Data Processing Agreement

Version 2026-10-16 · Art. 28 GDPR

This Data Processing Agreement ("DPA") forms part of the Terms of Service between [COMPANY NAME], [REGISTERED ADDRESS], IČO [IČO] ("Processor"), and each business customer ("Controller") whose Content contains personal data. It applies automatically when such a customer uses the Service; a signed copy is available on request at support@restandtest.xyz.

1. Subject, duration, nature and purpose

The Processor processes personal data contained in the Controller's Content (API documentation, example requests and responses, test code) only to provide the Service: generating, storing, running and repairing tests. Processing lasts for the term of the Controller's account.

2. Types of data and data subjects

Any personal data the Controller puts into its Content, typically sample values such as names, email addresses or identifiers of the Controller's users, employees or customers. The Controller should not include special categories of data (Art. 9 GDPR).

3. Processor's obligations

Process the data only on the Controller's documented instructions, which are these Terms and the Controller's use of the Service, unless EU or Czech law requires otherwise.
Ensure that persons authorised to process the data are bound by confidentiality.
Implement the technical and organisational measures in section 5.
Assist the Controller with data subject requests, security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of processing.
Notify the Controller of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it.
At the end of the service, delete the data (account deletion removes stored tests at once; diagnostic logs are deleted within 30 days), unless law requires storage.
Make available the information needed to demonstrate compliance and allow audits by the Controller or its auditor on reasonable notice, at most once a year unless a breach occurred.

4. Sub-processors

The Controller authorises these sub-processors: Hetzner Online GmbH (hosting, data centre in Finland), Anthropic PBC (AI model, USA). The Processor imposes on them data protection obligations equivalent to this DPA and informs the Controller by email at least 30 days before adding or replacing a sub-processor; the Controller may object and, if no solution is found, terminate the affected service with a pro-rata refund. Transfers to the USA rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

5. Technical and organisational measures

Encryption in transit (TLS) for all connections to the Service and its sub-processors.
Access to servers by SSH key only, restricted to authorised staff; brute-force protection; the application runs under a dedicated unprivileged account.
Database and configuration files readable only by the application account.
Diagnostic logs deleted automatically after 30 days; technical logs rotated and deleted after 30 days.
Passwords stored as salted PBKDF2-SHA256 hashes; secret values (API keys, tokens) of the Controller are not sent to the Service during generation.
Vulnerability handling as described in the Terms, section 15.

6. Liability and precedence

Liability under this DPA follows the Terms. If this DPA and the Terms conflict on the protection of personal data, this DPA prevails. Czech law governs this DPA.