Data processing agreement

1. Who is who

Leyser Rosales (sole trader, domiciled in Malta) provides the service as the PROCESSOR. The company that contracts the service is the CONTROLLER: it decides what the data is for and answers to the people concerned and to the supervisory authority.

Contact for any data matter or to request a signed copy: sleyer90@hotmail.com.

2. What data and whose

From the company team: name, email, trade, role, language and sessions.

From whoever reports through a QR code: the problem text, the area, the photo and the name if they write it. No account and no email.

From work orders: area, urgency, status, dates, assignment, resolution, costs and invoice photos.

Technical data: access logs and an irreversible hash of the IP address to limit abuse.

No health data or other special categories are requested. If the company writes them in a report, it is the company that needs a legal basis to do so.

3. Instructions and limits

Mantuni processes the data only to provide the contracted service, keep it secure and comply with the law. It is not used for advertising, not sold, and not shared with third parties unrelated to the service.

If an instruction from the company conflicted with data protection law, Mantuni would raise it before carrying it out.

No artificial intelligence: no model-based classification, no training on the customer’s data. Classification is a set of keyword rules configured by the company itself.

4. Confidentiality and access

Anyone processing the data is bound to confidentiality, and access is limited to what is needed to operate the service.

To support specific data, the company is asked first and only the minimum is looked at. No one at Mantuni needs to read the reports for the application to work.

5. Security

Per-company isolation enforced in the database, not in the screen.

Encryption in transit and at rest; photos and invoices in private buckets served through signed links that expire.

Photo metadata (where and when it was taken) removed before storing, and the real content of the file verified, not its extension.

Immutable access log, restricted error log, two-factor authentication available, and daily backups with restore testing.

Automatic retention deletion, with scheduled jobs that require a secret to run.

6. Sub-processors

Supabase (database and files, servers in the European Union), Vercel (application and scheduled jobs), Resend (email), Cloudflare Turnstile (anti-robot verification) and, once payment is active, Stripe (payments and invoicing).

All of them are bound by data protection obligations no less demanding than this annex. Any change is notified at least 30 days in advance so the company can object.

Any transfer outside the European Economic Area is covered by the European Commission’s standard contractual clauses.

7. Assisting the company

Mantuni assists with requests from the people concerned. In practice the company does not need to ask for the most common ones: under “Your data” it downloads a full copy and can delete everything, and each team member can exercise their rights by writing to the contact above.

It also assists with the obligations of Articles 32 to 36 GDPR, including breach handling.

8. Security breaches

If there is a breach affecting the company’s data, it is notified without undue delay and at most within 24 hours of becoming known, with the information available.

That deadline is intentionally shorter than the legal one: the company has 72 hours to notify the supervisory authority and cannot spend them waiting for its provider.

9. When it ends

When the contract ends the data is erased, except what the law requires to be kept (billing data, handled by Stripe outside the application).

The company can download a full copy and delete everything at any time, without asking and without waiting for the contract to end.

10. Audit and acceptance

Mantuni makes available the information needed to show it complies with this annex: what is processed, which measures exist, who the sub-processors are and the result of the service’s isolation and security tests. An audit with access to the infrastructure is agreed 30 days in advance, at most once a year, at the company’s expense.

The company accepts this annex when contracting the service. If a signed copy is needed, it is signed by email between the parties.