Data Processing Agreement
English translation for convenience; the Lithuanian version prevails.
Effective 2026-10-25 · under Article 28 of Regulation (EU) 2016/679 (GDPR)
This agreement is part of the Terms of service and applies when Data innovations MB (company code 308172154, the Processor), in providing the MarketScope service, processes personal data on behalf of the customer (the Controller).
1. Subject matter, duration and nature
The Processor processes personal data only to the extent necessary to provide the MarketScope service: storing the customer's workspace, collecting the public sources set by the customer, analysing items, and sending alerts and reports. Processing lasts for as long as the service agreement is in force, plus 30 days after it ends to return or delete the data.
2. Categories of data and data subjects
| Data subjects | Data |
|---|---|
| The customer's users | Name, e-mail, role, login sessions (IP address, browser), activity log |
| Persons the customer enters in the platform | Contact persons, notes, sales statuses, e-mail addresses of alert recipients |
| Persons mentioned in public sources | Names and positions mentioned in news, public procurement notices or registers |
Special categories of personal data are not processed in the platform; the Controller undertakes not to enter them.
3. Processor's obligations
- Process data only on the Controller's documented instructions, namely this agreement and the Controller's settings in the platform.
- Ensure that persons processing the data have committed themselves to confidentiality.
- Apply appropriate technical and organisational security measures (section 4).
- Assist the Controller in fulfilling data subjects' rights (access, rectification, erasure, portability): users' data can be viewed and exported in the platform; in other cases we assist within 10 working days.
- Notify the Controller of a personal data breach without undue delay, no later than 48 hours after becoming aware of it, and provide the information available.
- After the agreement ends, at the Controller's choice, return (export) or delete the data within 30 days; in backups, data is deleted at the end of their retention cycle.
- Provide the information necessary to demonstrate compliance with this agreement and allow reasonable audits, agreed in advance.
4. Security measures
- Data is stored in the EU (servers in Lithuania); all connections are encrypted (HTTPS, HSTS).
- Passwords are stored only as cryptographic hashes (scrypt); third-party access keys are encrypted; session identifiers are stored only as hashes.
- Access is separated by workspace and role; every request checks the user's membership of the workspace.
- Two-factor authentication is mandatory for administrators; actions are recorded in a log.
- Login attempt limiting, security headers, automated dependency vulnerability scanning.
- Regular database backups; system operation monitoring.
5. Sub-processors
The Controller gives general authorisation to engage the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Hostinger International Ltd. | Server infrastructure and e-mail delivery | EU (data centre in Lithuania) |
| Anthropic PBC | Artificial intelligence analysis: only the text of public items (headline and short excerpt) and the project name are sent; users' data is not sent | USA (European Commission Standard Contractual Clauses) |
We notify of new sub-processors or changes to them by e-mail at least 30 days in advance; the Controller may raise a reasonable objection and, failing agreement, terminate the agreement. Sub-processors are bound by data protection obligations no less protective than those set out in this agreement.
6. Controller's obligations
The Controller is responsible for having a legal basis for the data it enters, or whose collection it sets up, in the platform, and for ensuring that its instructions comply with the GDPR.
7. Contact
For data protection matters: Data innovations MB, Lvivo g. 91-48, LT-00153 Vilnius, info@datainnovations.lt. If you need a signed version of this agreement, write to us and we will send it.