Data Processing Agreement
Effective: 20 October 2026; supplemented for site-survey data, inspection records and purchasing documents.
An agreement under Article 28 GDPR, which forms an integral part of the Terms of Service; it is concluded between the User and the Operator upon registration.
Parties: the registered user (Controller, hereinafter: the User), and Agro Automatika Kft., 3531 Miskolc, Kiss Ernő u. 17., [email protected] (Processor, hereinafter: the Operator).
1. Subject matter and duration
In the course of using Avenler, the User enters into the system personal data of its own customers (clients, contact persons). The controller of these data is the User; the Operator stores and processes them on behalf of the User, in accordance with the User's instructions, to the extent necessary for providing the service. The agreement remains in force for as long as the account exists and until the end of the return/deletion process following deletion under section 7.
2. Characteristics of the processing
| Nature and purpose | storage, display, editing, project sharing on the User's instructions, preparation of quotations, purchasing and technical documents, inspection records and PDFs, backup, recovery |
| Categories of personal data | a client's or supplier's name, address and contact details; data contained in the free text of projects, quotations, purchasing and technical documents; labels on floor plans; the issue description and photo from a site survey; measurement data and signatory data entered by the User in an inspection record |
| Data subjects | the User's clients, contact persons, suppliers and persons appearing in a site survey or inspection record |
| Special categories of data | not envisaged; the User must not enter special categories of data (e.g. health data) |
3. Obligations of the Operator
The Operator:
- processes personal data only on documented instructions from the User (the intended use of the Service and this agreement constitute instructions); if it considers that an instruction infringes the law, it informs the User thereof;
- ensures that persons who have access to the data have committed themselves to confidentiality;
- takes the technical and organizational measures required under Article 32 GDPR and summarized in Annex 1;
- engages another processor (other than those named in section 4) only with the User's prior general authorization; it notifies any change on the interface/by e-mail at least 15 days in advance, and the User may object to the change or close its account; the new processor is subject to the same obligations;
- assists the User, within reasonable limits, in fulfilling data subject rights: if a data subject contacts the Operator, it forwards the request to the User within 5 working days;
- assists the User in fulfilling its obligations under Articles 32–36 (security, breach notification, impact assessment);
- notifies the User of any personal data breach within 48 hours of becoming aware of it, at the User's registered e-mail address, stating the nature of the breach, the categories of data concerned and the measures taken/planned;
- at the User's request, makes available the information necessary to demonstrate compliance and allows inspections (audits) – an inspection may not jeopardize the operation of the system, requires prior agreement, is carried out at the User's expense, and may not affect the data of other users.
4. Further processors engaged
| Processor | Task | Data concerned |
|---|---|---|
| Hosting: Private server | operating the application and the database (and its backups) | all data stored in the Service |
| Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) | forwarding and protecting the traffic between the browser and the Service (reverse proxy, filtering out denial-of-service attacks and bot traffic) | all data passing through its network (the data entered into and displayed from the Service), for the duration of forwarding; transfers to the USA are based on the EU–US Data Privacy Framework or on standard contractual clauses (SCC) |
The e-mail service provider delivering the system e-mails (Google Ireland Limited) does not receive the data of the User's clients: only the User's own e-mail address and the content of the system e-mail reach it; this is therefore processing carried out by the Operator as controller under the Privacy Notice.
In sign-in with a Google account, Google (Google Ireland Limited, identity provider) likewise acts as an independent controller, not as a processor: it does not receive the data of the User’s customers, and passes to us only the User’s verified e-mail address and Google identifier, as described in the Privacy Notice. Using Google to sign in is optional: you can also sign in with an e-mail address and password.
5. Transfer of data to third countries
The Operator does not store the personal data of the User's clients outside the EEA. Cloudflare, Inc. (section 4), which forwards the traffic, is a provider established in the United States: the transfer of the data passing through its network is based on its certification under the EU–US Data Privacy Framework or on standard contractual clauses (SCC).
6. Obligations of the User
The User is responsible for ensuring that entering the data is lawful (appropriate legal basis, information provided to data subjects), that the data entered are limited to what is necessary for the purpose, and that its use of the Service does not infringe the law. The User, as controller, responds to the requests of data subjects.
7. Return and deletion of data
Upon deletion of the account (or termination of the contract), the Operator, at the User's choice, provides a machine-readable copy of the data before deletion, and then deletes them from the live database immediately and from the backups within no more than 90 days. Where there is a statutory retention obligation, the deletion does not take place; the Operator will inform the User thereof.
8. Liability, governing law
Liability is governed by Article 82 GDPR and section 7 of the Terms of Service. The agreement is governed by Hungarian law.
Annex 1 – Technical and organizational measures (Article 32 GDPR)
- Access protection: individual accounts; passwords only as one-way, salted hashes (ASP.NET Core Identity), passwords of at least 10 characters; lockout after failed attempts; rate limiting; request origin (Origin) checking; each user can access only their own data.
- Communication: HTTPS (for live, public access); the session cookie is HttpOnly, SameSite=Lax, and Secure over HTTPS; security response headers.
- Storage: the database and the storage for site photos are within the server's network, not on a port accessible from the internet; the database password is stored encrypted.
- Availability, recovery: daily, verified database backup with 90-day retention; recovery procedure and test restore.
- Organizational: the Operator's access is limited to troubleshooting and backups, subject to confidentiality; written procedures for data subject requests and personal data breaches; updating the system with the available security patches.