Data Processing Agreement
Pravno zavezujoče besedilo je angleška različica spodaj. Version 1.9 — 6.10.2026, material — incorporates the full DPA text C1-04 in its version 1.3, which the TechRevati legal service approved on 6.10.2026 after its final review: Annex I.B of Exhibit F lists the categories of data subjects and states the sensitive data transferred, C1-04 §4.3 states that VAP is not designed or permitted to infer, classify or use special-category information instead of an absolute statement that none is processed, and the retention exhibit refers to §10 for return and deletion. For a Controller established outside the EEA, VAP records with each acceptance the accepted package of the Standard Contractual Clauses (official text, Module Four, options, completed Annex I, parties, time, DPA version and hash). The description of the transfer and of special categories changes, so this change is material: 1.9 applies to agreements concluded from 7.10.2026, and a Customer who accepted an earlier version moves to it only by accepting 1.9 or by signing the DPA amendment, never by notice alone (§6). (previous: 1.8 — 4.10.2026, material; wording under counsel review — incorporates the full DPA text C1-04 in its version 1.2. Transfers outside the EEA are no longer described as absent: for a Controller established outside the EEA, access through VAP, exports, compliance packs, alert e-mails and webhooks are transfers of personal data to the Controller, governed by an adequacy decision or, where the conditions in C1-04 Exhibit F are met, by the Standard Contractual Clauses, Module Four (Commission Implementing Decision (EU) 2021/914); Customers established in Serbia and the Onsite edition are addressed in C1-04 §2.5 and §12. The Standard Contractual Clauses are a new transfer mechanism, so this change is material: 1.8 applies to agreements concluded from 4.10.2026, and a Customer who accepted an earlier version moves to it only by accepting 1.8 or by signing the DPA amendment, never by notice alone (§6). The TechRevati legal service has approved the structure of C1-04 Exhibit F; its final check of the mapping table under that Exhibit is pending. (previous: 1.7 — 26.9.2026, corrections; wording under counsel review (agreements signed before 17.9.2026 stay on 1.5 — approved for use 2026-09-03). (1.7, same version, 28.9.2026, second change — a Slovenian translation of this page is added below the English text, for review by the TechRevati legal service together with the other group 1 documents (its answer of 27.9.2026, point 3, asks for a bilingual SL/EN DPA); until that review the English text is binding, and the translation adds, removes or changes no clause, right or obligation. 1.7, same version, 28.9.2026 — answer of the TechRevati legal service of 27.9.2026, group 2, taken into 1.7 because 1.7 has not yet been accepted by anyone: the confidentiality row uses the wording of GDPR Art. 28(3)(b) and states that no person gets technical access to the Controller's data before being bound; a new row states that for the Onsite edition without access TechRevati is a software supplier and that occasional diagnostic access during a remote-support session is covered by this DPA; the order of precedence in §5 follows the Terms of Service §12 (the Order Form now above the PoC Agreement). 1.7: two statements of fact corrected, no clause touched — the supervisory authority's address now reads Dunajska cesta 22 (it read „Dunavska 22"), and two rows that still called the PoC optional („a PoC is not required", „an optional Proof of Concept") now say what the Terms and the PoC Agreement have said since 3.9.2026: every new site starts with the onboarding. Roles, duration, sub-processors, deadlines, rights and obligations are unchanged. 1.6: material — the personal-data-breach row no longer states a fixed 72-hour processor deadline: GDPR Art. 33(2) sets no fixed period for a processor, and that 72-hour clock is the Controller's own under Art. 33(1), and a fixed processor deadline that consumes it is worse for the Controller and a hard obligation of result for TechRevati. Now: without undue delay after becoming aware, in time for the Controller's own deadline, information in phases, and a notification is not an admission. This removes a fixed time the Controller could rely on, so existing signatures do not carry over and re-acceptance is required. 1.5: editorial — one table row relabelled „Optional PoC" → „Onboarding (PoC)" so this page stops contradicting the Terms and the PoC Agreement, where the onboarding became the entry point for every new site on 3.9.2026; roles, duration limits and every clause are unchanged, no right or obligation changed. 1.4: editorial — text describing the processor's own document preparation was removed from this customer-facing page; no clause, right or obligation changed. 1.3: editorial — governing law for the DPA stated as Slovenian law, the rule that already applied by default under Rome I Art. 4(1)(b); no change to rights or obligations. 1.2: processor identity completed (legal name, registered seat, reg./VAT) and the sub-processor annex filled in with what is actually engaged — on-prem: no hosting sub-processor; MinIO self-hosted; Lettermint for transactional notices; Paddle and LLM explicitly not engaged. 1.1: editorial — internal document pointers replaced with public references; no change to rights or obligations))).
