Data Processing Agreement (DPA)

Version: 14 October 2026
Between: the Customer (the account holder) and GIJA HUB MB, Polocko g. 4B-20, Vilnius, Lithuania, company code 307210538, agne@gijahub.com ("we", "us", the "Processor").

This DPA is part of the Terms of Service. The Customer accepts it together with the Terms when registering (click-through). On request we send a countersigned copy (clause D13.5).

D1. Scope and roles

D1.1 This DPA applies where we process personal data in Customer Content on behalf of the Customer, and the GDPR (Regulation (EU) 2016/679) or another data protection law applies to that processing. "Customer Personal Data" means that personal data. "Customer Content" has the meaning in the Terms.

D1.2 The Customer is the controller of Customer Personal Data. We are the processor.

D1.3 If the Customer processes Customer Personal Data as a processor for its own client (for example a drone operator working for a landowner), the Customer is a processor and we are a sub-processor. The Customer confirms that its client has authorised this processing chain and that the Customer has the right to give us the instructions in this DPA. We apply the same terms.

D1.4 This DPA does not cover personal data for which we are the controller: the Customer's account data, payment records, security logs, and visitor session data for Client Galleries. The Privacy Policy covers those.

D1.5 This DPA does not apply where the Customer's processing is purely personal or household. It is for Business Customers and for other controllers.

D1.6 Words such as "personal data", "data subject", "personal data breach", "processing", "controller", "processor" and "supervisory authority" have the meaning in the GDPR.

D2. Instructions

D2.1 We process Customer Personal Data only on the Customer's documented instructions. These are: this DPA, the Terms, and the Customer's use of the Service (for example uploading a dataset, starting a job, creating a Client Gallery, deleting a job). This includes instructions about transfers to a third country (clause D10).

D2.2 We do not process Customer Personal Data for our own purposes. In particular we do not use it to train AI or machine-learning models, and we do not view it, except as the Terms allow (clause 12.2): to answer a support request that the Customer raised, to fix or contain a processing failure or incident that affects the Customer's job, to verify that processing and results came out as intended (for example when system logs show an anomaly, or in quality review of results, looking at results and logs, not original photos), solely to find and fix processing faults, or where EU or member-state law requires it.

D2.3 If we think an instruction infringes the GDPR or other data protection law, we tell the Customer at once. We may pause the instruction until the Customer confirms or changes it.

D2.4 If EU or member-state law requires us to process Customer Personal Data in another way, we tell the Customer before we do, unless that law forbids it (clause 12.6 of the Terms).

D3. Confidentiality of personnel

D3.1 We ensure that persons authorised to process Customer Personal Data are bound by confidentiality. Only staff who need access to do their work can access Customer Personal Data.

D3.2 That duty continues after their work for us ends.

D4. Security

D4.1 We use the technical and organisational measures in Annex II. They aim at a level of security suitable to the risk (Article 32 GDPR).

D4.2 We may change the measures if the level of security is not reduced. We keep Annex II accurate.

D5. Sub-processors

D5.1 General authorisation. The Customer gives us general written authorisation to use sub-processors, on the terms of this clause.

D5.2 Current list. The current sub-processors are listed in Annex III and on the Sub-processors page. The Customer authorises them by accepting this DPA.

D5.3 Same duties. We enter into a written contract with each sub-processor that imposes data protection duties no less protective than this DPA (Article 28(4) GDPR). We remain liable to the Customer for the sub-processor's performance.

D5.4 Notice of changes. We tell the Customer about a new sub-processor, or a replacement of one, at least 30 days before it starts to process Customer Personal Data. We send an email to the account address and update the Sub-processors page. The notice names the sub-processor, its country, the service it provides and the start date.

D5.5 Objection.

• The Customer may object in writing, with reasons related to data protection, within 14 days after our notice.
• We then try in good faith to solve the objection. For example, we can avoid using the new sub-processor for the Customer's data, or we can offer another way to deliver the Service.
• If we cannot solve it within the 30-day notice period, the Customer may end the contract for the affected service by written notice. The Customer then gets a refund of the unused Paid Balance for the affected service (Terms, clause 16.3). If we cannot provide the Service without the new sub-processor, the affected service is the whole Service.
• The refund is paid through Stripe as set out in Terms clauses 7.2 and 16.3.
• We do not start using the new sub-processor for that Customer's data until the objection is solved or the contract has ended, unless the Customer agrees.

