Article 1

PURPOSE AND LEGAL BASIS

This Contract for the Processing of Personal Data (hereinafter: “Contract“) is concluded in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter: “GDPR“) and the Personal Data Protection Act (ZVOP-2, Official Gazette of the Republic of Slovenia, No. 163/22, 40/25 – ZInfV-1).

The Contract regulates the relationship between:

• Algoritmik d.o.o., as a service provider that processes personal data on behalf of the client in the course of providing its services (hereinafter: “Processor“), and
• service client who determines the purposes and means of processing personal data (hereinafter: “Controller“), collectively also: “Contracting Parties”.

The mutual relations between the Contracting Parties are defined in the contracts concluded between the Controller and the Processor and in the general and special terms of the Processor, available at Processor’s website, all of which together form the Subscription Agreement (hereinafter: “Subscription Agreement“).

This Contract is concluded in accordance with the third paragraph of Article 28 of the GDPR for the purpose of defining the conditions and rules for the processing of personal data, measures for their protection, and the rights and obligations of the contracting parties in relation to the processing of personal data of individuals, which the processor performs on behalf of the controller within the framework of the Subscription Agreement.

The provisions of this Contract shall apply in conjunction with the provisions of the contracts and the aforementioned terms governing the Subscription Agreement and shall be interpreted in conjunction with each other.

Article 2

RIGHTS AND OBLIGATIONS OF THE CONTROLLER AND PROCESSOR

a) Legal basis of the Controller

The Controller shall ensure that it has a permissible legal basis for the processing of all personal data that will be processed on the basis of this Contract.

b) Ensuring Processor compliance

The Processor guarantees that it is registered to perform the activities specified in Article 1 of this Contract, and guarantees to the Controller that, during the processing of personal data under this Contract, it will implement appropriate technical and organizational measures to ensure the security of personal data and the full compliance of the tasks undertaken with the applicable law.

c) Access to personal data

The Processor shall only grant access to personal data processed on behalf of and for the account of the Controller to persons under its control who have undertaken confidentiality obligations or are subject to appropriate legal obligations of confidentiality and only to the extent necessary for the performance of their tasks.

d) Reporting breaches

In the event of a personal data breach, the Processor shall, without undue delay, after becoming aware of the breach, formally notify the Controller of the personal data breach in accordance with Article 33 of the GDPR.

e) Shared responsibility for ensuring safety

The Controller and Processor shall ensure appropriate procedures and measures for the security of personal data as set out in Article 32 of the GDPR.

f) Fulfilment of legal obligations

Under this Contract, both Contracting Parties shall be responsible for fulfilling their obligations as controllers or processors in accordance with the legislation applicable in the field of personal data protection.

Article 3

VALIDITY OF THE CONTRACT AND STORAGE OF PERSONAL DATA

This Contract shall be concluded for the duration of the Subscription Agreement between the Contracting Parties.

In the event of termination or cancellation of business cooperation, regardless of the reason, the Processor must:

• Return to the Controller, without undue delay, all personal data that it processes on its behalf.
• Delete or destroy all existing copies of this data, unless its storage is required by applicable law.

Article 4

NATURE AND PURPOSE OF PERSONAL DATA PROCESSING

The Processor processes personal data exclusively for the purpose of performing services within the framework of the Subscription Agreement between the Processor and the Controller. This includes, for example:

• Implementation
• Providing technical support
• Maintenance services
• Fixing bugs in services
• Cloud data storage

The list is not exhaustive and may be supplemented with other services that are necessary for the performance of obligations under the Subscription Agreement, in accordance with the Controller’s instructions.

In the context of processing personal data, the Processor performs the following processing operations, which include but are not limited to:

• Collection
• Storage
• Organization and structuring
• Backup
• Viewing, analyzing, supplementing, or correcting
• Printing
• Other forms of processing necessary for the performance of obligations arising from the Subscription Agreement.

The Processor shall process personal data referred to in this Article exclusively on the basis of the Controller’s instructions, in accordance with applicable personal data protection legislation.

Article 5

TYPES OF PERSONAL DATA

The Processor processes only those personal data to which it gains access when performing services based on a Subscription Agreement.