Source of truth: docs/legal/commercial/03-dpa-and-annexes.md — the same file the in-product
click-through hashes, so the published text and the accepted text cannot drift.
Data Processing Agreement (DPA)
| Version | 1.9 — 6.10.2026, material — incorporates the full DPA text C1-04 in its version 1.3, which the TechRevati legal service approved on 6.10.2026 after its final review: Annex I.B of Exhibit F lists the categories of data subjects and states the sensitive data transferred, C1-04 §4.3 states that VAP is not designed or permitted to infer, classify or use special-category information instead of an absolute statement that none is processed, and the retention exhibit refers to §10 for return and deletion. For a Controller established outside the EEA, VAP records with each acceptance the accepted package of the Standard Contractual Clauses (official text, Module Four, options, completed Annex I, parties, time, DPA version and hash). The description of the transfer and of special categories changes, so this change is material: 1.9 applies to agreements concluded from 7.10.2026, and a Customer who accepted an earlier version moves to it only by accepting 1.9 or by signing the DPA amendment, never by notice alone (§6). (previous: 1.8 — 4.10.2026, material; wording under counsel review — incorporates the full DPA text C1-04 in its version 1.2. Transfers outside the EEA are no longer described as absent: for a Controller established outside the EEA, access through VAP, exports, compliance packs, alert e-mails and webhooks are transfers of personal data to the Controller, governed by an adequacy decision or, where the conditions in C1-04 Exhibit F are met, by the Standard Contractual Clauses, Module Four (Commission Implementing Decision (EU) 2021/914); Customers established in Serbia and the Onsite edition are addressed in C1-04 §2.5 and §12. The Standard Contractual Clauses are a new transfer mechanism, so this change is material: 1.8 applies to agreements concluded from 4.10.2026, and a Customer who accepted an earlier version moves to it only by accepting 1.8 or by signing the DPA amendment, never by notice alone (§6). The TechRevati legal service has approved the structure of C1-04 Exhibit F; its final check of the mapping table under that Exhibit is pending. (previous: 1.7 — 26.9.2026, corrections; wording under counsel review (agreements signed before 17.9.2026 stay on 1.5 — approved for use 2026-09-03). (1.7, same version, 28.9.2026, second change — a Slovenian translation of this page is added below the English text, for review by the TechRevati legal service together with the other group 1 documents (its answer of 27.9.2026, point 3, asks for a bilingual SL/EN DPA); until that review the English text is binding, and the translation adds, removes or changes no clause, right or obligation. 1.7, same version, 28.9.2026 — answer of the TechRevati legal service of 27.9.2026, group 2, taken into 1.7 because 1.7 has not yet been accepted by anyone: the confidentiality row uses the wording of GDPR Art. 28(3)(b) and states that no person gets technical access to the Controller's data before being bound; a new row states that for the Onsite edition without access TechRevati is a software supplier and that occasional diagnostic access during a remote-support session is covered by this DPA; the order of precedence in §5 follows the Terms of Service §12 (the Order Form now above the PoC Agreement). 1.7: two statements of fact corrected, no clause touched — the supervisory authority's address now reads Dunajska cesta 22 (it read „Dunavska 22"), and two rows that still called the PoC optional („a PoC is not required", „an optional Proof of Concept") now say what the Terms and the PoC Agreement have said since 3.9.2026: every new site starts with the onboarding. Roles, duration, sub-processors, deadlines, rights and obligations are unchanged. 1.6: material — the personal-data-breach row no longer states a fixed 72-hour processor deadline: GDPR Art. 33(2) sets no fixed period for a processor, and that 72-hour clock is the Controller's own under Art. 33(1), and a fixed processor deadline that consumes it is worse for the Controller and a hard obligation of result for TechRevati. Now: without undue delay after becoming aware, in time for the Controller's own deadline, information in phases, and a notification is not an admission. This removes a fixed time the Controller could rely on, so existing signatures do not carry over and re-acceptance is required. 1.5: editorial — one table row relabelled „Optional PoC" → „Onboarding (PoC)" so this page stops contradicting the Terms and the PoC Agreement, where the onboarding became the entry point for every new site on 3.9.2026; roles, duration limits and every clause are unchanged, no right or obligation changed. 1.4: editorial — text describing the processor's own document preparation was removed from this customer-facing page; no clause, right or obligation changed. 1.3: editorial — governing law for the DPA stated as Slovenian law, the rule that already applied by default under Rome I Art. 4(1)(b); no change to rights or obligations. 1.2: processor identity completed (legal name, registered seat, reg./VAT) and the sub-processor annex filled in with what is actually engaged — on-prem: no hosting sub-processor; MinIO self-hosted; Lettermint for transactional notices; Paddle and LLM explicitly not engaged. 1.1: editorial — internal document pointers replaced with public references; no change to rights or obligations))) |
| Applies to | VAP SaaS and edge components, under the Terms of Service |
| Supervisory authority (processor) | Informacijski pooblaščenec RS (IP-RS), Dunajska cesta 22, 1000 Ljubljana |
Not legal advice. This page states the data-protection terms on which TechRevati processes personal data for a Customer under GDPR Art. 28. The full contract text is provided for review before signature — see *Execution* below.