D5.6 Urgent replacement. If a sub-processor stops working or a security risk requires an immediate replacement, we may replace it with shorter notice. We tell the Customer as soon as we can. The Customer keeps the right to object under clause D5.5.

D5.7 Providers that act as independent controllers (Stripe and Google Sign-In) are not our sub-processors. They receive only the data described in the Privacy Policy, not Customer Content. Our own equipment (a server located in our own office premises in the EU) is not a sub-processor.

D6. Data subject requests

D6.1 We tell the Customer within 5 working days if we receive a request from a data subject about Customer Personal Data. We do not answer it ourselves, except to say that we have passed it to the Customer, unless the Customer asks us to reply or the law requires it.

D6.2 We help the Customer to answer data subject requests (access, rectification, erasure, restriction, portability, objection) by appropriate technical and organisational measures, as far as possible. The Customer can delete jobs and galleries itself in the dashboard. We help with things the Customer cannot do itself. We do not charge for reasonable help. We may charge a reasonable fee for help that needs substantial extra work.

D7. Assistance and personal data breaches

D7.1 We help the Customer meet its duties under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information we have.

D7.2 Breach notice. If we become aware of a personal data breach that affects Customer Personal Data, we notify the Customer without undue delay and within 24 hours of becoming aware. We are "aware" when we have reasonable certainty that a breach affecting Customer Personal Data has occurred, not when we first see a possible warning sign. We send the notice to the account email address.

D7.3 The notice includes what we know at that time:

• the nature of the breach, including where possible the categories and approximate number of data subjects and records;
• the likely consequences;
• the measures we have taken or propose to take;
• a contact point for more information.

If we do not have all this information yet, we give it in stages, without undue further delay.

D7.4 We act at once to contain the breach and limit its effects. We keep records of breaches. We do not notify authorities or data subjects about a breach in Customer Personal Data ourselves, unless the law requires us to.

D7.5 The Customer decides whether to notify the supervisory authority (Article 33 GDPR) and data subjects (Article 34 GDPR). We give the Customer the information it reasonably needs for that.

D8. Deletion or return

D8.1 During the contract. The Customer can download its Customer Content and delete jobs and galleries in the dashboard at any time.

D8.2 Storage periods. Customer Content is stored for the period in the Terms (clause 9): 30 days for Basic and 365 days for Full Service. We delete it from our active systems within 30 days after the storage period ends.

D8.3 At the end of the contract. When the contract ends, or on the Customer's earlier request, we delete Customer Personal Data from our active systems within 30 days. The Customer can ask us to delay deletion by up to 30 days to finish retrieving its data. The retrieval is free.

D8.4 Return. The Customer's return option is to download its results and source data before deletion. On request we help with a bulk export of data still stored. We provide it in standard formats (GeoTIFF, LAS/LAZ, OBJ/GLB and the original image files).

D8.5 Backups.

• The files the Customer uploads and the result files (images, orthophotos, point clouds, models and other outputs) are not included in our backups.
• Our database backups are snapshots of account data. They can contain email addresses, IP addresses, session records, job records and Client Gallery details, including gallery passwords and the text the Customer wrote in a gallery (titles, client names, contact details, notes).
• We keep database backups for operational recovery, for as long as we need them for that purpose. Backups are access-restricted. We never restore a backup for any purpose other than disaster recovery.
• If data that was deleted under this clause is ever restored from a backup, we delete it again.

D8.6 Confirmation. On request we confirm in writing that deletion has taken place.

D8.7 Legal retention. We may keep data where EU or member-state law requires it. We then keep it only for that purpose, and it stays protected by this DPA.

D9. Audits and information

D9.1 We make available to the Customer the information needed to show that we comply with Article 28 GDPR and this DPA.

