This agreement is part of the Radzen Factory terms and applies to the personal data of others that you put into Radzen Factory or into the apps Radzen hosts for you. For that data, you are the controller and Radzen Ltd, Sofia Park 118, 1766 Sofia, Bulgaria, UIC 204049114, VAT BG204049114, is your processor (GDPR Art. 28).
Radzen uses what you put into Radzen Factory, such as prompts, attachments, sample rows and app code, to build your apps, and hosts your published apps and their databases: it stores and serves them, backs them up and restores them, and keeps recent logs. The data is whatever you or your apps' users enter about other people. You must not use a hosted app for special categories of data (Art. 9) or data about criminal convictions (Art. 10).
Radzen processes the data only on your instructions: the terms, this agreement, and what you do in Radzen Factory, such as publishing, unpublishing or deleting an app. Radzen tells you if it believes an instruction breaks data protection law, and processes the data otherwise only where EU or Member State law requires it, telling you first unless that law forbids it.
Everyone at Radzen who can access the data is bound by confidentiality, and Radzen's administrators do not sign in to your apps. Radzen keeps each app in its own isolated container with its own database, encrypts traffic to the app and to its database, and backs databases up with tested restores (Art. 32).
You authorise the sub-processors listed in the privacy notice. Radzen binds each to obligations no less protective than this agreement and remains responsible for them. Radzen announces a new or replaced sub-processor there and by email at least 30 days in advance; you may object within that time and, if no solution is found, stop hosting the affected apps. Data leaving the EU is protected by the EU-U.S. Data Privacy Framework where the sub-processor is certified, and otherwise by the European Commission's Standard Contractual Clauses.
Radzen forwards to you any request it receives from your app's users and helps you answer such requests. It gives you the information you reasonably need for security, impact assessments and consultations (Art. 32-36). It tells you about a personal data breach affecting your app without undue delay, with what you need to notify it yourself (Art. 33).
You can download your data and your app's database at any time. Radzen deletes the data when you delete it, the app or your account, and when your subscription ends, as the privacy notice describes. Deleted data leaves backups within about five weeks. Radzen keeps no other copies unless EU or Member State law requires it.
Radzen gives you the information needed to show it meets Art. 28, answers reasonable written audit questions, and allows and contributes to audits. An on-site inspection, by you or an auditor you mandate, takes place at most once a year, with 30 days' notice, at your cost.
Liability under this agreement, including under the Standard Contractual Clauses, falls under the limit in the terms. Neither party compensates the other for fines imposed on it. This agreement prevails over the terms on data protection. Write to Radzen at info@radzen.com; Radzen writes to your account's email address.