ANNEX 1 to Contract no 70009764, concluded between the Parties on the 01.07.2024.

Data Processing Agreement

This Data Processing Agreement ("Agreement") forms part of the Client contract ("Contract") between 

Riigi Kaitseinvesteeringute Keskus, local business registry number 70009764, with registered office at Järve 34a, 11314 Tallinn , represented by Ivar Janson

(the „Company“ or “Controller”) 

and  Stebby OÜ, Estonian business registry number 12231911, with registered office at Raatuse 20, Tartu, Estonia, 51009, represented by authorized employee  (the  “Processor”) 

(together as the “Parties”) 
WHEREAS 
 .	The Company acts as a personal data Controller. 
 .	The Company is importing its employees (hereinafter also as „Users“) personal data to the Processor’s platform Stebby (hereinafter also as „Stebby platform“), available at www.stebby.eu and as mobile application, for giving its employees access to health and wellness marketplace services, provided by the Processor.
 .	The Parties have established that personal data are intended to be processed within the framework of the Contract. In this regard the Parties agree to comply with the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC and any other regulatory enactments applicable for personal data processing and protection (hereinafter referred to as the GDPR) and hereby agree on personal data processing conditions pursuant to the requirements of the GDPR.
1.	Obligations of the Parties

1.1.	The Processor warrants that it has legal capacity and all necessary rights to provide the service and the processing of the personal data during the period of validity of the Contract and Agreement.
1.2.	The Processor shall process the personal data on behalf of the Controller and under documented instructions of the Controller for the purpose of fulfilment of liabilities under the Contract and this Agreement, in the amount and scope specified therein (and annexes to this DPA), in accordance with the specified processing nature and defined time period, as well as in compliance with the applicable regulatory enactments. 
1.3.	The Processor shall comply with all applicable Data Protection Laws in the Processing of personal data. The Processor warrants that it does not have any obstacles or restrictions (including lawful, contractual or any other type of restrictions) for the Personal data processing and fulfilment of liabilities set by the Agreement and the Contract. If any obstacle or restriction occurs or may occur during the period of validity of the Contract and the Agreement, the Processor shall immediately notify the Controller in writing.
1.4.	The Processor shall only be entitled to make derivatives from the Personal data (including electronic or hard copies) to the extent that it is necessary for the fulfilment of liabilities arising from the Contract and the Agreement, as well as the Processor undertakes to delete and destroy such derivatives (if any) as soon as it is no longer necessary for the fulfilment of the mentioned liabilities. 
1.5.	The Processor has appointed a data protection officer. The Processor shall inform the Controller regarding the data protection officer, specifying the given name, surname, contact phone number and e-mail address thereof. The general data protection officer contact is privacy@stebby.eu .
1.6.	The Processor shall have an obligation to document the activities with Personal data, and to present upon request the above-mentioned documentation to the Controller and/or supervisory authority.
1.7.	The Controller shall be entitled to determine the Personal data processing security requirements binding for the Processor.
1.8.	The Controller shall be responsible for ensuring, inter alia, that the personal data processing entrusted to the Processor has legal ground.

2.	Processing of personal data

2.1.	When adding a User to the Stebby platform, the Controller ensures that they have a legal basis for processing and transferring the personal data to Stebby and that the processing of personal data complies with the requirements set out in the legislation governing the protection of personal data, as well as that due notice has been given to the User, informing the User of which data and for which purpose are made available to Stebby and that Stebby may send to the e-mail address of the User a notice on how they can use their account and identify their right to the account, informing the User of the fact that they also have the right to read Stebby’s terms and conditions for the processing of personal data that are available on the website of Stebby platform.
2.2.	If Stebby receives a complaint from a User imported by the Controller that there is no basis for processing any of the personal data of the User, then Stebby will delete the relevant User account as soon as reasonably possible after confirmation of the Controller.
2.3.	The User may create an account on Stebby platform and notify the Company on the Stebby platform of their wish to use the health and sport compensation, after which the Company can accept the application for membership. In such a case, this Agreement does not apply and for such data Stebby shall be held as a Controller.
2.4.	The Controller shall notify the Processor within a reasonable time of the basis for ending the processing of the personal data of the User, as well as when the User withdraws their consent for the processing of personal data.
2.5.	The personal data of the User is retained by the Processor for as long as the User has a Stebby account. After deleting the Stebby account, the data of the User on participation in sports clubs, trainings, health services, and participation will be anonymised and this data will be used for analytical purposes by the Processor. The data of deleted users will be permanently lost from backups and logs within 90 days after its deletion at the latest. When the Contract ends, Stebby shall delete or return all the personal data for which Company is the Controller.