1. Parties and roles
| Role | Party |
|---|---|
| Controller | Customer / tenant — legal name is taken from the tenant compliance profile at registration and printed into the signed copy |
| Processor | Techrevati, računalniško programiranje in svetovanje, d.o.o., Dunajska cesta 136, 1000 Ljubljana, Slovenia (reg. 7528485000, VAT SI57204195) |
| Service | VAP SaaS + edge components, processed only on the Controller's documented instructions |
| Subscription (Terms) | Same roles during the subscription that follows the onboarding |
| Onboarding (PoC) | Same roles; duration and volume limited by the PoC Agreement and its Annex |
There is no joint controllership: TechRevati does not determine the purposes of the processing.
2. What the DPA covers
| Subject matter | Detection, timely warning and documentation of occupational safety events, including a person in a hazard zone and pedestrian–vehicle proximity, on IP cameras at the Controller's premises |
| Duration | For the term of the subscription; deletion or return on termination |
| Data categories | Camera imagery and derived event metadata. Excluded by architecture: biometric identification, worker performance scoring, automated decisions with legal effect |
| Instructions | Documented; TechRevati must not process for its own purposes |
| Confidentiality | Persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b)). No person is given technical access to the Controller's personal data before being so bound |
| Onsite edition and remote support | Where the software runs on the Controller's own equipment and TechRevati has no access to it, TechRevati is a supplier of software and does not process the Controller's personal data. Occasional diagnostic access during a remote-support session that the Controller requests and opens is processing under this DPA, limited to the purpose and duration of that session, logged, and without copying data off the site except on the Controller's instruction; no separate annex is required |
| Security | Technical and organisational measures, reviewed and updated |
| Data subject rights | TechRevati assists the Controller and forwards any request it receives |
| Personal data breach | Notified to the Controller without undue delay after TechRevati becomes aware, and in time for the Controller's own deadline towards the supervisory authority (Art. 33(1)); information may follow in phases; the Controller notifies the supervisory authority |
| Deletion / return | 30 days for the Controller to choose export or deletion, 90 days to complete deletion, with written confirmation |
| Audit | Information and audit rights as required by Art. 28(3)(h) |
| Governing law | Slovenian law (Rome I Art. 4(1)(b) — services follow the provider's seat) |
| Transfers outside the EEA | For a Controller established outside the EEA, access through VAP, exports, compliance packs, alert e-mails and webhooks are transfers of personal data to the Controller. They are governed by an adequacy decision under Art. 45 or, where the conditions in C1-04 Exhibit F are met, by the Standard Contractual Clauses, Module Four (Commission Implementing Decision (EU) 2021/914), incorporated in that Exhibit with TechRevati as data exporter. Customers established in Serbia and the Onsite edition: C1-04 §2.5 and §12 |
The exclusions in *Data categories* are deliberate: they are what keeps the system outside the EU AI Act's high-risk classification, and they are contractual, not merely a product setting.