D9.2 Documentation and questionnaire. The normal way to audit is by documentation and questionnaire. Once every 12 months, or after a personal data breach, the Customer may send us a reasonable security and data protection questionnaire. We answer within 30 days and provide relevant policies, summaries of measures, and the certifications or audit reports of our sub-processors that we may share.

D9.3 On-site audit, for cause only. The Customer, or an independent auditor bound by confidentiality, may carry out an on-site audit only for cause: (a) after a personal data breach that affects Customer Personal Data; (b) where the documentation and questionnaire do not show compliance and the Customer has given us a chance to answer; or (c) where a supervisory authority requires it. The following rules apply:

• at least 30 days' written notice, with the scope and the plan;
• during business hours, without disturbing our operations, and not more than once every 12 months unless a new breach happens;
• no access to other customers' data or to information that must stay secret for security reasons;
• the Customer pays the cost of the audit and our reasonable time and costs;
• the audit covers our premises and systems only. For sub-processors we rely on their audit reports and certifications, and we use our own audit rights where the Customer reasonably needs them.

D9.4 Nothing in this clause limits the powers of a supervisory authority.

D10. International transfers

D10.1 We process Customer Personal Data in the EU. All sub-processors in Annex III process it in the EU.

D10.2 Downloads by customers outside the EU/EEA. When a Customer that is located outside the EU/EEA downloads or receives its own data from us, this can be a transfer from us (processor) to the Customer (controller). We use these safeguards:

• If the Customer's country has an EU adequacy decision in force, that decision covers the transfer.
• Otherwise, if the Customer is not itself subject to the GDPR under Article 3(2), the parties agree the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 4 (processor to controller), with the choices in Annex IV. They apply from the time of the first such transfer and only for such transfers.
• If the Customer is subject to the GDPR under Article 3(2), the Standard Contractual Clauses are not used. This DPA applies.

D10.3 We do not transfer Customer Personal Data to any other third country, and we do not give access to it from a third country, unless the Customer instructs us to (for example by sharing a link with a person in a third country).

D10.4 We handle requests from authorities as set out in Terms clause 12.6.

D11. Liability

D11.1 The liability clauses of the Terms (clause 18) apply to this DPA. That includes the cap for Business Customers.

D11.2 This does not limit the liability that each party has towards data subjects under Article 82 GDPR. Between the parties, Article 82(4) and (5) GDPR apply to the right to recover a share of compensation paid to a data subject.

D11.3 Nothing in this DPA limits liability that cannot be limited by law (Terms, clause 18.1).

D12. Duration

D12.1 This DPA starts when the Customer accepts the Terms and continues as long as we process Customer Personal Data, including during the deletion period in clause D8.

D12.2 Clauses that by their nature continue (for example D7, D8, D9 and D11) continue after the DPA ends.

D13. General

D13.1 Order of precedence: this DPA prevails over the Terms and the Privacy Policy on the processing of Customer Personal Data. The Standard Contractual Clauses, where they apply, prevail over this DPA.

D13.2 This DPA is governed by the laws of Lithuania. The courts of Vilnius, Lithuania have jurisdiction, subject to any mandatory rule that gives data subjects, or a Customer that is a Consumer, another forum.

D13.3 We may update this DPA under Terms clause 19.1 (30 days' email notice and a new version date). We will do so if a change in law or guidance requires it, or to keep it accurate. Old versions are available on request at agne@gijahub.com.

D13.4 If a clause is invalid, the rest stays valid.

D13.5 Countersigned copy. The Customer accepts this DPA by accepting the Terms. On request to agne@gijahub.com, we send a copy signed by us, in which the Customer's details are filled in, for the Customer to countersign. The signed copy has the same terms.

D13.6 Customer's duties. The Customer confirms that it has a lawful basis for the processing, that it has given the information required to data subjects, and that its instructions comply with data protection law.

Signature block (for a countersigned copy)

Annex I: Details of the processing

A. Parties

• Controller: the Customer (account holder). Contact: the account email address.
• Processor: GIJA HUB MB, Polocko g. 4B-20, Vilnius, Lithuania. Contact: agne@gijahub.com. We have not appointed a data protection officer. Our data protection contact is agne@gijahub.com. No data protection officer is required.

