Zer.lv Data Processing Agreement

1. Status, parties and precedence

This DPA is concluded electronically between the Zer.lv customer identified in the account and SIA FIXLAB, registration No. 40203523267, legal address Liepu aleja 38, Babīte, Babītes pag., Mārupes nov., LV-2101, Latvia. Acceptance of the Zer.lv Terms includes acceptance of this DPA.

For workspace personal data the customer is the controller and SIA FIXLAB is the processor. If the customer itself acts as a processor, it confirms that the relevant controller has authorised the instructions and the appointment of SIA FIXLAB and its subprocessors. This DPA prevails over the Terms only to the extent of a conflict concerning processing on behalf of the customer.

2. Subject matter and duration

SIA FIXLAB processes workspace personal data for the subscription term and the subsequent return and deletion period solely to provide, secure, maintain, support, back up and recover Zer.lv. This DPA remains effective until SIA FIXLAB has deleted or returned all workspace personal data in accordance with section 16 of this DPA, ‘Return and deletion’.

3. Documented instructions

The Terms, this DPA, the customer's configured settings, authorised use of Zer.lv and written requests accepted by SIA FIXLAB constitute documented instructions. SIA FIXLAB processes and transfers workspace personal data only on those instructions, unless EU or Latvian law requires otherwise. In that case SIA FIXLAB informs the customer before processing unless the law prohibits notification.

An instruction outside the ordinary Zer.lv service requires prior written agreement and may be subject to reasonable technical limits, implementation time and cost. SIA FIXLAB promptly informs the customer if an instruction appears to infringe applicable data-protection law and may suspend that instruction while the parties clarify it.

4. Purpose, nature and processing operations

Purposes include operating the CRM workspace; authentication and access control; managing clients, devices, orders, services, inventory, sales, finance, employees and reports; generating documents; storing comments and attachments; delivering optional notifications; providing support; maintaining security logs; and backup and recovery.

Operations may include receiving, collecting, recording, organising, structuring, storing, retrieving, consulting, updating, transmitting, restricting, backing up, restoring, exporting at the customer's request and deleting data. SIA FIXLAB does not sell workspace personal data or use it for third-party advertising.

5. Categories of data subjects

Data subjects may include the customer's clients and prospective clients; the customer's owners, employees and contractors; suppliers and their representatives; payers, contact persons and any other individual whose data the customer lawfully enters into the workspace.

6. Categories of personal data

The data may include names, roles, company details, addresses, telephone numbers and email addresses; client history; device type, brand, model, IMEI and serial number; orders, reported defects, diagnostics, repair results, services, products, comments, attachments and communications; employee assignments, permissions and remuneration calculations; sales, transaction amounts and payment method without payment-card credentials; IP address, session, device, application, security and audit records; and other free-text or files deliberately uploaded by the customer.

7. Restricted data

Zer.lv is not designed for payment-card credentials, account passwords, authentication secrets, extensive government-identification records, criminal-offence data or special categories of personal data. The customer must not enter such data unless it is strictly necessary, lawful, proportionate and protected by appropriate safeguards agreed with SIA FIXLAB. The customer remains responsible for avoiding unnecessary confidential data in free-text fields and attachments.

8. Customer obligations

The customer ensures a lawful basis and transparent notices, responds to data-subject requests, applies data minimisation and retention limits, keeps data reasonably accurate, gives access only to authorised personnel, configures roles appropriately, protects user credentials and devices, and ensures that its instructions and exports comply with applicable law. The customer must notify SIA FIXLAB without undue delay of suspected unauthorised access affecting the workspace.

9. Processor obligations and confidentiality

SIA FIXLAB processes workspace personal data only as described in this DPA and limits access to authorised persons who require it for support, security, recovery, maintenance, abuse investigation or legal compliance. Such persons are bound by contractual or statutory confidentiality duties. Access by platform administration or support is restricted and logged.

