Updated 16 September 2026
Data Processing Agreement
This English version is provided for convenience. The Romanian version at /ro/informatii-legale/acord-prelucrare-date/ is the binding text.
This Data Processing Agreement (the “Agreement” or “DPA”) sets out the conditions under which Amazing Soft SRL processes personal data on behalf of its clients, in accordance with Article 28 of Regulation (EU) 2016/679 (the “GDPR”). The Agreement forms part of any contract between Amazing Soft and the Client, under the conditions of Article 2.
Article 1. Parties and definitions
1.1. Amazing Soft means Amazing Soft SRL, a Romanian company with its registered office in Bucharest, Sector 6, Str. Sg. Alexandru Cutieru nr. 25B, room 1, block 2, entrance 2, 11th floor, apartment 278, postcode 061422, registered with the Trade Register under no. J2016000150403, VAT no. RO35387202, e-mail office@amazingsoft.ro.
1.2. The Client means the legal person or authorised natural person that has entered into a Contract with Amazing Soft within the meaning of Article 1.3.
1.3. The Contract means any services contract, software development contract, hosting contract, maintenance subscription, accepted quote, order, addendum or other document by which the Client orders services from Amazing Soft.
1.4. The terms “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meaning given in Article 4 GDPR. In this Agreement, the controller is referred to as the “Controller”, the processor as the “Processor”, and a further processor engaged by the Processor as a “Sub-processor”.
1.5. Client Data means the personal data that Amazing Soft processes on behalf of the Client in the performance of the Contract, as described in Annex 1.
1.6. The Services means the services provided by Amazing Soft under the Contract: automations and AI agents, mobile applications, websites and online shops, branding and design, UI/UX, custom software, hosting, maintenance and support.
1.7. The Terms of Service means Amazing Soft’s Terms of Service, published at https://amazingsoft.ro/legal/terms-of-service/.
Article 2. Application of the Agreement and precedence
2.1. Application by reference. The Agreement applies automatically to any Contract concluded between Amazing Soft and the Client on or after the date the Agreement is published, without a separate signature. Amazing Soft’s contracts, quotes and subscriptions refer to this Agreement by the address https://amazingsoft.ro/legal/data-processing-agreement/. The Agreement, together with the document by which the Client accepts it (Article 2.2), constitutes the written legal act, including in electronic form, required by Article 28(3) and (9) GDPR.
2.2. How the Client accepts. The Client accepts the Agreement by any of the following: (a) signing or accepting a Contract that refers to the Agreement; (b) accepting a quote or placing an order that refers to the Agreement; (c) signing the Accession Form (Article 2.6); (d) the Client’s written confirmation, including by e-mail.
2.3. Contracts in progress. Contracts in progress on the date the Agreement is published remain under their own data protection clauses. The Agreement becomes part of them upon the first accepted quote, order, addendum or renewal that refers to it, or when the Client accepts it under Article 2.2 or 2.6. Until then, Amazing Soft applies, as a unilateral undertaking and as the minimum standard of processing, the obligations it assumes under Articles 4, 6–14 and Annexes 1–3, without any new obligations for the Client.
2.4. Precedence. If the parties have signed an individual data processing agreement, that agreement prevails over this Agreement. If there is no individual agreement, this Agreement prevails over any conflicting clause in the Contract or in the Terms of Service as regards the processing of personal data. The Standard Contractual Clauses (SCCs) under Commission Implementing Decision (EU) 2021/915, if concluded in accordance with Article 2.5, prevail over this Agreement.
2.5. The Commission’s standard clauses. The Agreement is aligned with the controller-to-processor Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/915. At the Client’s request, the parties may conclude those clauses directly, completing their annexes with the information in Annexes 1–3 of this Agreement. The Agreement continues to apply to matters not governed by the standard clauses.
2.6. If the Client wants a signed document. The Client may: (a) complete and sign the one-page Accession Form, available at https://amazingsoft.ro/legal/dpa-accession-form/; or (b) request that the Agreement be attached as an annex to an existing Contract, by way of a one-page addendum referring to the version and date of the Agreement. Both options have the same effect as acceptance by reference.