3. Sub-processors
General written authorisation applies; the Controller may object to a new sub-processor. This list is the current one and is kept up to date.
| Sub-processor | Purpose | Location | Notes |
|---|---|---|---|
| On-prem deployment: none — API, DB and dashboard run on Customer-controlled hardware | API, DB, dashboard hosting | Customer site (EU) | Default deployment model; no hosting sub-processor exists |
| SaaS deployment only: Hetzner Online GmbH | API, DB, dashboard and event-media hosting | EU (Germany / Finland) | Applies only where the Customer's centre is hosted by the Provider; not engaged for an on-prem deployment |
| SaaS deployment only: Cloudflare | TLS termination and DNS in front of public hostnames; no video content | Global anycast network unless an EU-only configuration is confirmed | Applies only where the Provider's public hostnames are served through Cloudflare; Cloudflare DPA with EU SCCs |
| MinIO (self-hosted, same host as the API) | Media / LLM spillover | Same site/region as the API | Not a third party: runs inside the same deployment |
| Lettermint | Transactional notices (invites, password reset, digests) | EU | Only recipient address and message body; no event media |
| Paddle — *not engaged* | Payments | — | Dormant: no billing account is live; this row activates only when it is |
| LLM provider — *not engaged by default* | Metadata-only LLM use cases | EU endpoint by default; a non-EU endpoint is blocked in code unless the operator records a residency acknowledgement | Requires a separate DPA and the tenant's opt-in |
No invented vendors. Empty rows stay empty until real contracts exist.
4. SaaS vs PoC
- SaaS under the Terms needs this DPA whenever TechRevati processes personal data — whether or
not a PoC exists.
- During the onboarding (Proof of Concept), the DPA still applies if personal data are processed.
The PoC Agreement and its Annex may cap sites, cameras and duration and forbid production reliance; they do not waive Art. 28.
5. Execution
- The full DPA text and its annexes are provided for your review before signature — ask at any
point, or receive them with the order form. 2. Both parties sign; the DPA forms part of the Agreement. 3. The signature is recorded against your tenant, together with the signatory and date. 4. Cameras stay off until that record is complete — the product enforces this, it is not a promise. 5. Precedence. This DPA prevails over every other document of the Agreement as regards the processing of personal data; otherwise the order of precedence in the Terms of Service §12 applies (DPA, for personal data only → Order Form → PoC Agreement with signed Annex A, for the onboarding phase → Terms of Service → AUP → offer package and marketing, only where the Order Form expressly incorporates them). The full text in C1-04 forms part of this DPA.
6. Customers who accepted an earlier version
- This version 1.9 applies to agreements concluded from 7 October 2026.
- A Customer who accepted an earlier version stays on that version. Because version 1.9 introduces
the Standard Contractual Clauses, Module Four, as a transfer mechanism, it does not take effect for that Customer by notice: the Customer moves to it only by accepting version 1.9 or by signing the DPA amendment that incorporates C1-04 version 1.3 and its Exhibit F. 3. An electronic acceptance records the person who accepts, the company on whose behalf they accept, the version of the document, the date and time, the proof of acceptance and the SHA-256 hash of the accepted text. 4. A clause of an earlier version that allows non-material changes by notice is not used for this change.
Slovenščina — Pogodba o obdelavi osebnih podatkov (DPA)
Prevod v pregledu. To je slovenska različica zgornjega angleškega besedila, pripravljena za pregled pravne službe TechRevati, ki je še ni potrdila. Do potrditve je zavezujoče besedilo angleška različica zgoraj. Prevod ne dodaja, ne odvzema in ne spreminja nobene pravice ali obveznosti; izrazi sledijo slovenskemu besedilu Splošne uredbe o varstvu podatkov (Uredba (EU) 2016/679).
| Različica | Ista kot angleška različica zgoraj (vrstica *Version*) |
| Velja za | VAP SaaS in robne (edge) komponente v skladu s Pogoji uporabe |
| Nadzorni organ (obdelovalec) | Informacijski pooblaščenec RS (IP-RS), Dunajska cesta 22, 1000 Ljubljana |
To ni pravni nasvet. Ta stran navaja pogoje varstva podatkov, pod katerimi TechRevati obdeluje osebne podatke za naročnika v skladu s členom 28 Splošne uredbe o varstvu podatkov. Celotno pogodbeno besedilo je na voljo za pregled pred podpisom — glejte *Sklenitev* spodaj.
1. Pogodbeni stranki in vlogi
| Vloga | Pogodbena stranka |
|---|---|
| Upravljavec | Naročnik (tenant) — pravno ime se prevzame iz profila skladnosti naročnika ob registraciji in se natisne v podpisani izvod |
| Obdelovalec | Techrevati, računalniško programiranje in svetovanje, d.o.o., Dunajska cesta 136, 1000 Ljubljana, Slovenija (matična številka 7528485000, ID za DDV SI57204195) |
| Storitev | VAP SaaS in robne komponente, obdelava samo po dokumentiranih navodilih upravljavca |
| Naročnina (Pogoji uporabe) | Enaki vlogi med naročnino, ki sledi uvajanju |
| Uvajanje (PoC) | Enaki vlogi; trajanje in obseg omejujeta Pogodba o PoC in njen aneks |
Skupnih upravljavcev ni: TechRevati ne določa namenov obdelave.