10. Technical and organisational security measures

Taking account of the state of the art, implementation costs, processing context and risk, SIA FIXLAB maintains measures including logical isolation of company workspaces; role-based access and least privilege; password, authentication and protected-session controls; request-rate and request-origin protections; encryption in transit and protection of attachments and backups at rest; private file storage with access, size, type and malware controls; audit and login logging; restricted server and secret access; security maintenance and dependency review; encrypted rolling backups and recovery checks; and incident identification, containment, recovery and review.

Measures may be updated to reflect technical progress, provided the overall protection is not materially reduced. Security information that would create a meaningful risk to Zer.lv or other customers may be supplied under confidentiality rather than published.

11. Data-subject requests and compliance assistance

If SIA FIXLAB receives a request concerning workspace data directly from a data subject, it promptly forwards the request to the customer and does not respond on the substance unless authorised by the customer or required by law. Taking account of the nature of processing and available information, SIA FIXLAB reasonably assists the customer with access, correction, deletion, restriction, portability and objection requests, and with obligations under Articles 32–36 GDPR, including data-protection impact assessments and supervisory-authority consultations.

12. Personal-data breaches

Upon becoming aware of a personal-data breach affecting workspace data, SIA FIXLAB notifies the customer without undue delay; a completed investigation is not a condition. The initial notice gives available facts about the nature and affected data, a contact point, likely consequences and containment or remedial measures. Unknown details are identified and supplemented as they become available. SIA FIXLAB records its assessment and response. Notification is not an admission of liability.

13. Public-authority requests

SIA FIXLAB informs the customer of a legally binding request, inquiry or investigation concerning workspace data unless law prohibits notification. SIA FIXLAB reviews the legal basis, limits disclosure to what is required and, where appropriate and legally available, challenges an unlawful or disproportionate request.

14. Subprocessors

The customer gives general written authorisation for the subprocessors listed below. SIA FIXLAB imposes data-protection obligations substantially equivalent to this DPA and remains responsible for the performance of their processing obligations.

Hetzner Online GmbH, Germany/EEA — infrastructure hosting, network, workspace database, private file storage and protected backups. Google Cloud EMEA Limited, Ireland — Firebase Cloud Messaging, only when Android push notifications are enabled; processing is limited to a device push token and the notification or order-event metadata needed for delivery.

SIA FIXLAB gives the account email at least 14 days' advance notice of any intended addition or replacement of a workspace subprocessor, identifying its entity, location and processing activity, before access starts. The customer has an opportunity to object on reasonable data-protection grounds during that period. The parties seek a compliant alternative; otherwise the affected optional function can be disabled or the affected service terminated before the change. An urgent event does not dispense with GDPR authorisation and notice requirements. Brevo currently processes SIA FIXLAB's own transactional account and subscription correspondence as its controller's provider; using it for workspace messages requires this procedure first.

15. International transfers

Primary Zer.lv workspace hosting is in the EEA. If a subprocessor or its approved subprocessor transfers workspace personal data outside the EEA, SIA FIXLAB ensures that the transfer complies with Chapter V GDPR through an applicable adequacy decision, approved Standard Contractual Clauses and supplementary measures where required, or another lawful mechanism. The customer may request information about the applicable mechanism at fixlablv@gmail.com.

16. Return and deletion

Only the workspace owner may download company exports. A full owner export is available at /workspace-export in a structured JSON and TAR.GZ archive with the workspace's uploaded files, relationships, metadata and a checksum manifest. It excludes authentication secrets, other customers' information, platform source code and protected internal security information. Expiry of a paid period alone does not remove this export right while data is retained; if ordinary sign-in is restricted, verified export can be requested at fixlablv@gmail.com without purchasing another subscription.

