In order to fulfil the agreement regarding Galeyo’s provision of any and all products, licenses and services (the “Agreement”), Galeyo may, when providing such products, licenses and services, process certain personal data for which the Customer is the controller, in the capacity of the Customer’s processor.

This data processing agreement (the “DPA”) forms an integrated part of the Agreement and is intended to satisfy a secure, correct and legal processing of personal data and to comply with applicable requirements for data processing agreements as well as to ensure adequate protection for the personal data processed within the scope of the Agreement and the requirements of Article 28 of the General Data Protection Regulation and applicable data protection laws, including the laws of Bosnia and Herzegovina.

Any terms used in this DPA, e.g. “controller”, “data subject”, “personal data”, “processing”, “processor”, and “supervisory authority”, shall have the meaning as stated in the GDPR. The terms “processing” and “personal data” refer exclusively to such processing and such personal data that Galeyo processes on behalf of the Customer in accordance with this DPA. This DPA applies exclusively to processing where Galeyo acts as a processor. To the extent Galeyo independently determines the purposes and means of processing, Galeyo shall act as an independent controller. In addition, the definitions used in the Agreement shall have the same meaning in this DPA unless otherwise is expressly stated or indicated by the circumstances.

The GDPR and a supervisory authority's binding decisions, recommendations and guidelines, practices in the field of data protection, supplementary local adaptation and legislation (including Bosnia and Herzegovina law) as well as sector-specific legislation in relation to data protection are collectively referred to as the “Data Protection Rules”.

The type of personal data and the categories of data subjects processed by Galeyo under this DPA and the purpose, nature, duration and objects of this processing, are described in the instructions on processing of personal data (see Appendix 1). Customer shall ensure that Galeyo is not able to process additional categories of personal data or personal data in relation to other data subjects than those specified in Appendix 1.

Galeyo shall implement technical and organisational security measures in order to protect the personal data against destruction, alteration, unauthorised disclosure and unauthorised access. The measures shall ensure a level of security that is appropriate taking into account the state of the art, the costs of implementation, the nature, scope, context and purpose of the processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons. Galeyo may amend its technical and organisational measures from time to time. Galeyo retains sole discretion to determine, implement and update security measures, provided that the level of protection is not materially reduced.

Galeyo shall notify Customer without undue delay upon becoming aware of a personal data breach. Such notification shall not constitute admission of liability nor confirmation of fault nor it will in any manner imply that Galeyo has committed any wrongful act or omission, or that Galeyo shall become liable for the personal data breach.

Customer acknowledges that no system is completely secure and that residual risks remain inherent in all data processing. If Customer during the term of this DPA requires that Galeyo takes additional security measures, Galeyo shall as far as possible meet such requirements provided that Customer pays and takes responsibility for any and all costs associated with such additional measures.

Galeyo implement modern security standards including: a) Encrypted data transmission b) Access controls and authentication c) Regular backups and audits d) Employee awareness and training

Customer hereby grants Galeyo with a general authorization to engage Sub-processors.

Galeyo shall enter into a data processing agreement with each Sub-processor, according to which, corresponding data protection obligations as set out in this DPA, are imposed upon the Sub-processor.

Galeyo is responsible towards the Customer for Sub-processors’ performance of its undertakings in relation to the Customer. Customer may object to a Sub-processor only where a substantiated and material data protection risk exists. If such objection prevents service delivery, Galeyo may suspend services or terminate the Agreement without liability. Galeyo shall inform the Customer of any intended addition or replacement of Sub-processors at least thirty (30) days in advance, giving the Customer the opportunity to object.

Customer acknowledges that Galeyo operates from Bosnia and Herzegovina, which is considered a third country under the GDPR.

Where required, International transfers shall be subject to appropriate safeguards, including Standard Contractual Clauses.

To the maximum extent permitted by law: Customer is responsible for assessing the legality of transfers; including conducting transfer impact assessments.

Customer acknowledges that certain risks related to international transfers cannot be fully eliminated.

