// Legal

Data Processing Agreement (Art. 28 GDPR)

When our work for you involves personal data, for example when we administer servers, databases or applications that contain it, BLUEGEM acts as your processor. This page summarises the standard terms of our Data Processing Agreement (DPA).

The signed agreement is prepared for each engagement. To request it, email hello@bluegem.sk. This summary is for information and does not replace the signed agreement.

1. Parties and roles

You (the client) are the controller. BLUEGEM, Bratislava, Slovakia (EU), is the processor and processes personal data only on your behalf.

2. Subject matter and duration

The DPA covers the processing that is necessary to provide the services agreed in the main contract or order (for example Linux and database administration, migration, development or AI integration). It applies for as long as BLUEGEM processes personal data for you under that contract.

3. Nature and purpose of processing

Typical operations are access, storage, structuring, copying, migration, backup, restoration and deletion of data in your systems, carried out solely to deliver the agreed services.

4. Categories of data and data subjects

These are defined per engagement in an annex. They typically include contact and identification data of your employees, customers or suppliers, contract and transaction data, and technical data such as log entries. Special categories of personal data (Art. 9 GDPR) are processed only if expressly agreed.

5. Obligations of BLUEGEM as processor

• Instructions: we process personal data only on your documented instructions and inform you if we consider an instruction to infringe data protection law.
• Confidentiality: everyone with access is bound by confidentiality.
• Security (Art. 32 GDPR): technical and organisational measures appropriate to the risk, including access through accounts and keys you control, least privilege, encryption in transit, multi-factor authentication where available, logging of administrative work, tested backups, prompt security updates and documented changes. A detailed list of measures is attached to the signed agreement.
• Sub-processors: engaged only with your general written authorisation. We inform you in advance of any intended addition or replacement, and you may object. Sub-processors are bound by the same data protection obligations.
• Assistance: we help you respond to data subject requests (Art. 12–22 GDPR) and with your obligations under Art. 32–36 GDPR, including security, breach notification and data protection impact assessments.
• Personal data breaches: we notify you without undue delay after becoming aware of a breach, with the information you need for your own notification under Art. 33 GDPR.
• Deletion or return: at the end of the services we delete or return all personal data at your choice, unless EU or member state law requires storage, and confirm this in writing.
• Audits: we make available all information necessary to demonstrate compliance and allow for and contribute to audits, including inspections, by you or an auditor you appoint, with reasonable notice.

6. Place of processing and international transfers

We work from the European Union and, wherever possible, on infrastructure you provide and control. Personal data is transferred outside the EU/EEA only on your instructions and only with appropriate safeguards under Chapter V GDPR, such as an adequacy decision or standard contractual clauses.

7. Liability

Liability is governed by the main contract, subject to Art. 82 GDPR.

8. Governing law and jurisdiction

The DPA is governed by the laws of the Slovak Republic. Courts in Slovakia have jurisdiction unless otherwise agreed in the main contract. Mandatory provisions of the GDPR take precedence.

More on how this website handles personal data: Privacy notice.