2.7. Versions. Amazing Soft may update the Agreement to reflect legislative changes, guidance from the authorities or changes to the Services. New versions are published at the same address, with the version number and date, and apply to Contracts concluded after publication. Existing Contracts remain under the version accepted, unless otherwise agreed. Previous versions are retained and made available on request.
Article 3. Roles of the parties
3.1. General rule. In providing the Services, the Client is the Controller and Amazing Soft is the Processor. Amazing Soft processes Client Data exclusively on behalf of the Client and on the Client’s instructions.
3.2. The Client is itself a Processor. If the Client processes Client Data on behalf of a third-party controller (for example, an agency or a SaaS provider serving its own customers), the Client acts as Processor and Amazing Soft as Sub-processor. In that case: (a) the Client warrants that it has the controller’s authorisation to engage Amazing Soft; (b) the controller’s instructions reach Amazing Soft through the Client; (c) Amazing Soft’s obligations under this Agreement remain the same, and the Client remains responsible towards the controller.
3.3. Amazing Soft as Controller. For the data of the Client’s representatives and contact persons (name, position, e-mail, telephone, correspondence), for billing data and for its own contractual records, Amazing Soft is an independent Controller. These processing activities are described in the Privacy Policy (https://amazingsoft.ro/legal/privacy-policy/) and are not covered by this Agreement.
3.4. Own products. Amazing Soft’s products (for example Listero, DuoDive, Cluekeep, undepierzi.ro, Tasao) have their own terms and privacy policies, under which Amazing Soft is the Controller. This Agreement does not apply to the use of those products.
Article 4. Subject matter, duration, nature and purpose of the processing
4.1. The subject matter of the processing is the provision of the Services described in the Contract. The nature, purpose, types of data and categories of data subjects are described in Annex 1, by type of service. The Contract or a specific annex may detail or narrow these elements for a particular project.
4.2. The duration of the processing is the term of the Contract, plus the return and deletion period under Article 13.
4.3. Amazing Soft does not process Client Data for its own purposes and does not use it to train artificial intelligence models, for its own analytics or for marketing.
Article 5. Obligations and rights of the Client (Controller)
5.1. The Client is responsible for the lawfulness of the processing: the legal basis, informing data subjects, compliance with the principles in Article 5 GDPR and the exercise of data subjects’ rights.
5.2. The Client gives documented instructions (Article 6) and ensures that they comply with the law. The Client is responsible for the data it transmits or to which it gives Amazing Soft access, including data in production systems, databases, accounts, logs, CRM/ERP systems and communication channels.
5.3. The Client has the right to verify compliance with the Agreement under the conditions of Article 14 and to give reasonable additional instructions in connection with the processing.
5.4. The Client informs Amazing Soft if Client Data includes special categories of data (Article 9 GDPR), data relating to criminal convictions (Article 10 GDPR) or the personal identification number (CNP) and other data with a general identification function (Article 4 of Law no. 190/2018), so that the parties can agree additional measures.
Article 6. Documented instructions
6.1. Amazing Soft processes Client Data only on the Client’s documented instructions. The initial instructions are: the Contract, this Agreement and Annex 1. Subsequent instructions are given in writing (e-mail, ticketing system, signed document) and are kept together with the Contract.
6.2. Exception: Amazing Soft may process Client Data where required to do so by Union or Romanian law. In that case, Amazing Soft informs the Client before processing, unless the law prohibits such information on important grounds of public interest.
6.3. Amazing Soft informs the Client immediately if, in its opinion, an instruction infringes the GDPR or other data protection provisions. Amazing Soft may suspend the execution of the instruction until it is clarified, without being liable for the resulting delay.
6.4. Amazing Soft does not transfer Client Data to a third country or an international organisation except on the Client’s instructions or under the conditions of Article 11.
Article 7. Confidentiality
7.1. Amazing Soft ensures that the persons authorised to process Client Data (shareholders, employees, contractors) have committed themselves to confidentiality by written agreement or are under a statutory obligation of confidentiality.
7.2. Access to Client Data is granted only to persons who need it to provide the Services and is revoked when their involvement in the project ends.
