Data Processing Agreement (DPA)
You are the controller of your employees' personal data; CertGuard is the processor.
Last updated: 20. 8. 2026
1. Parties
Processor: Sašo Špacapan s.p., Tominčeva ulica 10, 5250 Solkan, Slovenia, company registration number 2405980500125, VAT ID SI62073621 ("CertGuard"). Controller: the customer who has entered into a subscription with CertGuard and created an organisation in the application ("the customer"). This agreement is concluded pursuant to Article 28 GDPR and forms an integral part of the terms of service.
2. Roles of the parties
The customer is the controller of the personal data of its employees and contractors and determines the purposes and means of processing. CertGuard is the processor and processes personal data solely on the documented instructions of the customer, as set out in this agreement and through use of the application. CertGuard does not use the personal data for its own purposes, does not sell it, and does not use it for profiling or advertising.
3. Subject matter, nature and purpose
The subject matter is maintaining records of mandatory training, medical examinations and certificates of the customer's employees. The purpose is to support the customer's occupational health and safety obligations: tracking validity, automatically notifying responsible persons before expiry, and producing overviews and reports for labour inspections.
4. Duration
Processing continues for the duration of the subscription. On termination, data is handled in accordance with clause 9.
5. Types of personal data
Employee first and last name, work email address (optional), job role (optional), obligation type, date completed and expiry date, and uploaded certificates. Account data of the customer's users is also processed: email address and sign-in data. CertGuard does not process special categories of data under Article 9 GDPR: medical findings, diagnoses, fitness assessments or reasons for restrictions are not collected and must not be entered into the application by the customer. For medical examinations, only the date completed and the expiry date are processed.
6. Categories of data subjects
Employees and contractors of the customer for whom the customer maintains obligation records, and users to whom the customer grants access to the application.
7. Obligations of the processor
CertGuard processes personal data only on the customer's instructions; ensures that persons processing the data are bound by confidentiality; implements the technical and organisational measures in clause 8; assists the customer in responding to data subject requests; notifies the customer without undue delay of any personal data breach and makes available all information necessary to demonstrate compliance.
8. Security measures
Encrypted data transfer (TLS) and encryption at rest with infrastructure providers; separation of data between organisations enforced at the database level (row-level security), not only in the application; certificates stored in private storage accessible only through time-limited links; access to an organisation's data restricted to signed-in members of that organisation; separation of administrator and viewer permissions; regular backups at the database provider.
9. Deletion and return of data
The customer may at any time export all of its data in machine-readable form together with the original certificate files; export remains available even when the subscription is inactive. A request to delete an organisation triggers a 30-day grace period during which the customer may cancel the deletion. After the grace period, all organisation data, including uploaded certificates, is permanently deleted. Records of sent reminders are retained for a maximum of 24 months and then deleted automatically. Deleting an employee also deletes their certificates.
10. Sub-processors
The customer consents to the following sub-processors: Supabase (database and file hosting, EU – Frankfurt); Vercel (application hosting); Resend (email delivery); Stripe (payment processing and invoicing); Anthropic PBC, USA (reading details from a photographed certificate, only when the customer uses that feature – see clause 10.a). CertGuard has an agreement with each sub-processor providing the same level of protection as this agreement. CertGuard will inform the customer in advance of any intended replacement or addition of a sub-processor, and the customer may object on reasonable grounds.
10.a Reading details from a photographed certificate
The application lets a user photograph a certificate and have the entry fields suggested from the image: employee name, obligation type, date completed and validity. The feature is optional and runs only when a user uploads an image themselves; otherwise no image is sent anywhere. When it is used, the image is passed to the sub-processor Anthropic PBC (USA), which reads the details and returns a suggestion. Anthropic does not use the images to train its models and does not retain them after processing. Suggested values are never saved automatically – the user checks and confirms them before saving. A certificate image may also be attached separately as evidence for an obligation; such attachments are stored with the provider named in clause 10 (Supabase, EU) and are not sent for reading.
11. Place of processing and international transfers
Personal data in the training records is processed and stored on servers in the European Union (Frankfurt, Germany). The only routine transfer outside the European Economic Area arises when the feature in clause 10.a is used and a certificate image is passed to the sub-processor Anthropic PBC in the United States; that transfer is made on the basis of the European Commission's standard contractual clauses. Where any other sub-processor processes data outside the European Economic Area, the transfer is made on the same basis or another appropriate safeguard under Chapter V GDPR.
12. Data subject rights
As controller, the customer is responsible for handling data subject requests (access, rectification, erasure, restriction, portability, objection). CertGuard assists with appropriate technical means: data export, and editing and deletion of records in the application. If a data subject contacts CertGuard directly, CertGuard forwards the request to the customer without delay.
13. Audits and demonstrating compliance
On request, CertGuard makes available to the customer the information necessary to demonstrate compliance with Article 28 GDPR, and allows for audits conducted by the customer or an auditor mandated by the customer, to a reasonable extent and by prior arrangement.
14. Data protection contact
Questions about data protection and the exercise of rights: podpora@certguard.si. Given the scope and nature of the processing, CertGuard is not required to appoint a data protection officer.
15. Cookies and measurement
The application uses only strictly necessary cookies (the sign-in session), which require no consent. Where visit measurement is enabled, the analytics tool loads only after your explicit consent; until then no third-party script is loaded and no analytics cookie is stored. Your decision is kept in the browser's localStorage, so declining creates no cookie at all. You can change the decision at any time by clearing site data in your browser.
Where is my data?
On servers in the European Union (Frankfurt). Each organisation sees only its own records — isolation is enforced at the database level, not just in the application.
What we store
Names, work emails, job roles, completion and validity dates, and uploaded certificates.
What we never store
Medical results, diagnoses or reasons. For a medical examination we store only the date and its validity.