2. Kaj pokriva pogodba o obdelavi
| Predmet | Zaznavanje, pravočasno opozarjanje in dokumentiranje dogodkov s področja varnosti pri delu, vključno z osebo v nevarnem območju in bližino pešca in vozila, na IP-kamerah v prostorih upravljavca |
| Trajanje | Za čas trajanja naročnine; izbris ali vrnitev ob prenehanju |
| Vrste podatkov | Slike s kamer in iz njih izpeljani metapodatki o dogodkih. Izključeno z arhitekturo: biometrična identifikacija, ocenjevanje uspešnosti delavcev, avtomatizirane odločitve s pravnimi učinki |
| Navodila | Dokumentirana; TechRevati podatkov ne sme obdelovati za lastne namene |
| Zaupnost | Osebe, ki so pooblaščene za obdelavo osebnih podatkov, so se zavezale k zaupnosti ali jih k zaupnosti zavezuje ustrezen zakon (člen 28(3)(b)). Nobena oseba ne dobi tehničnega dostopa do osebnih podatkov upravljavca, preden je tako zavezana |
| Različica Onsite in oddaljena podpora | Kadar programska oprema teče na lastni opremi upravljavca in TechRevati do nje nima dostopa, je TechRevati dobavitelj programske opreme in osebnih podatkov upravljavca ne obdeluje. Občasni diagnostični dostop med sejo oddaljene podpore, ki jo upravljavec zahteva in odpre, je obdelava po tej pogodbi, omejena na namen in trajanje te seje, zabeležena in brez kopiranja podatkov z lokacije, razen po navodilu upravljavca; poseben aneks ni potreben |
| Varnost | Tehnični in organizacijski ukrepi, ki se pregledujejo in posodabljajo |
| Pravice posameznikov, na katere se nanašajo osebni podatki | TechRevati pomaga upravljavcu in mu posreduje vsako zahtevo, ki jo prejme |
| Kršitev varstva osebnih podatkov | Upravljavec je o njej uradno obveščen brez nepotrebnega odlašanja po tem, ko se je TechRevati z njo seznanil, in pravočasno za upravljavčev lastni rok do nadzornega organa (člen 33(1)); informacije se lahko zagotovijo postopoma; nadzorni organ uradno obvesti upravljavec |
| Izbris / vrnitev | 30 dni, da upravljavec izbere izvoz ali izbris, 90 dni za dokončanje izbrisa, s pisno potrditvijo |
| Revizija | Pravice do informacij in revizij, kot jih zahteva člen 28(3)(h) |
| Pravo, ki se uporablja | Slovensko pravo (Uredba Rim I, člen 4(1)(b) — storitve sledijo sedežu ponudnika) |
| Prenosi zunaj EGP | Za upravljavca s sedežem zunaj EGP so dostop prek VAP, izvozi, paketi skladnosti, opozorila po e-pošti in spletni klici (webhooks) prenos osebnih podatkov upravljavcu. Urejajo jih sklep o ustreznosti po členu 45 ali, kadar so izpolnjeni pogoji iz Priloge F (Exhibit F) k C1-04, standardne pogodbene klavzule, modul 4 (Izvedbeni sklep Komisije (EU) 2021/914), vključene v to prilogo, pri čemer je TechRevati izvoznik podatkov. Naročniki s sedežem v Srbiji in različica Onsite: C1-04 §2.5 in §12 |
Izključitve v vrstici *Vrste podatkov* so namerne: zaradi njih sistem ostaja zunaj razvrstitve med visokotvegane sisteme po Aktu EU o umetni inteligenci, in so pogodbene, ne zgolj nastavitev izdelka.
3. Drugi obdelovalci (podobdelovalci)
Velja splošno pisno dovoljenje; upravljavec lahko nasprotuje novemu drugemu obdelovalcu. Ta seznam je trenutni in se sproti posodablja.
