Data Processing Terms

Version 2026-10 · effective from 1 November 2026

This is an English translation for convenience. The Czech version is legally binding.

Annex to the Terms of Service. The Customer accepts them together with the Terms in the order.

1. Parties and subject matter

The Customer (controller) instructs Rebis services, s.r.o., company ID 22342508 (processor), to process personal data the Customer and its Users put into the our* family services, for the duration of the contract and until erasure under Article 9.

2. Nature and purpose

Storage, display, modification, transfer, backup, restoration and erasure of data to the extent needed to provide the Services under the Terms, to maintain them and to fix faults, including creating an anonymised copy for development and troubleshooting (data from which no individual can be identified).

3. Types of data and data subjects

• Data subjects: the Customer’s employees and collaborators, its business partners and contact persons, other persons whose data the Customer puts into the Services.
• Data: identification and contact data, work data (attendance, working time, leave, timesheets, tasks, jobs), content of documents, files, mail and messages, operational usage data. The Customer is not to put special categories of data (Art. 9 GDPR) into the Services; if it does, it is responsible for the legal basis.

4. Processor’s obligations

The processor:

1. processes data only on documented instructions of the Customer; the instructions are these terms and the settings and actions in the Services. It notifies the Customer if in its opinion an instruction infringes the law;
2. ensures confidentiality of all persons with access to the data;
3. takes measures under Art. 32 GDPR: encrypted connections, separation of organisations’ data, role-based access control, password hashing, two-factor authentication, monitoring, backups to a second site and to removable disks, physically secured own premises in the Czech Republic;
4. assists the Customer with data subject requests and obligations under Art. 32–36 GDPR;
5. notifies personal data breaches to the Customer without undue delay, at the latest within 48 hours of becoming aware;
6. makes available the information needed to demonstrate these obligations and allows audits, by prior agreement on date and scope, at most once a year unless investigating a breach.

5. Sub-processors

The Customer gives general authorisation to engage sub-processors. As of the effective date they are:

We announce changes of sub-processors by e-mail to the contact person from the order at least 30 days in advance. If the Customer does not agree with the change, it may terminate the contract as of the date of the change. Each sub-processor is bound by a contract with obligations of the same level.

6. Transfers outside the EU

Transfers to the USA rely on the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914, module 3 — processor to processor) in our contracts with the sub-processors.

7. Location

Customer data are stored on the processor’s own servers in the Czech Republic. Exceptions exist only to the extent of Article 5.

8. Assistance with legal obligations

On request the processor provides information for data protection impact assessments and records of processing activities.

9. End of processing

After the contract ends the processor, at the Customer’s choice, returns the data (export in a common format) or erases them within the periods under Article 6 of the Terms. Data disappear from backups when their period expires (at most 365 days). Data the processor must keep by law are kept only as long as necessary.

10. Liability and precedence

Liability follows Article 10 of the Terms and Art. 82 GDPR. In matters of personal data protection these Data Processing Terms prevail over the Terms in case of conflict.