B. Description

C. Competent supervisory authority

• For us: Valstybinė duomenų apsaugos inspekcija (VDAI), L. Sapiegos g. 17, Vilnius, Lithuania.

Annex II: Technical and organisational measures

1. Access control and confidentiality

• Root and administrative access to production systems is restricted to authorised personnel and is logged.
• Customer Content is accessible only through the owning account, through the share links the owner receives, and through galleries the owner creates.
• Accounts are protected by a password stored only as a salted one-way hash, or by Google Sign-In. Sign-in sessions use cookies that are HttpOnly, Secure and SameSite=Lax.
• Personnel with access are bound by confidentiality (clause D3).

2. Transmission control

• Traffic between browsers and our website, API and viewers is encrypted with TLS. HTTP Strict Transport Security is enabled.
• Connections from our systems to object storage use HTTPS.

3. Share links, galleries and viewers

• Share links and gallery links use long random tokens (at least 256 bits) that cannot practically be guessed. Anyone who has a share link can download the files. This is how share links work, and it is stated in the Terms.
• Client Galleries add a 6-digit access code. The code is stored so that the account owner can see it. It is an additional control, not a replacement for keeping the link secret.
• Gallery visitor sessions expire after 8 hours. Session tokens are stored only as SHA-256 hashes.
• Wrong gallery codes are limited: ten wrong attempts from one IP address lock that address out for 15 minutes.
• The interactive viewers require the owner's login or a valid gallery session.

4. Network and infrastructure

• Firewall rules restrict access to the servers. The database and internal services are not directly reachable from the internet.
• Temporary cloud servers are deleted after each job.
• Hosting providers operate the data centres, including physical access control and power and network resilience, under their own security programmes. See the Sub-processors page.

5. Application security

• Protection against cross-site request forgery for account actions.
• Rate limiting on sensitive endpoints.
• Bot protection on registration and sign-in through a proof-of-work challenge that runs on our own infrastructure. No data goes to third parties for this.
• Security headers, including a Content Security Policy.
• Checks that a user can access only their own jobs, datasets and galleries.

6. Logging, monitoring and incident response

• Security logs (IP addresses, sessions, events) are kept for 90 days.
• Independent external monitoring checks the availability of the website, API and viewer.
• We investigate security events and notify Customers of personal data breaches within 24 hours of becoming aware (clause D7).

7. Backups and recovery

• Uploaded files and result files are not included in backups.
• Database backups (account data and Client Gallery details, no image or result files) are access-restricted and used only for disaster recovery. Data deleted at a Customer's request is deleted again if it is ever restored (clause D8.5).

8. Availability and resilience

• Uptime target of 99.9% per month for the website, API and viewer, measured by independent external monitoring (Terms, clause 14).

9. Data minimisation and separation

• We collect only the data we need to provide the Service.
• Customer Content is not used for any purpose other than providing the Service to that Customer. It is not used to train models.
• Customer Content is stored under per-job identifiers and is not mixed between customers.

10. Physical security of our own equipment (custom jobs)

• For custom jobs that the Customer has approved, we may use a server located in our own office premises in the EU. Physical access is limited to authorised persons.

11. Sub-processor management

• Sub-processors are bound by written data protection terms and are listed with 30 days' notice of changes (clause D5).

Annex III: Sub-processors

The list on the Sub-processors page is the current list. It is repeated here for the version of this DPA in force.

Independent controllers (not sub-processors): Stripe (payments), Google (Google Sign-In). They do not receive Customer Content.

Annex IV: Choices for the Standard Contractual Clauses (only where clause D10.2 applies)

• Module: Module 4 (processor to controller). Data exporter: GIJA HUB MB. Data importer: the Customer.
• Clause 7 (docking clause): not used.
• Clause 11(a) optional language: not used.
• Clause 17 (governing law): the law of Lithuania.
• Clause 18(b) (courts): the courts of Lithuania (Vilnius).
• Competent supervisory authority (Annex I.C): Valstybinė duomenų apsaugos inspekcija (VDAI).
• Annex I (parties, description of transfer): as in Annex I to this DPA.
• Annex II (technical and organisational measures): as in Annex II to this DPA.

Reviewer's map: Article 28(3) GDPR