7.3. The confidentiality obligation continues after the termination of the Contract.
Article 8. Security of processing (Article 32 GDPR)
8.1. Amazing Soft implements the technical and organisational measures described in Annex 3 (“Technical and Organisational Measures”), taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risks to data subjects.
8.2. Amazing Soft may update the measures in Annex 3, provided that the overall level of security does not decrease.
8.3. For the Client’s systems to which Amazing Soft is given access (production environments, databases, accounts, servers), the Client remains responsible for the security of those systems and for granting access on a least-privilege basis. Amazing Soft complies with the Client’s security policies communicated in writing.
Article 9. Sub-processors
9.1. General authorisation. The Client gives Amazing Soft a general authorisation to engage Sub-processors. The list of Sub-processors authorised on the date the Agreement is published is published at https://amazingsoft.ro/legal/subprocessors/ (Annex 2) and indicates for each: the entity, country, purpose, data location and transfer mechanism.
9.2. Notice of changes. Amazing Soft informs the Client at least 30 days before adding or replacing a Sub-processor, by updating the Sub-processors page and by e-mail to the Client’s contact address (or to the address subscribed to notifications as described on the Sub-processors page).
9.3. Right to object. The Client may object in writing, giving reasons, within 15 days of the notice. The parties seek a solution in good faith (for example, a configuration without the Sub-processor concerned or the use of the Client’s own account). If no solution is found within 30 days of the objection, either party may terminate the part of the Contract affected by the Sub-processor concerned, without penalty, with settlement of the Services provided up to that date.
9.4. Contract with the Sub-processor. Amazing Soft imposes on each Sub-processor, by contract, data protection obligations equivalent to those in this Agreement, in particular as regards security and instructions. Amazing Soft remains fully liable to the Client for the performance of the Sub-processors’ obligations.
9.5. Contractors. Amazing Soft may use external contractors (sole traders or companies, for example for design, WordPress or marketing) who work under a confidentiality agreement and under Amazing Soft’s instructions. They are Sub-processors within the meaning of this Article; their list is communicated to the Client on request, and the addition of a new contractor to a project is notified in accordance with Article 9.2.
9.6. Sub-processors chosen by the Client. If the Client requires the use of a particular provider (for example, its own hosting platform, its own CRM or its own account with an AI model provider), that provider is a processor of the Client, not a Sub-processor of Amazing Soft, and the Client is responsible for the contract with it.
9.7. Information on request. At the Client’s request, Amazing Soft makes available the information needed for the Client to verify the guarantees offered by Sub-processors (contract extracts, security pages, the provider’s public certifications), subject to the confidentiality clauses in the contracts with the providers.
Article 10. Artificial intelligence models (LLMs)
10.1. For automation and AI agent services, Amazing Soft may use language models provided via API by Anthropic and OpenAI (or other providers listed in Annex 2), as Sub-processors. The use of a model provider for Client Data is recorded in the Contract or in the project’s documented instructions.
10.2. Amazing Soft uses only commercial plans or APIs under which the provider contractually undertakes not to train models on the data transmitted. Where the provider offers the option, Amazing Soft requests zero data retention or the shortest retention period available. Retention periods are those set out in each provider’s terms, including the provider’s exceptions for legal obligations and for content flagged for breach of its usage policies.
10.3. Amazing Soft transmits to the model provider only the data necessary for the function concerned and applies, where feasible, data minimisation or pseudonymisation before transmission.
10.4. At the Client’s request, Amazing Soft configures the solution to use the Client’s own API keys or account with the model provider. In that case Article 9.6 applies, and the Client concludes the data processing agreement directly with the provider.
10.5. Amazing Soft does not use Client Data to train, fine-tune or evaluate its own or third-party models, except on the basis of a separate written instruction from the Client.
10.6. For the purposes of Regulation (EU) 2024/1689 on artificial intelligence, the Client that puts the system into service under its own name or trade mark generally has the status of provider and/or deployer of the AI system, and the language model providers (Article 10.1) are providers of general-purpose AI models; Amazing Soft develops the system on the Client’s order. The Client remains responsible for informing its own users and customers that they are interacting with an AI system (Article 50 of the Regulation) and for the other obligations incumbent on it in that capacity, to the extent the Regulation applies. At the Client’s request, Amazing Soft builds the technical mechanisms needed for that information (for example, the opening message of a conversational agent) and provides the Client with the technical documentation it holds.
