Annex 1 to the  Data Processing Agreement (DPA)

Description of Personal data processing

Purpose	Platform (Stebby) for mediating wellness services to Controller’s employees. 	
Categories of data subjects	Employee data
	
Types of personal data processed of behalf of the Controller	Empoyees’ personal data: name, surname, e-mail address, date of birth, gender, personal ID code (in Estonia), mobile phone number, transactional data generated on or
uploaded to the platform.	
The nature of the processing and duration	The personal data processing nature is to collect, organize, structure, amend, store, delete the data for offering Controller’s employees a platform, which is used for mediating wellness services. 
Processor stores and keeps available to the Controller, transactional data made on the platform for minimum of 7 years (according to Accounting act in Estonia) or in accordance with the law, if longer storage time is required. User data, which is not mandatory to store by the law, is deleted when User deletes its account on the Platform.
Processor shall provide that information is kept safe, is available and is not destroyed for period of time while it is necessary. Afterwards, the Processor is obliged to delete/return such information in a secure way, complying with GDPR requirements and the Agreement.	

Signatures of the Parties:
On behalf of Controller
Riigi Kaitseinvesteeringute Keskus
Ivar Janson
/signed digitally/	On behalf of Processor
Stebby OÜ
Karl-Eduard Möldre
/signed digitally/