This Data Processing Agreement ("DPA") forms part of the Service Agreement between LLC Dva PiEr ("Processor") and the Service Client ("Controller"). It governs the processing of personal data carried out by the Processor on behalf of the Controller in connection with the 4Pay.online service.
1.1. "Personal Data" means any information relating to an identified or identifiable natural person.
1.2. "Controller" means the Service Client that determines the purposes and means of processing Personal Data.
1.3. "Processor" means LLC Dva PiEr, which processes Personal Data on behalf of the Controller.
1.4. "Processing" means any operation performed on Personal Data, including collection, storage, use, transfer, or deletion.
1.5. "Sub-processor" means any third party engaged by the Processor to assist in processing Personal Data.
2.1. The Processor shall process Personal Data only as necessary to provide the 4Pay.online service and as documented in writing by the Controller.
2.2. Categories of data subjects: employees, customers, and counterparties of the Controller whose data is transmitted through the Service.
2.3. Categories of Personal Data: contact details, identification data, payment transaction data, and technical identifiers.
3.1. Process Personal Data only on documented instructions from the Controller, unless required by applicable law.
3.2. Ensure that persons authorized to process Personal Data are bound by confidentiality obligations.
3.3. Implement appropriate technical and organizational security measures in accordance with Article 32 GDPR and applicable laws.
3.4. Assist the Controller in responding to requests from data subjects exercising their rights.
3.5. Delete or return all Personal Data upon termination of the service, as directed by the Controller.
3.6. Make available all information necessary to demonstrate compliance with this DPA.
4.1. The Controller is responsible for handling data subject requests (access, rectification, erasure, portability, objection).
4.2. The Processor shall promptly notify the Controller if it receives a request directly from a data subject.
4.3. The Processor shall provide reasonable technical assistance to enable the Controller to fulfill data subject rights.
4.4. Response time for Processor assistance: within 5 business days of the Controller's request.
5.1. The Controller grants general authorization for the Processor to engage sub-processors, subject to the conditions in this DPA.
5.2. The Processor shall impose the same data protection obligations on sub-processors as set out in this DPA.
5.3. The Processor shall notify the Controller of any intended changes to sub-processors with reasonable advance notice.
6.1. The Processor applies encryption of data in transit and at rest, access controls, and regular security assessments.
6.2. Payment card data (CHD/SAD) is processed exclusively through PCI DSS-certified infrastructure. No CHD/SAD is stored beyond transaction completion.
6.3. Access to Personal Data is restricted on a need-to-know basis and is subject to strong authentication controls.
7.1. The Processor shall notify the Controller without undue delay, and not later than 72 hours after becoming aware of a Personal Data breach affecting the Controller's data.
7.2. Notification shall include: nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and measures taken.
7.3. The Controller is responsible for notifying the supervisory authority and affected data subjects where required by law.
8.1. Personal Data may be transferred outside the EEA only where adequate safeguards are in place (e.g., Standard Contractual Clauses, adequacy decision).
8.2. The Processor shall provide the Controller with information on transfer mechanisms upon request.
9.1. This DPA remains in force for the duration of the Service Agreement and terminates automatically upon its expiry or termination.
9.2. This DPA is governed by the law applicable to the Service Agreement. Contact for DPA queries: support@4pay.online.