10.7. The outputs generated by language models are probabilistic and may be inaccurate or incomplete; the consequences of this for the Services and the Client’s responsibility for verifying the outputs are governed by Article 13.4 of the Terms of Service. If an automated workflow produces or corrects personal data (for example, extracts data from a document), the Client, as Controller, determines the steps for verifying accuracy (Article 5(1)(d) GDPR), and Amazing Soft implements them in accordance with the Client’s instructions.
Article 11. International transfers
11.1. Rule. Client Data is processed in the European Economic Area (EEA). Transfers outside the EEA are made only to the Sub-processors in Annex 2 or on the Client’s instructions, using one of the mechanisms below.
11.2. Mechanisms. (a) Countries with a European Commission adequacy decision (Article 45 GDPR) — including the United Kingdom (decision renewed in December 2025, valid until 27 December 2031 unless extended), Switzerland and Canada (only for organisations subject to PIPEDA, i.e. commercial organisations) — without additional measures; (b) the United States: to organisations listed as active on the EU–US Data Privacy Framework (DPF) list on the date of the transfer (Decision (EU) 2023/1795) and, for non-certified organisations or as a fallback mechanism, the Commission’s Standard Contractual Clauses (SCCs) (Decision (EU) 2021/914, Article 46(2)(c) GDPR); Annex 2 indicates, for each Sub-processor, the mechanism actually used; (c) other countries, including the United Arab Emirates: the Standard Contractual Clauses under Decision (EU) 2021/914, supplemented by a transfer impact assessment and additional measures where necessary.
11.3. Clients outside the EEA as Controllers. If the Client is established outside the EEA and transmits data to Amazing Soft, the data enters the EEA, where the GDPR applies to the processing carried out by Amazing Soft. The Client is responsible for the lawfulness of the transfer under its own law: (a) Controllers in the United Kingdom may rely on the United Kingdom’s adequacy decision for the EEA or, if they prefer a contractual instrument, on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses; (b) Controllers in Canada, the United States or the United Arab Emirates comply with their local legislation; Amazing Soft signs the necessary annexes on request (for example, an SCC- or IDTA-type addendum), provided they do not contradict this Agreement.
11.4. Onward transfers. An onward transfer from Amazing Soft to a Sub-processor located outside the EEA is made only under the conditions of Articles 9 and 11.2.
Article 12. Assistance with data subjects' rights and with Articles 32–36
12.1. Data subject requests. If Amazing Soft receives a request from a data subject in connection with Client Data, it forwards the request to the Client within 3 working days and does not respond on the merits except on the Client’s instruction. Amazing Soft assists the Client, by appropriate technical and organisational measures, in fulfilling its obligation to respond to requests (access, rectification, erasure, restriction, portability, objection), to the extent the Services technically allow.
12.2. Personal data breaches. Amazing Soft notifies the Client without undue delay and no later than 48 hours after becoming aware of a personal data breach affecting Client Data. The notification includes, to the extent the information is available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed and the contact person. Information not initially available is provided as it becomes available. Amazing Soft assists the Client with the notification to the supervisory authority (Article 33 GDPR) and with the communication to data subjects (Article 34 GDPR).
12.3. Security, impact assessment and prior consultation. Amazing Soft assists the Client, taking into account the nature of the processing and the information available to it, in fulfilling the Client’s obligations regarding the security of processing (Article 32 GDPR, including through the information in Annex 3 and by answering questions about the measures applied to the Services), in carrying out data protection impact assessments (Article 35 GDPR) and in the prior consultation of the authority (Article 36 GDPR), in connection with the Services.
12.4. Hours and costs. Assistance is provided during working hours: Monday to Friday, 10:00–18:00, Romanian time, except for breach notification, which is made within the time limit in Article 12.2 regardless of working hours. Assistance is included in the price of the Services for ordinary requests. For requests that exceed a reasonable effort or that are caused by the Client’s instructions, Amazing Soft may invoice the time at the hourly rate in the Contract, after informing the Client in advance.