The customer can request switching to another provider or its own infrastructure, or erasure, through /workspace-export or fixlablv@gmail.com, identifying the workspace and requested destination or action. No contractual notice period is required for such a request. SIA FIXLAB confirms receipt, verifies authority and agrees the transition and retrieval dates. The normal transition is no longer than 30 calendar days from the request; any technically necessary extension is explained within 14 working days and handled within the mandatory limits of the EU Data Act where applicable. SIA FIXLAB reasonably assists continuity and secure transfer; the customer arranges the destination and validates the received data. Data remains available for retrieval for at least 30 calendar days after the transition ends, unless the customer explicitly requests earlier erasure. No switching or export fee is charged. The provider's software and trade secrets need not be transferred. Mandatory switching rights prevail over contrary terms. The customer may extend the transition once for a period appropriate to its needs. A provider-proposed technical extension must state reasons and an alternative period not exceeding seven months. Successful switching ends the affected service contract and SIA FIXLAB notifies the customer; an erasure-only request ends it on the agreed termination date without a contractual notice delay. Exportable categories are customer/contact and supplier records; devices; orders, parts, services, comments and their history; products, warehouses, stock and receipts; appointments and vacations; sales, finance, accounting and cash-journal records; employee assignments and remuneration inputs; workspace settings, roles and document templates; the customer's requests and referral benefits; its subscription/invoice records, legal-document evidence and uploaded originals/previews. Relationships and timestamps are included. Ordinary self-service export captures up to 128 MiB of record/evidence data and individual retained attachments up to 64 MiB; larger data and missing files require a managed export, not forfeiture of switching rights. The open authenticated export interface is POST /api/workspace-data/export. It returns documented JSON in TAR.GZ and a SHA-256 manifest; no proprietary source-system importer is required. Internal sessions, authentication credentials, anti-abuse infrastructure and other companies' data are excluded. Importing into the destination and converting destination-specific fields are the customer's or destination provider's responsibility, subject to SIA FIXLAB's mandatory assistance duties.

A verified erasure request is distinct from expiry or non-renewal. Active workspace records and uploaded files are removed normally within 30 days after the agreed retrieval period or an explicit erasure instruction. Application-managed encrypted daily backup remnants expire on the configured rolling cycle, currently 30 days; provider backup and snapshot deletion is managed separately and is not represented as occurring through the application. Retained backups are isolated, not used for ordinary operations, and deletions must be reapplied on restoration. SIA FIXLAB retains only the records independently required by law or necessary for a substantiated claim, for that purpose and its applicable period, not an entire workspace as an accounting record. Restoration after final erasure is not guaranteed.

Order-comment attachments. Each order may store up to four PNG/JPG/JPEG photos and four PDFs across all comments; other upload formats are not accepted. Each photo is limited to 3 MB; each PDF is limited to 5 MB and 5 pages. These attachments are automatically and permanently deleted from active storage 90 days after upload. Existing attachments receive a full 90-day period from activation of this rule, without retroactive immediate deletion; the displayed expiry date applies. Download and retain any files you need before that date. Comment text and the order remain. This rule does not delete accounting or stock-receipt documents and does not replace the customer's legal record-retention duties. Backup remnants follow the separately stated backup lifecycle.

17. Evidence and audits

SIA FIXLAB provides information reasonably necessary to demonstrate compliance with Article 28 GDPR. Documentation and remote evidence are used first. Subject to confidentiality and security, the customer may conduct a proportionate audit no more than once in any 12-month period with at least 30 days' written notice, during normal business hours and without disrupting other customers. A qualified independent auditor must not be a competitor and must be bound by confidentiality. The customer bears reasonable audit costs, unless the audit identifies a material breach by SIA FIXLAB. Frequency and notice limits do not apply after a material incident, credible indication of non-compliance or a competent authority's request.

18. Termination and contact

If SIA FIXLAB cannot comply with this DPA, it informs the customer and may suspend the affected processing until compliance is restored. The liability and governing-law provisions of the Zer.lv Terms apply without limiting rights or duties that cannot lawfully be limited. Privacy and DPA notices must be sent to fixlablv@gmail.com.