3.	The Processor Personnel 

3.1.	 The Processor shall take reasonable steps to ensure the reliability of any authorised person who may have access to personal data, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant Personal Data, as strictly necessary for the purposes of the Contract, and to comply with Applicable Laws, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality. 
3.2.	The Processor shall provide the access to the Personal data only to those employees, authorized persons or sub-processors who are involved in the fulfilment of the Contract and/or the Agreement, and only to the extent it is necessary for fulfilment of direct duties under the Contract and/or Agreement. The Processor shall ensure that any sub-processors or person authorized (including Stebby employees) to process the Personal data complies with and have undertaken in writing to comply with confidentiality obligation and other Personal data processing requirements to an extent that is equal to the requirements set in the Agreement and the Contract.

4.	Security and Confidentiality

4.1.	Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR. 
4.2.	In assessing the appropriate level of security, the Processor shall take account in particular of the risks that are presented by the processing, in particular from a Personal Data Breach. 
4.3.	 The Processor shall not be entitled to disclose (including, to transfer), without receiving prior written consent of the Controller, the Personal data to any other person, except if the applicable regulatory enactments of European Union or European Union’s member state impose an obligation to the Processor to disclose the above mentioned information to the state and/or local government authorities, however subject to GDPR.
4.4.	The Processor is obliged to keep information confidential for an indefinite period of time, including, during the period of validity of the Contract and afterwards. The Processor shall have an obligation to ensure that its employees and/or authorized persons, and/or sub-contractors, and/or other processors comply with the confidentiality requirement referred to in this Agreement.
4.5.	Subject to clause 4.3, in case the applicable regulatory enactments of European Union or European Union’s Member State impose an obligation of disclosure (incl., transfer) for the Processor, including if Personal data shall be transferred to a third country or an international organization, the Processor shall notify the Controller immediately, before processing, of such obligation (notification shall at least contain the following: Article of law that obliges disclosure, content of request, reasoning) as far as the law does not forbid that on important grounds of public interest. If due to specific circumstances the Processor is not able to notify the Controller prior to disclosure, then the Processor is obliged to notify the Controller as soon as possible after disclosure, providing reasoning for the delay.

5.	Sub-Processors

5.1.	The Processor is given general authorisation to engage third-parties to process the Personal Data (“Sub-Processors”) without obtaining any further written, specific authorization from the Data Controller. The Processor notifies the Data Controller of new Sub-Processors 30 days prior to their implementation.
5.2.	Where the the Processor engages Sub-Processors, the Processor imposes data protection terms on the Sub-Processors that provide at least the same level of protection for Personal Data as those in this DPA (including, where appropriate, the Standard Contractual Clauses), to the extent applicable to the nature of the services provided by such Sub-Processors. The Processor shall remain responsible for each Sub-Processor’s compliance with the obligations of this DPA and for any acts or omissions of such Sub-Processor that cause us to breach any of its obligations under this DPA.

6.	Data Subject Rights 

6.1.	Taking into account the nature of the Processing, the Processor shall assist the Controller by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller obligations, as reasonably understood by Controller, to respond to requests to exercise Data Subject rights under the Data Protection Laws. 

7.	Personal Data Breach 

7.1.	The Processor shall have an obligation to notify the Controller immediately, but no later than within 24 hours, when a breach of the Personal data processing has occurred or suspicions have arisen that it might have occurred which surpassed identification phase of incident handling process. The notification shall include description of particular circumstances, data type, data subjects that may be influenced, its volume, as well as measures that are applied or are planned to be applied in order to reduce the risk. The Processor shall immediately provide to the Controller any other information requested by the Controller, as well as proactively provides any significant information related to the occurred or possible personal data breach and its investigation.

8.	Audit rights 

8.1.	 The Processor shall make available to the Controller, on request, all information necessary to demonstrate compliance with this Agreement, and shall allow for and contribute to audits, including inspections, by the Controller or an auditor mandated by the Controller in relation to the Processing of the personal data.
8.2.	Information and audit rights of the Controller only arise under this section 8, to the extent that the Agreement does not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Law. 

9.	Data Transfer 

9.1.	If the personal data processed under this Agreement is transferred from a country within the European Economic Area to a country outside the European Economic Area, the Parties shall ensure that the personal data is adequately protected. To achieve this, the Parties shall, unless agreed otherwise, rely on EU approved standard contractual clauses for the transfer of personal data. 

10.	Notices. 
10.1.	All notices and communications given under this Agreement must be in writing and will be delivered personally, sent by email to the email address set out in the Contract or in this Agreement. 

11.	Governing Law and Jurisdiction 

11.1.	This Agreement is governed by the laws of the Republic of Estonia.
11.2.	Any dispute arising in connection with this Agreement, which the Parties will not be able to resolve amicably, will be submitted to the exclusive jurisdiction of the courts of Estonia.

ANNEXES:
Annex 1. Description of Personal data processing
Annex 2. Technical and organisational measures.
Annex 3. List of Sub-Processors

IN WITNESS WHEREOF, this Agreement is entered into with effect from the date set out below. 
Signatures of the Parties:

On behalf of Controller 
Riigi Kaitseinvesteeringute Keskus
Ivar Janson

/signed digitally/
 	On behalf of Processor
Stebby OÜ
Karl-Eduard Möldre

/signed digitally/