Data Processing Agreement

1. Parties and roles

Processor: tross kkeys OÜ, registry code 17549658, Loosivälja tee 2, Metsakasti küla, Viimsi vald, Harju maakond 74019, Estonia ("tross kkeys").
Controller: the customer identified in the Master Services Agreement (the "Customer").

The Customer determines the purposes and means of processing personal data of its employees and contractors in connection with their home workplaces. tross kkeys processes such data solely on behalf of and on the documented instructions of the Customer.

2. Subject matter, duration, nature and purpose

The subject matter is the provision of managed home-office IT services (device management, security, helpdesk, network, lifecycle and reporting) as described in the Service Description. Processing lasts for the term of the customer agreement plus the deletion period in Section 11. The nature and purpose of processing, categories of data subjects and categories of personal data are specified in the Annex.

3. Processing on documented instructions

tross kkeys shall process personal data only on documented instructions from the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in such a case tross kkeys shall inform the Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest. The agreement, the Service Description and tickets raised through the agreed support channels constitute documented instructions. tross kkeys shall immediately inform the Customer if, in its opinion, an instruction infringes the GDPR.

4. Confidentiality

tross kkeys ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and process data only to the extent necessary for their tasks.

5. Technical and organisational measures

tross kkeys implements the measures required by Article 32 GDPR, including at minimum:

• full-disk encryption of all managed and internal devices; TLS for all data in transit;
• multi-factor authentication and conditional access for all administrative and staff accounts; no standing administrator rights; quarterly access reviews;
• endpoint detection and response, centralised logging and alerting with 24/7 monitoring;
• segregation of customer tenants; management performed within the Customer's own Microsoft 365 / Google Workspace tenant where applicable;
• encrypted, geographically redundant backups within the EU with periodic restore tests;
• documented incident response, change management and secure offboarding (remote wipe, certified data destruction on returned equipment);
• security awareness training for all staff at least annually.

6. Sub-processors

The Customer grants general written authorisation for the engagement of the sub-processors listed below. tross kkeys shall inform the Customer of any intended addition or replacement at least 30 days in advance, giving the Customer the opportunity to object on reasonable data-protection grounds. tross kkeys imposes the same data-protection obligations on each sub-processor and remains fully liable to the Customer for their performance.

7. Assistance with data subject rights

Taking into account the nature of the processing, tross kkeys assists the Customer with appropriate technical and organisational measures in fulfilling its obligation to respond to requests for exercising data subject rights under Chapter III GDPR. Requests received directly by tross kkeys are forwarded to the Customer within two business days without substantive response.

8. Personal data breach notification

tross kkeys notifies the Customer without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach affecting the Customer's data, providing the information required by Article 33(3) GDPR as it becomes available, and cooperates in the Customer's investigation, mitigation and notifications.

9. Assistance, documentation and audits

tross kkeys assists the Customer in ensuring compliance with Articles 32–36 GDPR (security, breach notification, data protection impact assessments, prior consultation). tross kkeys makes available all information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, once per year on 30 days' notice or at any time following a breach, during business hours and subject to reasonable confidentiality undertakings.

10. International transfers

Personal data is stored and processed in the EU/EEA. Any transfer to a third country takes place only on the Customer's documented instruction and only where an adequacy decision, the EU‑US Data Privacy Framework certification of the recipient, or the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) with appropriate supplementary measures apply.

11. Deletion and return of data

At the end of the provision of services tross kkeys, at the choice of the Customer, deletes or returns all personal data and deletes existing copies within 30 days, unless Union or Member State law requires storage. Returned equipment is securely wiped in accordance with NIST SP 800‑88 and a destruction certificate is provided on request.

Annex — Details of processing

Contact for data protection matters: privacy@trossremote.com.