Data processing agreement

This agreement applies when Hovhannes Torosyan IE ("we", the processor) processes personal data on behalf of a client ("you", the controller) while delivering plans, audits or hourly work. It forms part of our terms.

Scope

We process personal data only where it's needed to build, run and support your infrastructure: for example, when it's stored in systems we operate, appears in logs, or is part of a migration. The types of data and data subjects are whatever your systems hold.

Your instructions

We process personal data only on your documented instructions, which are our agreement and your requests during the work. If we think an instruction breaks data protection law, we tell you.

Confidentiality and security

• Only the three engineers of Hovhannes Torosyan IE have access, and all are bound by confidentiality.
• We use least-privilege access, multi-factor authentication and encrypted connections, and we work inside your cloud accounts rather than copying data out of them.
• We don't keep copies of your data on our own devices or systems beyond what the work requires.

Sub-processors

Your data stays in the cloud accounts and services you choose. We don't add sub-processors that store your personal data without telling you first and giving you the chance to object.

Personal data breaches

We tell you without undue delay after we become aware of a breach affecting your data, and help you meet your own notification duties.

Helping you

We help you answer data subject requests, carry out impact assessments and demonstrate compliance, as far as our role allows.

International transfers

We work from Armenia. Where GDPR applies and personal data is accessed from outside the EU or UK, we rely on the European Commission's standard contractual clauses, signed as part of your proposal.

End of the work

When our work ends, we return or delete personal data at your choice, unless the law requires us to keep it.

Audits

We make available the information you need to show we meet this agreement, and allow reasonable audits with notice.

Health data

For HIPAA-scoped work, a separate business associate agreement applies and takes precedence for protected health information.

Contact

Hovhannes Torosyan IE, Armenia, Yerevan, Vardanants 10, apt. 11. info@devopsy.services.