Version dated 19 August 2026
This document applies when OpenBox processes personal data on behalf of a client in providing the service.
1. Roles of the Parties
The client determines the purposes and means of processing and acts as the data controller; OpenBox acts as the processor within the scope of the client's documented instructions, unless otherwise required by law.
2. Subject Matter of Processing
The categories of data, data subjects, purposes, and processing period are determined by the features used, the order, and the client's settings. The client is responsible for the lawfulness of transferring data and notifying data subjects.
3. Security Measures
OpenBox implements access management, logging, backups, infrastructure protection, and response procedures proportionate to the risk.
4. Sub-processors and Transfers
Sub-processors may be engaged for hosting, communications, analytics, and support, subject to confidentiality and data protection requirements. International transfers are arranged using applicable mechanisms.
5. Incidents and Termination
In the event of a confirmed incident, the client will be notified without undue delay. Upon termination of the services, data will be deleted or returned as agreed, except where retention is required.
Contact: info@openbox.ooo