Data Processing Agreement (DPA) — Elevator Matrix

DRAFT for review by a lawyer. Version 0.2 — October 2026. This Agreement forms an integral part of the Terms of Use and is entered into pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR).

1. Parties and Roles

• Controller: the customer company that creates an account on Elevator Matrix (hereinafter "the Customer").
• Processor: the provider of Elevator Matrix (hereinafter "the Provider"), Thessaloniki.

2. Subject Matter, Duration, Nature and Purpose of the Processing

• Subject matter: hosting, storage, synchronisation, backup and display of the data entered by the Customer into the service, as well as processing through ancillary AI features upon user action.
• Duration: for the duration of the service contract and up to 30 days after its expiry (export/deletion period).
• Purpose: the provision of the lift company management service to the Customer.

3. Types of Data and Categories of Data Subjects

• Data subjects: customers of the Customer (building owners/managers, building service-charge management companies), their contacts, persons reporting faults, users/employees of the Customer (technicians, office staff).
• Data: full names, telephone numbers, emails, building addresses, billing details (Tax Identification Number (ΑΦΜ), competent tax office (ΔΟΥ)), maintenance and fault history, photographs of installations, digital acceptance signatures, call records (number, time, duration), user location data (only where the user enables the relevant feature), maintenance engineer licence details.
• No processing of special categories of data (Article 9 GDPR) is envisaged. The Customer must not enter such data.

4. Obligations of the Provider

The Provider:

1. Processes the data only on documented instructions from the Customer (the instructions are embodied in the operation of the service and in the actions of the Customer's users), unless required to do otherwise by Union or Member State law — in which case it informs the Customer before the processing, where permitted.
2. Ensures that persons with access to the data are bound by an obligation of confidentiality.
3. Implements the appropriate technical and organisational measures set out in Annex A.
4. Complies with the conditions of paragraph 6 for engaging sub-processors.
5. Assists the Customer, by appropriate measures, in fulfilling data subjects' rights (access, rectification, erasure, portability) — the service provides built-in editing/deletion of records and data export.
6. Assists the Customer in ensuring compliance with Articles 32–36 GDPR (security, notification of breaches, impact assessment).
7. Notifies the Customer of any personal data breach without undue delay and at the latest within 48 hours of becoming aware of it, with the information available.
8. At the choice of the Customer, deletes or returns all the data after the end of the provision of services and deletes the copies within 30 days, unless the law requires retention.
9. Makes available to the Customer all information necessary to demonstrate compliance and allows audits, with 30 days' prior written notice, once per year or following a breach, at the Customer's expense.
10. Does not, as platform administration, have access to the Customer's business data, other than to aggregated usage metrics, unless the Customer requests in writing support that requires such access.

5. Obligations of the Customer

The Customer warrants that it has a lawful basis for the processing, informs data subjects as required by law, enters only the necessary data, manages its users and their roles with due care and responds to data subjects' requests.

6. Sub-processors

The Customer grants general authorisation for the use of the sub-processors listed in Annex B. The Provider gives notice of any intended addition or replacement at least 30 days in advance, and the Customer may object in writing; if no solution is found, the Customer may terminate the contract without cost. The Provider imposes the same data protection obligations on sub-processors and remains fully liable to the Customer.

7. Transfers outside the EEA

Transfers to a third country take place only on the basis of an adequacy decision or standard contractual clauses of the European Commission, with supplementary measures where required.

8. Liability

The liability of each party is governed by Article 82 GDPR and the Terms of Use.

9. Governing Law

Greek law; the courts of Thessaloniki shall have jurisdiction.

Annex A — Technical and Organisational Measures

• Encryption in transit (TLS 1.2+). Encrypted storage of credentials on devices.
• Data isolation per company through access rules on the server (multi-tenant rules) and role-based access control (owner, office, supervisor, technician, accountant).
• Authentication by email/password, password reset facility, automatic session expiry.
• Daily backups with rolling retention of 14 days; restore testing every six months.
• Access and error logging (logs) for up to 12 months.
• Security updates of software and infrastructure; least privilege for staff.
• Incident management and breach notification procedure.

Annex B — List of Sub-processors

• Amazon Web Services — Frankfurt region (EU): hosting of servers and database, backups, email delivery (Amazon SES), maps (Amazon Location Service).
• Anthropic (USA) — artificial intelligence models (Claude) for the AI features, only upon user action; data is not used for training.
• Apple (Apple Push Notification service) — delivery of notifications to iPhone (notification title/text only).
• Enable Banking — read-only bank connection, only where connected by the Customer.
• E-invoicing provider — only where selected by the Customer in the Settings.
• VoIP telephony provider — only where connected by the Customer.

Invoices and receipts are transmitted to the tax authority (e.g. AADE / myDATA in Greece) on the Customer’s instruction, under its legal obligation; the authority is not a sub-processor.