Article 13. Deletion and return of data
13.1. On termination of the Contract or completion of the Services, at the Client’s choice communicated in writing, Amazing Soft returns Client Data to the Client in a common, structured format or deletes it from active systems, and deletes existing copies, within 30 days of termination. If the Client does not communicate a choice within 30 days, Amazing Soft deletes the data.
13.2. Backup copies expire in the normal rotation cycle, no later than 90 days after deletion from active systems. Until then, backups remain isolated and are not used for any other processing.
13.3. Amazing Soft may retain data only to the extent required by Union or Romanian law, informing the Client, and only for that purpose.
13.4. On request, Amazing Soft confirms deletion in writing. Certificates of destruction are not issued.
13.5. Intellectual property in code, design and deliverables is governed by the Contract; this Article concerns personal data only.
Article 14. Demonstrating compliance and audits
14.1. Amazing Soft makes available to the Client the information necessary to demonstrate compliance with the obligations under Article 28 GDPR and this Agreement.
14.2. Annual questionnaire. Once a year, on request, Amazing Soft completes the Client’s written security and data protection questionnaire free of charge, responding within 30 days of receipt.
14.3. On-site audit. The Client, directly or through an independent auditor bound by confidentiality and accepted by Amazing Soft (acceptance not to be unreasonably withheld), may carry out an on-site or remote audit: (a) after a confirmed security incident affecting Client Data; or (b) at the request of a supervisory authority. The audit takes place with 30 days’ written notice, no more than once a year, during working hours (Monday to Friday, 10:00–18:00), without disproportionately disrupting Amazing Soft’s activity or the confidentiality of other clients, and is limited to the systems and processes relevant to Client Data. The costs of the audit are borne by the Client, including Amazing Soft’s time, at the hourly rate in the Contract.
14.4. Outside the situations in Article 14.3, verification is carried out through the questionnaire under Article 14.2, the documentation made available under Article 14.1 and the public reports or certifications of the Sub-processors, which Amazing Soft indicates on request.
Article 15. Liability
15.1. Each party’s liability to the other for breach of this Agreement is subject to the cap and exclusions in the Terms of Service: Amazing Soft’s total liability is limited to the fees actually received from the Client under the Contract concerned in the 12 months preceding the event or, for subscriptions, to the value of 12 monthly instalments, whichever is lower (Article 14.1 of the Terms of Service); indirect damages (loss of profit, loss of business or loss of data recoverable from backup) are excluded. The limitation does not apply to loss caused intentionally or through gross negligence and cannot restrict liability towards data subjects.
15.2. Liability towards data subjects and administrative fines are governed by Articles 82 and 83 GDPR and are not capped by this Agreement. Each party is liable for its own infringements of the GDPR; Amazing Soft is liable for damage caused by processing only where it has not complied with the obligations specifically directed to processors or where it has acted outside the Client’s lawful instructions.
15.3. The Client indemnifies Amazing Soft against third-party claims arising from unlawful instructions of the Client or from the absence of a legal basis for Client Data.
Article 16. Term and termination
16.1. The Agreement enters into force together with the Contract (or, for existing Contracts, at the moment set out in Article 2.3) and remains in force for as long as Amazing Soft processes Client Data, including during the period under Article 13.
16.2. If Amazing Soft seriously breaches this Agreement and does not remedy the breach within 30 days of notice, the Client may suspend the processing or terminate the affected part of the Contract.
16.3. Articles 7, 13, 15 and 17 survive termination.
Article 17. Final provisions
17.1. Governing law. The Agreement is governed by Romanian law and the GDPR.
17.2. Courts. Disputes are settled by the competent courts of Bucharest, Romania, after a 30-day attempt at amicable settlement.
17.3. Language. The Agreement is drawn up in Romanian. The English version is provided for information; in the event of any discrepancy, the Romanian version prevails.
17.4. Data protection contact. Amazing Soft is not legally required to designate a data protection officer (Article 37 GDPR) and has not designated one. The data protection contact is available at gdpr@amazingsoft.ro, with “Data protection” in the subject line.
17.5. Severability. If a clause is void, the rest of the Agreement remains valid, and the clause is replaced by a valid one as close as possible to its intended purpose.