| Drugi obdelovalec | Namen | Lokacija | Opombe |
|---|---|---|---|
| Namestitev na lokaciji (on-prem): nobeden — API, podatkovna baza in nadzorna plošča tečejo na strojni opremi pod nadzorom naročnika | Gostovanje API, podatkovne baze in nadzorne plošče | Lokacija naročnika (EU) | Privzeti model namestitve; drugi obdelovalec za gostovanje ne obstaja |
| Samo pri namestitvi SaaS: Hetzner Online GmbH | Gostovanje API, podatkovne baze, nadzorne plošče in medijev dogodkov | EU (Nemčija / Finska) | Velja le, kadar center naročnika gosti ponudnik; pri namestitvi on-prem ni vključen |
| Samo pri namestitvi SaaS: Cloudflare | Zaključevanje TLS in DNS pred javnimi imeni gostiteljev; brez video vsebine | Globalno omrežje anycast, razen če je potrjena konfiguracija samo za EU | Velja le, kadar se javna imena gostiteljev ponudnika strežejo prek Cloudflare; pogodba o obdelavi Cloudflare s standardnimi določili o varstvu podatkov, ki jih je sprejela Komisija (SCC) |
| MinIO (samostojno gostovan, na istem gostitelju kot API) | Mediji / prelivanje za LLM | Ista lokacija/regija kot API | Ni tretja oseba: teče znotraj iste namestitve |
| Lettermint | Transakcijska obvestila (povabila, ponastavitev gesla, povzetki) | EU | Samo naslov prejemnika in besedilo sporočila; brez medijev dogodkov |
| Paddle — *ni vključen* | Plačila | — | Neaktivno: noben račun za obračun ni v uporabi; ta vrstica začne veljati šele, ko bo |
| Ponudnik LLM — *privzeto ni vključen* | Primeri uporabe LLM samo z metapodatki | Privzeto končna točka v EU; končna točka zunaj EU je v kodi blokirana, razen če operater zabeleži potrditev glede lokacije (rezidentnosti) podatkov | Zahteva ločeno pogodbo o obdelavi in izrecno privolitev naročnika (opt-in) |
Brez izmišljenih ponudnikov. Prazne vrstice ostanejo prazne, dokler ne obstajajo resnične pogodbe.
4. SaaS in PoC
- SaaS po Pogojih uporabe potrebuje to pogodbo o obdelavi vedno, kadar TechRevati obdeluje
osebne podatke — ne glede na to, ali PoC obstaja.
- Med uvajanjem (Proof of Concept) ta pogodba o obdelavi še vedno velja, če se obdelujejo
osebni podatki. Pogodba o PoC in njen aneks lahko omejita število lokacij, kamer in trajanje ter prepovesta zanašanje v produkciji; člena 28 ne odpravljata.
5. Sklenitev
- Celotno besedilo pogodbe o obdelavi in njenih aneksov Vam je **na voljo za pregled pred
podpisom — zanj lahko zaprosite kadar koli ali ga prejmete skupaj z naročilnico. 2. Obe pogodbeni stranki podpišeta; pogodba o obdelavi postane del Pogodbe. 3. Podpis se zabeleži pri Vašem naročniškem računu (tenant), skupaj s podpisnikom in datumom. 4. Kamere ostanejo izklopljene, dokler ta zapis ni popoln — to uveljavlja izdelek, ni zgolj obljuba. 5. Vrstni red veljavnosti.** Ta pogodba o obdelavi ima glede obdelave osebnih podatkov prednost pred vsemi drugimi dokumenti Pogodbe; sicer velja vrstni red iz §12 Pogojev uporabe (pogodba o obdelavi, samo za osebne podatke → naročilnica → Pogodba o PoC s podpisanim Aneksom A, za fazo uvajanja → Pogoji uporabe → pravila sprejemljive uporabe (AUP) → ponudbeni paket in trženjsko gradivo, samo kadar ju naročilnica izrecno vključuje). Celotno besedilo v C1-04 je del te pogodbe o obdelavi.
6. Naročniki, ki so sprejeli prejšnjo različico
- Ta različica 1.9 velja za pogodbe, sklenjene od 7. oktobra 2026.
- Naročnik, ki je sprejel prejšnjo različico, ostane na tej različici. Ker različica 1.9 kot
mehanizem prenosa uvaja standardne pogodbene klavzule, modul 4, zanj ne začne veljati z obvestilom: nanjo preide samo s sprejemom različice 1.9 ali s podpisom dodatka k pogodbi o obdelavi, ki vključuje C1-04 v različici 1.3 in njeno Prilogo F. 3. Elektronski sprejem zabeleži osebo, ki sprejme, družbo, v imenu katere sprejme, različico dokumenta, datum in čas, dokaz o sprejemu in zgoščeno vrednost SHA-256 sprejetega besedila. 4. Določba prejšnje različice, ki dovoljuje nebistvene spremembe z obvestilom, se za to spremembo ne uporablja.