Data Processing Agreement

Controller (data controller): the Miridar CRM customer who decides the purpose and means of processing the data entered into the app.

Processor (data processor): Miridar (MiriDar HR + IT Agency SRL), who processes data exclusively on behalf of the customer, per documented instructions.

Miridar processes customer data for the duration of the subscription plus 90 days post-cancellation (for final export). Data types include:

• Contact data (name, email, phone of the customer's contacts)
• Deal/contract data (amounts, status, history)
• HR data (if HR App is active): employment contracts, time tracking, leave, CVs, documents
• App usage data (audit log)

Miridar undertakes to:

• Process data only per the customer's documented instructions.
• Ensure confidentiality — data access is restricted to authorized personnel under non-disclosure clauses.
• Implement appropriate technical and organizational measures: TLS encryption in transit, AES-256 at rest, 2FA for personnel, audit log, daily backup, EU hosting.
• Assist the customer with data-subject requests (access, rectification, erasure, portability).
• Notify the customer without undue delay if a security breach occurs.
• Allow audits on reasonable request, with 30 days' notice.

To deliver the service, Miridar uses the following authorized subprocessors:

• Amazon Web Services (AWS) Frankfurt — hosting, databases, backup (European Union)
• Cloudflare — DNS and DDoS protection
• Google (gtag/GA4) — aggregated analytics on the marketing site (NOT on the CRM application)

For BYO integrations (AI: OpenAI / Anthropic; Email: Mailjet), the customer contracts directly with that provider — Miridar only facilitates the connection, transmits no data of its own.

30 days' notice before adding a new subprocessor. The customer may object with reason; if no replacement is found, the contract may be terminated without penalty.

Data stays in the EU on AWS Frankfurt infrastructure. We do not transfer data outside the EEA without a GDPR legal basis (standard contractual clauses or European Commission adequacy decision).

The customer, as controller, is responsible for responding to data-subject requests (employees, contacts). Miridar assists technically — we provide:

• Complete data export (Excel, CSV, JSON) for portability / access requests
• Data deletion feature for 'right to be forgotten' requests
• Audit log for all changes on a specific contact

In case of a breach, Miridar notifies the customer within 72 hours of becoming aware, with:

• Nature of the breach
• Categories and approximate number of data subjects
• Likely consequences
• Measures taken or proposed for remediation

At the end of the contract, the customer has 90 days to export all data. After that, Miridar irreversibly deletes the customer's data from production within 30 days, including from backup (in the normal 30-day post-active retention cycle).

This DPA is an integral part of the Terms accepted by the customer when signing the Cloud or Self-hosted subscription. For a physically/electronically signed DPA, email office@miridar.com — we send it within 2 business days.