17.6. Annexes. Annexes 1–3 form an integral part of the Agreement.
17.7. Expressly accepted clauses. By accepting the Agreement in any of the ways set out in Article 2.2, the Client confirms that it has read the Agreement and expressly accepts, within the meaning of Article 1203 of the Romanian Civil Code, the clauses on the limitation of liability (Article 15.1), the governing law and the jurisdiction of the courts of Bucharest (Articles 17.1 and 17.2) and the language (Article 17.3).
Annex 1. Details of the processing
The table describes the typical processing for each type of Service. The Contract or the checklist completed at the start of the project (kept in the project file) may narrow or specify these elements.
| Service | Nature and purpose of the processing | Types of data | Categories of data subjects | Duration | Typical access |
|---|---|---|---|---|---|
| Software development, mobile applications, UI/UX | Design, development, testing and release of applications; data migration on request; configuration of services (notifications, authentication, databases) | Identification and contact data of users, account data, user-generated content, technical data (device ID, logs, push notification tokens), data from test sets provided by the Client | Users of the Client’s applications, the Client’s employees, the Client’s customers | Duration of the project + Article 13 | Test environments and, on request, production; app stores (App Store Connect, Google Play Console); Firebase; hosted databases (Annex 2) |
| Hosting, maintenance and support (subscription or one-off interventions) | Hosting of websites and applications; monitoring, bug fixing, updates, interventions on production systems, restoration from backup, technical support | All data in the Client’s systems to which access is granted: user accounts, databases, logs (including IP addresses), e-mails, documents, CRM/ERP data, order and invoice data | Users, customers, employees, suppliers and partners of the Client | Duration of the subscription + Article 13 | Least-privilege, logged access to production; no copying into development environments without anonymisation |
| AI agents and automations | Building and operating conversational agents and automated workflows that collect, classify, generate and transmit information; integration with WhatsApp, e-mail, chat, CRM/ERP | Content of conversations (text, attachments, sometimes voice), telephone numbers, e-mail addresses, names, order or booking data, interaction history, execution logs | The Client’s customers and prospects, the Client’s employees who use the agents | Duration of the Contract + Article 13; agent logs are retained as instructed by the Client and, absent an instruction, for 90 days | AI model APIs (Article 10), automation platform hosted by Amazing Soft, the Client’s messaging channels |
| Websites and online shops | Building, migrating, configuring, hosting (on request) and maintaining WordPress/WooCommerce or custom websites; configuring forms, payments and cookie consent | Account and order data of the shop’s customers, contact form data, delivery addresses, server logs, data from analytics tools | Visitors and customers of the Client’s website, website administrators | Duration of the project or of the hosting + Article 13 | Admin panel, database, hosting; payment processors are processors of the Client |
| Branding, design, photo/video | Creation of visual identity, campaign materials and photo/video content; publication on the Client’s channels on request | Contact data of the Client’s team; images and recordings of the Client’s employees, representatives or customers, where they appear in the materials; access data for social media accounts | Employees, representatives and customers of the Client who appear in the materials | Duration of the project + Article 13; raw materials are deleted in accordance with the Contract | Project files, the Client’s social media accounts (on request) |
Special categories of data: not normally processed. If the Services involve health data, biometric data, sensitive financial data or data about minors, the Client informs Amazing Soft in accordance with Article 5.4 and the parties agree additional measures in writing.
Frequency: continuous for the duration of the Contract, with ad hoc access to systems depending on the tasks.
Annex 2. Sub-processors
The up-to-date list of Sub-processors, with entity, country, purpose, data location and transfer mechanism, is published and maintained at: https://amazingsoft.ro/legal/subprocessors/. The list as at the date of acceptance of the Agreement is deemed authorised under Article 9.1. Changes are notified in accordance with Article 9.2.
Annex 3. Technical and organisational measures
The description of the technical and organisational measures implemented by Amazing Soft in accordance with Article 32 GDPR is published at: https://amazingsoft.ro/legal/security-measures/. The version as at the date of acceptance of the Agreement is the applicable one, with the updates permitted by Article 8.2.
Amazing Soft SRL · VAT no. RO35387202 · J2016000150403 · office@amazingsoft.ro