Data processing agreement

The Customer is the controller and EasyHaus is the processor of the personal data described in Annex 1. EasyHaus processes it only on the Customer's documented instructions, which are the terms of service, this DPA and the Customer's use of the service. EasyHaus will tell the Customer if it believes an instruction breaches data protection law.

EasyHaus ensures that people authorised to process the data are bound by confidentiality. Staff access a Customer's organization for support only when the Customer's owner has enabled support access; such access is limited, requires a stated reason and is recorded in the Customer's audit trail.

EasyHaus implements the technical and organisational measures in Annex 2 and may update them provided the overall level of protection does not decrease.

The Customer gives general authorisation for the sub-processors in Annex 3. EasyHaus will announce new or replaced sub-processors at least 30 days in advance by email to the organization owner. The Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Customer may terminate the affected service. EasyHaus imposes data protection obligations on each sub-processor equivalent to this DPA and remains responsible for them.

• Data subject requests: the service lets the Customer export a client's data, correct it and erase it. EasyHaus forwards requests it receives directly to the Customer and does not answer them itself.
• EasyHaus assists with data protection impact assessments and consultations with authorities where the information is available to it.

EasyHaus notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer's data. The notice describes the nature of the breach, the data and people concerned as far as known, likely consequences and the measures taken, and is updated as more becomes known.

During the subscription and for 90 days after it ends, the Customer can export all its data. After that period, or 30 days after the Customer deletes its organization, EasyHaus deletes the data from the database and file storage. Encrypted backups expire on their normal rotation within 30 days. EasyHaus keeps data longer only where the law requires it.

EasyHaus makes available the information needed to demonstrate compliance with Article 28 GDPR, including a summary of its latest security review. The Customer may audit compliance, or have an independent auditor do so, on 30 days' notice, at most once a year unless a breach or an authority requires otherwise, at the Customer's cost and under confidentiality.

The database holding Customer Data is hosted in the European Union. Sub-processors in Annex 3 that are based in the United States or process data there are certified under the EU–US Data Privacy Framework, and the Standard Contractual Clauses of their data processing terms apply as well. EasyHaus is operated from the Republic of Azerbaijan; access to Customer Data from Azerbaijan is covered by the Standard Contractual Clauses. EasyHaus transfers personal data outside the European Economic Area only with such safeguards under Chapter V GDPR.

Liability under this DPA follows the terms of service. If this DPA conflicts with the terms of service, this DPA prevails for the processing of personal data. This DPA ends when EasyHaus no longer processes Customer personal data.

• Encryption in transit with TLS and HSTS.
• Encryption at rest of tax IDs, identity document numbers, bank account numbers, beneficial owner identifiers, second-factor secrets and recovery codes with AES-256-GCM; keys kept outside the database, with key identifiers for rotation.
• Logical separation of organizations: every query scoped to one organization, enforced by an automated check and an isolation test suite.
• Role-based access within an organization (owner, admin, manager, viewer); sensitive fields shown in full only to owners and admins.
• Passwords hashed with argon2id, minimum length and breached-password checks; optional or enforced two-factor authentication; lock-out after repeated wrong codes.
• Random session tokens stored as hashes, with idle and absolute expiry and revocation.
• Rate limits on sign-in, password reset, emailed links, uploads and the contact form.
• Private file storage with short-lived, single-use upload links; file type allowlist and content checks; image re-encoding.
• Audit trail of every change, with personal fields masked, that cannot be deleted by customers; logged document downloads.
• Support access only with the owner's consent, limited in scope and logged.
• Hardened server processes, dependency vulnerability scanning and security headers including a Content Security Policy.
• Database hosted in the European Union; files encrypted at rest in storage.
• Nightly backups, encrypted with AES-256 on our server before they leave it, kept for 30 days, with a weekly integrity check and a documented restore procedure.