The Customer shall indemnify Galeyo against all claims, costs, damages and administrative fines to the extent they arise from the Customer’s breach of the Data Protection Rules or from the Customer’s unlawful instructions. The Customer is however not responsible according to this Clause 5.1 if the Customer can demonstrate that Galeyo or a Sub-processor is fully responsible for the event, action or omission that caused Galeyo the claim, cost or damage, in which cases, Clause 5.2 shall apply, as applicable.

If Galeyo, a person working under Galeyo’s management or a Sub-processor engaged by Galeyo processes personal data in breach of this DPA or the documented instructions provided by the Customer, Galeyo shall, taking into account the limitations of liability resulting from the Agreement, compensate the Customer for the direct damage which the Customer is caused due to the incorrect processing. Galeyo’s compensation obligations according to this Clause 5.2 apply on the condition that i) the Customer notifies Galeyo in writing without undue delay of the direct damage caused to the Customer or of the claim made against the Customer; and ii) the Customer allows Galeyo to control the defense of the claim and alone decides on any settlement.

Notwithstanding what is stated above in this Clause 5, the liability of each Party is limited in accordance with what is stated in the Agreement and under no circumstances shall a Party be liable for any loss of profits or other indirect damage caused to the other Party. Under no circumstances shall Galeyo be liable for indirect or consequential damages; loss of profit, revenue, or business; reputational damage.

Nothing in this DPA shall expand Galeyo’s liability beyond mandatory legal requirements set in The Law on Protection of Personal Data in Bosnia and Herzegovina.

This DPA enters into force when the Agreement enters into force.

Upon termination of the Agreement, Galeyo shall delete or return the personal data at the Customer’s request. In absence of instructions, Galeyo may delete personal data at its discretion. Backup copies may be retained temporarily in accordance with security policies. Fully anonymized data may be retained indefinitely.

For the avoidance of doubt, Galeyo may continue to store and analyse or otherwise handle data on an aggregated level (not containing any personal data) after termination of the Agreement.

This DPA remains in force as long as Galeyo processes personal data on behalf of Customer, including the deletion or returning of personal data according to Clause 6.2 above. This DPA shall thereafter cease to apply.

Clauses that by their nature continues to apply after this DPA has been terminated shall continue to apply even after this DPA has been terminated, e.g. Clause 5.

Galeyo is at any time entitled to change the DPA by publishing a new version of the DPA on Galeyo’s website or by otherwise communicating the updated version to the Customer. Galeyo may amend this DPA with two (2) months’ written notice to the Customer, in accordance with Clause 11.4 of the GT&C. Continued use of services constitutes acceptance of the updated DPA.

In the event of deviating provisions between the Agreement and this DPA, the provisions of this DPA shall prevail with regard to processing of personal data and nothing in the Agreement shall be deemed to restrict or modify obligations set out in this DPA, notwithstanding anything to the contrary in the Agreement, except for the limitations of liability set out in the Agreement, which shall apply to this DPA.

Unless explicitly stated, Galeyo is not entitled to any compensation for performance of the obligations related to processing of personal data under this DPA, except for such work and costs that arise due to Customer’s instructions or audits that entail additional work for Galeyo compared with what otherwise follows from the Agreement, for example, requiring Galeyo to change its working methods or make customised adaptions on behalf of Customer. In such case, Galeyo’s from time to time applicable standard fees and prices shall apply.

This DPA supersedes and replaces all data processing agreements between the Parties potentially existing prior to this DPA, except the general DPA, which shall continue to apply to the services it covers.

If a Party assigns the Agreement (according to the terms of the Agreement), this DPA shall also be deemed assigned to the assignee of the Agreement. No Party shall assign this DPA separately from the Agreement.

Bosnian law, except its choice-of-law provisions, shall apply to this DPA in all regards. Any disputes arising out of or in connection with this DPA shall be resolved in accordance with the dispute settlement provision of the Agreement.