Data Processing & GDPR

This page describes how GTVA, s.r.o. handles personal data when providing infrastructure services to clients. It explains the roles and principles that apply; the binding terms are set out in a Data Processing Agreement tailored to each engagement.

Roles

When GTVA designs, commissions or operates infrastructure for a client, the client will generally act as the data controller and GTVA as the data processor, where GTVA processes personal data on the client’s documented instructions.

Our commitments as processor

In that role, GTVA:

• processes personal data only on the client’s documented instructions, unless otherwise required by applicable EU or Member State law;
• applies appropriate technical and organisational security measures in accordance with Article 32 GDPR;
• ensures that personnel with access are bound by confidentiality;
• engages sub-processors only as permitted by the applicable Data Processing Agreement and, where required, with the client’s prior written authorisation, subject to appropriate contractual data-protection obligations;
• assists the client, where required by Article 28 GDPR and the applicable Data Processing Agreement, with data-subject requests, security obligations and personal-data breach notification;
• provides information reasonably necessary to demonstrate compliance with the applicable data-processing obligations and supports audits or assessments as provided for in the applicable Data Processing Agreement;
• on completion of the services, returns or deletes personal data as the client directs, subject to any legal retention requirement.

Where data is processed

GTVA’s services are designed to support processing within the European Union. Where an engagement requires processing outside the EU/EEA, the applicable transfer mechanism and safeguards are addressed in the Data Processing Agreement.

The binding agreement

This page is a summary for information only. For each engagement, GTVA and the client enter into a Data Processing Agreement under Article 28 of the GDPR, setting out the subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subjects, and the specific obligations of each party. The applicable Data Processing Agreement, not this summary page, governs the processing relationship between GTVA and the client.