Data processing agreement (DPA)

Last updated: 10 November 2026 · [Denumire firmă SRL / PFA]

This is an English translation provided for convenience. In case of any discrepancy, the Romanian version prevails. Organizations needing a signed version can request it at privacy@onement.ro.

This agreement forms part of the Terms of service of Onement. It is concluded between the organization using the Service (the "Controller") and [Denumire firmă SRL / PFA], VAT/ID [CUI], registered office [Adresa sediului], Cluj-Napoca, România (the "Processor"), and governs the processing of Members' (students, mentors) personal data on behalf of the Controller, under GDPR art. 28.

1. Subject and duration

The Processor processes the data described in Annex 1 solely to provide the Service, for the duration of the contract and until all data is deleted or returned.

2. Instructions

The Processor acts only on the Controller's documented instructions: these terms, the Controller's configuration of the Service (sign-up, request rules, matching weights, document storage location) and the actions of its users. Legal obligations are an exception; the Controller is informed beforehand where the law allows. The Processor informs the Controller if an instruction appears to infringe the GDPR.

3. Confidentiality

Persons authorized to process the data (the Provider's technical administrators) are bound by confidentiality and access data only when needed: support requested by the Controller, incidents, legal requirements.

4. Security

The Processor applies the measures in Annex 2 (GDPR art. 32) and may update them without lowering the overall level of security.

5. Sub-processors

The Controller gives general authorization for the sub-processors in Annex 3. The Processor gives at least 30 days' notice before adding or replacing a sub-processor (including when moving the service to another hosting provider). The Controller may object on reasonable grounds and, failing a solution, terminate without penalty. Sub-processors are bound by equivalent obligations. The Controller's own Nextcloud, if used for team documents, is the Controller's infrastructure and not a sub-processor.

6. Assistance

• Data subject requests: the Service allows viewing, correcting and deleting profiles; a full export of the organization is available on request. Requests received directly are forwarded without delay.
• Personal data breaches: notification without undue delay, within 48 hours of discovery, with the available information.
• Impact assessments: reasonable information, including a description of the matching logic (GDPR art. 35–36).

7. Transfers

Data is stored in the European Union ([OCI region, e.g. EU — Frankfurt (eu-frankfurt-1)]). Transfers outside the EEA take place only with the safeguards of GDPR chapter V, usually standard contractual clauses.

8. Deletion or return

On termination, the Controller can obtain the full export for 30 days. Data is then deleted from active systems and from backups at the end of rotation (at most 190 days), unless the law requires retention. Deletion is confirmed in writing on request.

9. Audit

The Processor makes available the information needed to demonstrate compliance (Annex 2, activity log, questionnaire answers) and allows inspections with reasonable notice, without compromising other customers' security. On-site audit costs are borne by the Controller unless a significant breach is found.

10. Liability and precedence

Liability is as set out in the GDPR and the Terms. In case of conflict on data protection, this agreement prevails.

Annex 1 — Description of processing

Annex 2 — Technical and organizational measures

• Encryption in transit: HTTPS/TLS on all domains, HSTS.
• Data separation: each organization has its own logical space, with composite foreign keys preventing cross-organization links; sessions are bound to the subdomain.
• Access control: named accounts, roles (owner, administrator, coordinator, mentor, student), workspaces visible only to members, mentors and coordinators; argon2 passwords, revocable sessions, sign-in rate limiting, CSRF protection; single-use, expiring invitation and reset tokens.
• Minimization: a student's e-mail is visible to a mentor only after acceptance; profiles can be hidden from mentors; documents are served only as attachments with headers preventing execution in the browser.
• Secrets: organizations' Nextcloud app passwords are encrypted in the database and never displayed.
• Traceability: activity log for important actions (sign-ins including failed ones, settings, decisions, moderation, edits and deletions in team workspaces with the previous version, restores), visible only to the Controller's owner and administrators, kept 12 months and then deleted automatically. The Processor's staff see only aggregate volumes, without content, people or IP addresses.
• Availability: automatic database backups, local (14 days) and encrypted (AES-256) in EU storage with rotation (at most 190 days), backup verification, documented restore procedure; encrypted copy of the export before an archived organization is deleted.
• Infrastructure: dedicated server in the EU, firewall allowing only web traffic and key-based SSH, automatic security updates, containerized application running as an unprivileged user, database not publicly exposed, with a separate role per application.
• Organizational: restricted administrative access, incident response procedure with notification within 48 hours.

Annex 3 — Sub-processors