Data Processing Agreement

Last updated 26 October 2026 · Version 2026-10-26

This agreement is between the Makeborne customer (the "Customer", controller) and ZORBY&CO d.o.o., Vilsonovo šetalište 10, 71000 Sarajevo, Bosnia and Herzegovina (the "Processor"). It forms part of the Terms of Service and applies automatically, without signature, whenever the Processor processes personal data for the Customer. It meets GDPR Art. 28, UK GDPR and equivalent laws. If the Customer is itself a processor for its own clients, the Processor is its sub-processor on the same terms.

1. Processing

The subject matter, duration, nature, purpose, data and people concerned are in Annex I. The Processor processes the data only to provide Makeborne and on the Customer's documented instructions, which are these terms and the Customer's use of the service. It will tell the Customer if it believes an instruction breaks the law.

2. Processor duties

The Processor will:

• keep the data confidential and allow access only to personnel bound by confidentiality who need it;
• apply the security measures in Annex II, which it may improve but not weaken;
• help the Customer, taking into account the nature of the processing, to answer data subject requests and to meet its duties on security, breach notification, impact assessments and prior consultation;
• notify the Customer of a personal data breach without undue delay, aiming for 48 hours after becoming aware of it, with the information available then and more as it emerges;
• make available the information needed to show compliance, and allow audits by the Customer or an auditor it appoints, on 30 days' notice, under confidentiality, once a year unless a breach or authority requires more, at the Customer's cost; written answers and existing reports are used first;
• at the end of the service, delete the data, or return it first through the export tools if the Customer asks; copies in backups are deleted on their normal cycle, and copies the law requires are kept only for that purpose.

3. Sub-processors

The Customer gives general authorisation to use the sub-processors in Annex III. The Processor imposes on each the same data protection obligations as in this agreement and remains responsible for them. It will announce new or replaced sub-processors at least 30 days in advance on this page and by email to account owners. The Customer may object on reasonable data protection grounds; if no solution is found, the Customer may end the affected service and receive a pro-rata refund of prepaid fees.

4. International transfers

The Processor is established in Bosnia and Herzegovina, which has no EU adequacy decision. Where the Customer transfers personal data from the EEA to the Processor, the EU Standard Contractual Clauses (Commission Decision 2021/914) are incorporated by reference: Module 2 (controller to processor), or Module 3 where the Customer is a processor. Clause 7 (docking) applies; in Clause 9 option 2 (general authorisation, 30 days' notice); in Clause 11 the optional language does not apply; in Clauses 17 and 18, the law and courts of Ireland apply. Annexes I to III of this agreement complete the Clauses' annexes, and the supervisory authority is the one competent for the Customer. For UK data, the UK Addendum (version B.1.0) applies; for Swiss data, the Clauses apply with references read as the Swiss FADP and the FDPIC. If the Clauses conflict with this agreement, the Clauses prevail. Onward transfers to sub-processors use an adequacy decision, the EU-US Data Privacy Framework or Standard Contractual Clauses (Annex III).

5. Customer duties

The Customer is responsible for having a lawful basis for the data it adds or collects (including lead-finder results), for informing data subjects (including under GDPR Art. 14) and for lawful outreach, and for its websites' own privacy notices.

Annex I: Details of processing

Annex II: Technical and organisational measures

Annex III: Sub-processors

Services the Customer connects itself (Google Gmail, GitHub, a domain registrar) act under the Customer's own agreement with them and are not sub-processors.