Categories of personal data may include, for example:

• Identification data (e.g., first name, last name, address, e-mail address, telephone number, etc.).
• Other personal data that users themselves enter into the system or that the Controller provides to the Processor when using services within the framework of a Subscription Agreement.

Article 6

CATEGORIES OF INDIVIDUALS

The Individuals to whom the personal data refer are natural persons whose data are entered and managed by the Controller in the Typless software solution. The Processor processes this personal data exclusively on behalf of and on the instructions of the Controller and solely for the purpose of performing services within the framework of the Subscription Agreement.

Article 7

TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES AND INTERNATIONAL ORGANIZATIONS

Any transfer of personal data to third countries (i.e., countries outside the European Economic Area) or international organizations by the Processor will be carried out exclusively on the basis of documented instructions from the Controller and will always comply with the provisions of Section 5 of the GDPR.

In the event of transfers of personal data to third countries or international organizations where the Processor has not received instructions from the Controller to do so, and required by European Union or Member State law to which the Processor is subject, the Processor shall inform the Controller of that legal requirement before processing the personal data, unless that law prohibits such information on important grounds of public interest.

Without documented instructions from the Controller (e.g., the Controller’s approval or specific requirements under European Union or Member State law applicable to the Processor), the Processor shall not:

1. 1. Transfer personal data to a controller or processor in a third country or international organization.
   2. Transfer personal data to a sub-processor in a third country or international organization.
   3. Enable the processing of personal data by a processor in a third country or international organization.

Article 8

TECHNICAL AND ORGANIZATIONAL MEASURES

The Processor has taken all necessary and appropriate technical and organizational measures to ensure an appropriate level of security of personal data in view of the existing risks. These measures include, in particular:

• SECURITY OF PREMISES WHERE COLLECTIONS ARE LOCATED:
  • Access to premises where personal data is processed or stored is restricted to authorized persons only.
  • Personal data carriers are appropriately locked and protected against unauthorized access outside working hours.
  • Unauthorized persons may only enter secure areas under the supervision of employees.
  • Computer displays and data carriers are installed and used in such a way as to prevent unauthorized persons from viewing them.
  • The processor implements a “clean desk” policy and uses additional physical security measures.

• ENSURING THE INTEGRITY (IMMUTABILITY) AND CONFIDENTIALITY OF DATA
  • Personal data is not left uncontrolled and is protected from access by third parties.
  • Accessible resources (keys, passwords, etc.) must be protected by every employee, and any loss or misuse must be reported immediately.
  • Computers and other equipment are locked outside working hours, and data on disks is adequately protected.
  • Technical staff and cleaners may only access secure areas if the data is physically or programmatically locked.
  • When servicing or upgrading systems, it must be ensured that any copies of personal data are destroyed or deleted after use.
  • When a computer virus appears, all necessary measures are taken to eliminate it, and all external media and software are checked before use.
  • Regular data backups are provided in case of malfunctions or extraordinary events.
  • Installing or modifying software is only permitted with the approval of the managing director.
  • Access to data via software is protected by passwords and user authorization.
  • Employees must prevent misuse of personal data and immediately report any breaches to the responsible persons; in the event of a suspected breach, the Processor is obliged to notify the Information Commissioner within 72 hours at the latest.
  • Appropriate labor law measures shall be taken against employees who misuse personal data or access databases without authorization.

• ENSURING ACCESSIBILITY OR AVAILABILITY OF DATA 

• • Access to data via application software is protected by passwords that enable the authorization and identification of individual users.
  • The Processor has introduced an authorization model for assigning rights in accordance with job classification and approval by supervisors.
  • The Processor agrees that, in the event of access to personal data, it will ensure that interference with personal data is minimal. Personal data will only be interfered with to the extent necessary to ensure the performance of services in accordance with the Subscription Agreement.

• ENSURING THE TRACEABILITY OF DATA OPERATIONS

• • Internal traceability of personal data processing: a log of all processing operations (entries, changes, additions, views, deletions) is kept, which allows for subsequent determination of the time, method, and person who performed each operation.
  • Traceability of personal data transfers to third parties: a record of transfers is kept, enabling subsequent verification of which personal data were transferred, to whom, when, and on what legal basis.

