Ocitygate Data Processing Agreement

Version 1.0.0 | Effective date 01 November 2026

Intended publication address: ocitygate.com/legal/data-processing-agreement

Draft for legal and operational review. Complete unresolved fields and verify operational statements before publication.

Parties scope and priority

This Data Processing Agreement forms part of the accepted Ocitygate Service contract between Matthew Zahra, established in Malta, VAT registration number MT17229420, of 44, L Casolani Street, B'Kara BKR4536, Malta, operating Ocitygate (Processor) and the customer named in the Order (Customer). It applies to personal data processed on the Customer’s behalf through the cloud Service and MyHost connector (Customer Personal Data). The Customer acts as controller or, where lawfully administering a client’s data, as processor with authority to appoint us as a further processor. References to controller instructions include instructions relayed by an authorized processor. Our own-purpose account and billing processing is addressed by the privacy notice. This DPA prevails on processing matters. It applies throughout processing, including any necessary return, deletion or legally required retention.

Definitions and applicable law

GDPR means Regulation (EU) 2016/679. Personal data, processing, controller, processor, personal data breach and supervisory authority have their GDPR meanings. Applicable Data Protection Law includes GDPR, applicable Maltese data protection legislation and other law applying to the processing. Service terms are at ocitygate.com/legal/terms. Neither commercial terms nor a Customer instruction may remove a mandatory obligation or data subject right.

Documented instructions and customer duties

We process only on documented Customer instructions in this DPA, the Order, authorized run settings and subsequently agreed instructions, including instructions concerning transfers. The Customer determines purposes, lawful bases, necessary notices, recipients and appropriate access permissions, and exercises its rights to instruct, obtain information, audit and require return or deletion. The Customer must have authority from any underlying controller and relay relevant instructions and restrictions. If EU or Member State law requires other processing, we inform the Customer beforehand unless law prohibits that notice on important public-interest grounds. We immediately inform the Customer if, in our opinion, an instruction infringes applicable EU or Member State data protection law, and may pause the affected processing pending clarification rather than knowingly follow an unlawful instruction. No sale, advertising use or general-purpose AI training is authorized.

Authorized personnel and security

We restrict access to people authorized for the task who are bound by confidentiality or an appropriate statutory duty. We implement and maintain measures required by Article 32 GDPR appropriate to the processing risks, and document them in Schedule B before processing. Changes must not reduce the overall protection required by law or this DPA. We assess the risks to individuals and the confidentiality, integrity, availability and resilience needed for the actual systems. This undertaking is a contractual obligation; uncompleted Schedule B is not proof that any named technical measure is already implemented.

Subprocessors

No external subprocessor may process Customer Personal Data unless identified in completed Schedule C and specifically authorized in writing by the Customer. A replacement or new subprocessor requires advance disclosure of its identity, function, locations and safeguards and the Customer’s written authorization before access. This is specific authorization, not a blanket right to appoint unidentified providers. We impose the same applicable data protection obligations by binding contract and remain fully liable to the Customer for the subprocessor’s performance of its obligations. If authorization is withheld, the parties must agree an alternative or end the affected service under the commercial terms and mandatory law. Operating our own Malta datacenter does not itself identify a separate subprocessor; actual legal entities and outside access must be assessed. Customer-selected systems acting independently must be distinguished from providers we engage.

Locations and transfers

The Service hosting location is Malta in the Ocitygate LAN datacenter. Do not transfer or permit access to Customer Personal Data outside the EEA without documented Customer instructions and a lawful mechanism under GDPR Chapter V where required. Identify relevant countries, remote access and onward transfers before processing. Where needed, agree applicable approved transfer safeguards and supplementary measures following a transfer assessment; this DPA is not itself a substitute for approved transfer clauses. Tell the Customer of a transfer issue that prevents lawful performance. Customer-selected overseas statement recipients must also be addressed in the instructions and applicable transfer assessment; geography is not determined only by where servers sit.

Assistance with individuals and compliance

Taking account of the nature of processing, we assist through appropriate technical and organizational measures, insofar as possible, with requests to exercise GDPR rights. We promptly forward requests received directly and do not independently decide a response unless authorized or legally required. We assist with compliance under Articles 32 to 36 GDPR, taking account of the nature of processing and information available to us, including security, breach notifications, impact assessments and prior consultation. Reasonable agreed fees may cover extraordinary assistance beyond the ordinary Service, but not excuse legal duties, remedying our breach or delay a mandatory response.

Personal data breaches

We notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, using the Customer’s designated incident contact, with escalation through other available contacts if needed. We supply available details of the nature of the breach, affected categories and approximate numbers of people and records where possible, a contact point, likely consequences, and measures taken or proposed to address and mitigate it. Provide information in phases as it becomes available without delaying initial notice. We investigate, contain, preserve appropriate evidence and cooperate with the Customer’s notification and remediation duties. We do not condition notice on proving fault. The controller determines regulator and individual notifications unless law independently requires us to act. Any evidence retention must be minimized, justified under law and notified to the Customer where lawful, not a routine exception to immediate payload deletion.

Information audits and inspections

We make available all information necessary to demonstrate compliance with Article 28 GDPR and allow and contribute to audits and inspections by the Customer or an auditor it mandates. Coordinate reasonable notice, confidentiality and scope to protect other customers and avoid unnecessary disruption; urgent incidents, credible non-compliance and authority requirements may need shorter notice. Reports and remote evidence may reduce unnecessary duplication but do not eliminate inspection rights. No fee or scheduling condition may make the statutory right ineffective. We promptly address identified deficiencies and cooperate with competent supervisory authorities as required.

