DATA PROCESSING AGREEMENT (edition 2.15)
Between the household owner (hereinafter «you») and Firetech Engineering BG EOOD, company number 208214428, address: България, гр. София 1000, р-н Средец, ул. Леге № 6 (hereinafter «Domiq», «we»). Accepted together with the Terms of Service and forming part of them.
1. ROLES
You are the controller of the personal data of the people who work in your home: you decide who to add, what to keep about them and why. Domiq processes that data on your instructions and within their limits.
2. SUBJECT OF THE INSTRUCTIONS
What we process: name, contact details, photo, position and working conditions, tasks and reports on them, shifts and hours worked, cash advances and expenses, work documents, ratings of work, messages within the household.
Whose data: the people you invited into your household.
Why: so that the app works the way you use it.
For how long: while your household exists, subject to the retention periods in the Privacy Policy.
3. WHAT WE UNDERTAKE
- To process your staff's data only on your instructions and within the limits described above. Not to use it for our own purposes.
- To ensure confidentiality: access is held only by those of our people who need it to support the service, and they are bound by confidentiality.
- To apply protective measures: access separation on the server side, encryption in transit, closed file storage with time-limited links.
- To help you answer your employees' requests: provide a copy of data, correct it, delete it.
- To tell you about an incident affecting the data without undue delay, so that you can meet your own obligations.
- On the end of your use of the service, to delete the data within the periods stated in the Privacy Policy.
- To provide the information needed to demonstrate compliance with these obligations, and to allow an audit — by you or an auditor you appoint — on reasonable prior notice.
4. SUB-PROCESSORS
Your staff's data is processed by:
- Supabase — database and file storage, sign-in. Servers in the European Union.
- Groq — processing of AI model requests, speech recognition and translation of texts between workspace members. Servers in the United States. Requests and voice only for those who gave the corresponding consent.
- Expo — delivery of push notifications: the device address, the title and the text of the notification (for example, a task name). Servers in the United States.
- Resend — emails: invitations, address confirmation, password recovery. Servers in the European Union.
- Cloudflare — backup copy of files: photos, receipts, documents. Servers in the European Union.
- Sentry — app crash reports, with no name, email or screen contents. Servers in the European Union.
The full list of providers and what each receives is in section 4 of the Privacy Policy.
You give a general authorisation to engage service providers. We will notify you in advance of any change to that list; if a new provider is not acceptable to you, you may stop using the service.
Every provider is bound by obligations no lower than those described here.
5. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA
Data goes to the United States to Groq and Expo. The transfer is based on the European Commission's standard contractual clauses (Decision 2021/914), which form part of our agreement with each of them; who receives what and what it means is in section 5 of the Privacy Policy.
6. WHAT YOU UNDERTAKE
- To have a lawful basis for collecting data about your workers and to tell them what information you keep. The app shows everyone who joins a notice of what is visible about them, but it does not replace your obligations as an employer.
- Not to enter information you are not entitled to collect: about health, beliefs, origin and the like, unless you have a lawful basis for it.
- To answer your workers' requests about the content of data — ratings, pay rate, documents. Storage and deletion are ours to answer for.
7. ANONYMOUS AGGREGATED DATA
Separately and explicitly: anonymous information about how a household is customarily run — with no names, addresses or anything pointing to you or your people — is used by us only with your separate consent, which is withdrawn in settings. Staff data in personal form is never used for these purposes, and your consent cannot stand in for that: you cannot consent on behalf of your workers.
8. TERM
In force while you use the service. Confidentiality obligations survive it.
9. GOVERNING LAW
The law of the Republic of Bulgaria and the law of the European Union. The General Data Protection Regulation (EU) 2016/679 applies to the processing.