented only where technically feasible and subject to Customer bearing all associated costs.
3.5
Galeyo implements modern security standards including:
• encrypted data transmission
• access controls and authentication
• backups and audits
• employee awareness
Sub-processors and Transfers to Third Countries
4.1
Customer hereby grants Galeyo with a general authorisation to engage Sub-processors.
4.2
Galeyo shall ensure that Sub-processors are bound by obligations equivalent to those in this DPA.
4.3
Customer may object to a Sub-processor only where a substantiated and material data protection risk exists. If such objection prevents service delivery, Galeyo may suspend services or terminate the Agreement without liability. Galeyo shall inform the Customer of any intended addition or replacement of Sub-processors at least thirty (30) days in advance, giving the Customer the opportunity to object.
4.4
Customer acknowledges that Galeyo operates from Bosnia and Herzegovina (a third country under GDPR).
4.5
Where required, international transfers shall be subject to appropriate safeguards, including Standard Contractual Clauses.
4.6
To the maximum extent permitted by law, Customer is responsible for assessing the legality of such transfers, including conducting any transfer impact assessments.
4.7
Galeyo shall implement reasonable supplementary safeguards taking into account the nature of data, technical feasibility and risk level.
4.8
Customer acknowledges that certain risks related to international transfers cannot be fully eliminated.
Limitation of Liability
5.1
The Customer shall indemnify Galeyo against all claims, costs, damages and administrative fines to the extent they arise from the Customer’s breach of the Data Protection Rules or from the Customer’s unlawful instructions.
5.2
Galeyo shall compensate Customer only for direct damages resulting from its own breach, subject to the limitations set out in the Agreement.
5.3
Under no circumstances shall Galeyo be liable for:
• indirect or consequential damages
• loss of profit, revenue or business
• reputational damage
5.4
Nothing in this DPA shall expand Galeyo’s liability beyond mandatory legal requirements under applicable law, including the Law on Protection of Personal Data in Bosnia and Herzegovina.
Term and Termination
6.1
This DPA enters into force when the Agreement enters into force.
6.2
Galeyo shall delete or return personal data at Customer’s request. In absence of instructions, Galeyo may delete personal data at its discretion. Backup copies may be retained temporarily. Fully anonymised data may be retained indefinitely.
6.3
For the avoidance of doubt, Galeyo may continue to store and analyse or otherwise handle data on an aggregated level (not containing any personal data) after termination of the Agreement.
6.4
This DPA remains in force as long as Galeyo processes personal data on behalf of Customer, including the deletion or returning of personal data according to Clause 6.2 above. This DPA shall thereafter cease to apply.
6.5
Clauses that by their nature continues to apply after this DPA has been terminated shall continue to apply even after this DPA has been terminated, e.g. Clause 5.
Changes
7.1
Galeyo is at any time entitled to change the DPA by publishing a new version of the DPA on Galeyo’s website or by otherwise communicating the updated version to the Customer. Galeyo may amend this DPA with two (2) months’ written notice to the Customer, in accordance with Clause 11.4 of the GT&C. Continued use of services constitutes acceptance of the updated DPA.
Miscellaneous
8.1
In the event of deviating provisions between the Agreement and this DPA, the provisions of this DPA shall prevail with regard to processing of personal data and nothing in the Agreement shall be deemed to restrict or modify obligations set out in this DPA, notwithstanding anything to the contrary in the Agreement, except for the limitations of liability set out in the Agreement, which shall apply to this DPA.
8.2
Unless explicitly stated, Galeyo is not entitled to any compensation for performance of the obligations related to processing of personal data under this DPA, except for such work and costs that arise due to Customer’s instructions or audits that entail additional work for Galeyo compared with what otherwise follows from the Agreement, for example, requiring Galeyo to change its working methods or make customised adaptions on behalf of Customer. In such case, Galeyo’s from time to time applicable standard fees and prices shall apply.
8.3
This DPA supersedes and replaces all data processing agreements between the Parties potentially existing prior to this DPA, except for the general DPA for user and license management services, which shall continue to apply to the services it covers.
8.4
If a Party assigns the Agreement (according to the terms of the Agreement), this DPA shall also be deemed assigned to the assignee of the Agreement. No Party shall assign this DPA separately from the Agreement.
8.5
Bosnian law, except its choice-of-law provisions, shall apply to this DPA in all regards. Any disputes arising out of or in connection with this DPA shall be resolved in accordance with the dispute settlement provision of the Agreement.
Appendix 1A – Instructions on processing of personal data in the context of Galeyo products
Subject matter and duration: Personal data processed on behalf of the Customer (i) when Galeyo hosts a product as a cloud service, and (ii) when Galeyo accesses the Customer’s own installation of a product for support or maintenance at the Customer’s request. Where the Customer installs and runs a product in its own IT environment, Galeyo does not otherwise process personal data on the Customer’s behalf. The processing lasts for the term of the Agreement and until deletion or return under Clause 6.2. Technical information processed by Galeyo as a controller under Clause 9.1 of the License Terms is not covered by this DPA.
Purpose: Solely to provide the products, licenses and services ordered by the Customer and to fulfil Galeyo’s obligations under the Agreement.
Types of personal data: Name, business contact details, job title and company of users; user account, access-right and authentication data; log data (log-in times, activity logs, IP address) to the extent necessary for operation and security of hosted products; and personal data contained in content that the Customer uploads to hosted products or that Galeyo accesses during support. Special categories of personal data, data on criminal convictions and offences, and the unique master citizen number (JMBG) shall not be provided to Galeyo unless expressly agreed in writing.
Categories of data subjects: The Customer’s employees, contractors and other authorised users, and the Customer’s business contacts whose data is contained in the Customer’s content.
Retention time: For hosted products: for the term of the Agreement; thereafter deleted or returned in accordance with Clause 6.2, or earlier upon the Customer’s written instruction. Backup copies are deleted within ninety (90) days. For support of products installed by the Customer: personal data is accessed only during the support session and is not copied or stored by Galeyo.
Processing operations: Hosting and storage of hosted products, as well as installation, configuration, updating, support, troubleshooting, backup and deletion, as necessary to provide the services.
Appendix 1B – Instructions on processing of personal data in the context of Galeyo consulting services
Subject matter and duration: Personal data to which Galeyo gains access in the Customer’s IT environment when performing Consulting Services, for the duration of each assignment.
Purpose: Solely to perform the Consulting Services ordered by the Customer. Galeyo accesses only the personal data necessary for the specific assignment.
Types of personal data: Personal data contained in the Customer’s systems, databases and files to which Galeyo is given access, typically names, business contact details, user account data and business records containing personal data. Special categories of personal data, data on criminal convictions and offences, and the unique master citizen number (JMBG) shall not be provided to Galeyo unless expressly agreed in writing.
Categories of data subjects: The Customer’s employees, contractors and users of its systems, and the Customer’s business contacts whose data is contained in those systems.
Retention time: Galeyo performs the Consulting Services exclusively in the Customer’s IT environment, on site or by remote access, and does not copy or store personal data in its own IT environment. Galeyo’s access ends upon completion of the assignment.
Processing operations: Access, consultation, use, adaptation, data migration and testing within the Customer’s systems, as necessary for development, installation, configuration, integration, support and training.
Location and Sub-processors: Personal data remains in the Customer’s IT environment and is accessed on site or remotely from Bosnia and Herzegovina. No Sub-processors are engaged unless notified in accordance with Clause 4.