End of run deletion and end of services

As the standing instruction, delete statement-run payloads immediately when a run completes, is cancelled or reaches final failure. Payloads include extracted accounting data, generated PDF or statement copies, working files, relevant email spools and other temporary copies under our or our subprocessors’ control. Do not retain payloads in diagnostic logs, backups or archives. Active processing and pending retries must remain limited to the authorized run and the documented maximum lifecycle; a stalled run cannot become indefinite retention. Copies delivered into the Customer’s or its chosen recipients’ independent systems are under their control after delivery; copies still held by our delivery providers remain our responsibility. A legal requirement to retain particular data is handled only to the extent EU or Member State law requires, with separation, restricted access and notice where permitted.

Return deletion and verification

At the end of services, at the Customer’s choice, return or delete remaining Customer Personal Data and delete existing copies unless EU or Member State law requires storage. Historical run payloads cannot be returned after their instructed immediate deletion. Arrange any required run output delivery before cleanup; return does not authorize keeping a post-run archive. Any remaining processor configuration, recipient or operational records must be inventoried and returned or deleted as instructed. Confirm completion on request and identify any legally retained data, reason and duration where lawful. The own-controller records described in the privacy notice are separate, remain subject to applicable law and do not justify retaining statement payloads.

Liability duration and courts

Commercial liability between the parties follows the lawfully agreed Service contract; free connector supply does not remove statutory accountability. Nothing limits data subjects’ rights, supervisory powers or non-excludable duties under GDPR, including the applicable rules on compensation and recourse. This DPA is governed by Maltese law and the courts of Malta, subject to mandatory jurisdiction and data subject rights. It is accepted with the Order or by separate signature identifying this version; commercial termination does not end ongoing protection of lawfully retained data.

Schedule A Processing description and instructions

Subject matter: read-only retrieval of Customer-authorized Sage records and preparation and delivery of scheduled statements. Purpose: the Customer’s accounting and statement communications. Nature: access, selection, retrieval, temporary transmission and processing, statement or PDF generation, instructed email or other agreed output delivery, and deletion. Frequency: configured runs; duration: only the authorized run lifecycle for payloads, and separately documented lifecycle for any continuing processor configuration. Data subjects: customers and debtors including individuals and sole traders, their representatives and contacts, and people incidentally identified in relevant transaction references. Types of data: the actual selected identity, address, contact, customer or account identifiers, transaction dates, references, descriptions, amounts, balances and delivery destinations. Actual fields must be recorded per deployment; no complete schema is presumed. Special-category and criminal-offence data are not intentionally required; do not include them unless separately assessed and agreed with adequate safeguards.

Schedule A Read only access and run lifecycle

Sage 50: ODBC user and password, read-only access to COMPANY, SALES_LEDGER and AUDIT_HEADER. Sage Evolution: SQL Server user and password, read-only access to Entities, Client and PostAR. No writes to those source tables or access to unrelated datasets are authorized. Controller or Customer identity, authorized companies, fields, recipients, administrators and incident contacts: [COMPLETE DEPLOYMENT RECORD WITHOUT SECRETS]. Immediate deletion applies to all payload artifacts at run end, including unsuccessful or cancelled runs. Maximum time for active or stalled processing, retries and final-failure cleanup: [COMPLETE VERIFIED LIMIT AND TRIGGER]. Credential storage location, allowed use during or between runs, rotation and deletion or revocation: [COMPLETE VERIFIED LIFECYCLE]. Persistent configuration and non-payload processor log categories and periods: [COMPLETE]. Without these fields the processing schedule is incomplete.

Schedule B Technical and organizational measures

Complete a factual, approved description before production processing. Record: host and cloud identity and authorization controls; least-privilege database accounts; protection and storage of credentials; transmission and at-rest protections actually used; physical access and environmental controls at the Malta datacenter; network and tenant isolation; personnel confidentiality; patching and vulnerability management; operational monitoring without statement payloads; incident handling and contacts; run termination, memory and temporary-file cleanup; email delivery and spool cleanup; and verification that payloads are excluded from backups and logs. Record availability and recovery measures consistent with no post-run payload retention, security testing and periodic review, and assistance and audit procedures. Status for each control: [IMPLEMENTED CONTROL EVIDENCE OWNER AND REVIEW DATE]. Do not substitute a list of desired controls for evidence or claim unsupported encryption or certifications.

Schedule C Authorized subprocessors and transfers

Inventory status: [NOT YET CONFIRMED]. No external provider is authorized solely by this blank schedule. Before use, identify each legal entity, function, personal data involved, processing and remote-access locations, retention and cleanup, contract and security assessment, transfer mechanism if required, and the Customer’s dated written authorization. Check email relay and delivery services, outside infrastructure or backup providers, monitoring, remote support and any other provider able to access payloads. If there are no external subprocessors, explicitly confirm that finding after the actual inventory; do not assume it because hosting is in our own datacenter.

Schedule D Contacts and acceptance

Processor privacy and incident contact: legal@ocitygate.com; operational support: support@ocitygate.com; general enquiries: info@ocitygate.com. Customer legal name, status as controller or authorized processor, contact and incident escalation details: [COMPLETE IN ORDER]. Acceptance must identify DPA version 1.0.0 and incorporated completed schedules, with date, method and authorized representative. Electronic acceptance is permitted where legally valid. Optional signatures: Customer representative [NAME ROLE SIGNATURE DATE]; Matthew Zahra [SIGNATURE DATE].