Article 9

SUB-PROCESSORS

In cases where the Provider acts as a personal data processor and the Client as a controller, the Controller gives written consent by entering into a Subscription Agreement (within the meaning of the provisions of the second paragraph of Article 28 of the GDPR) that the Processor may process personal data arising from this Subscription Agreement itself or entrust it in whole or in part to subcontractors acting as sub-processors. The sub-processors with whom the Processor cooperates are:

• individuals who cooperate with the processor based on service, subcontracting, or business collaboration agreements (e.g., IT service providers and other external experts),
• Datalab Tehnologije d.d.,
• Anthropic – for AI functionality and natural language processing
• OpenAI – for AI functionality and natural language processing,
• Amazon Web Services (AWS) – infrastructure hosting and data processing,
• Google Cloud Platform (GCP) – data processing and storage,
• Microsoft Azure – data processing and storage.

To obtain an accurate and up-to-date list of all sub-processors, the Controller may contact the email address specified in Article 13 of this Contract. In the event of a subsequent intention to replace or include a new sub-processor in the aforementioned list, the processor shall notify the Controller in writing at least 15 days prior to the intended granting of access to personal data to such sub-processor. The Controller shall be entitled to raise a reasoned objection to the change within this period.

The Processor shall conclude a contract or other legally binding act with each sub-processor, which shall ensure the same obligations and standards of personal data protection as agreed in the Subscription Agreement between the Processor and the Controller. For each processing of personal data, the sub-processor shall ensure procedures and measures for the protection of personal data that are as strict or stricter than those implemented by the personal data processor in accordance with this Contract.

An individual sub-processor may perform individual tasks related to the processing of personal data within the scope of the contractual processor’s authorizations and may not process personal data for any other purpose.

Article 10

ASSISTANCE TO THE CONTROLLER

The Processor shall provide the following services to the Controller upon its written request:

– Providing information upon written request by the Controller that is necessary to demonstrate compliance with the Controller’s obligations regarding the contractual processing of personal data.

– Providing information, upon written request by the Controller, that is necessary or useful for the Client to respond to requests for the exercise of individuals’ rights to

 whom the personal data relate, in relation to which the Processor does not provide the Controller with any technical and organizational measures.

– Providing information upon written request from the Controller regarding the processing of personal data that the Controller needs to perform a data protection impact assessment and for the prior consultation procedure pursuant to Articles 35 and 36 of the GDPR.

– Services enabling the inspection and audit of personal data processing. The Processor shall enable the Controller to carry out an inspection or audit upon the Controller’s written request, which must be submitted at least 8 days prior to the planned inspection or audit. The request must contain at least the desired date of the inspection or audit, the name of the contractor, and the subject of the inspection or audit. As a rule, the inspection or audit shall be carried out during the Processor’s regular working hours and shall be carried out in a manner that interferes as little as possible with the processor’s work process.

Article 11

LIABILITY FOR BREACHES

The liability of the contracting parties for any breaches shall be determined exclusively in accordance with the provisions of the Contract or the terms of use governing the subscription relationship.

Article 12

CONTACT

All notices, requests, inquiries, and other documentation related to personal data protection shall be addressed to info@typless.com.

Article 13

FINAL PROVISIONS

This Contract is an integral part of the Subsciption Agreement between the Controller and the Processor. The contract shall enter into force and shall be deemed concluded on the date of conclusion of the contracts / acceptance of the terms by the Controller, which constitute the Subscription Agreement.

The parties may agree at any time to additionally sign this Contract in physical or electronic form, with both copies having equal validity.

This Contract shall be governed exclusively by applicable Slovenian law and applicable European Union law. In the event of a dispute, the parties to the Contract shall attempt to resolve the dispute amicably. If that is not possible, the court in Ljubljana shall have jurisdiction to resolve the dispute.

Personal data controller:                                                                             Personal data processor:

                                                                                                                              Algoritmik d.o.o.

Last updated: 3 March 2026