# Data processing agreement

Hands for Agents · your engineering s.r.o., company ID (IČO) 09738100. Version 2026-09-29. Article 28 GDPR agreement for clients whose tasks contain personal data. HTML: https://handsforagents.com/dpa.html

This agreement under Article 28 GDPR applies between the client as controller ("you") and **your engineering s.r.o.**, company ID (IČO) 09738100, as processor ("we"), whenever a task makes us process personal data on your behalf. It forms part of the contract concluded under the [terms of service](https://handsforagents.com/terms.html) and needs no separate signature. A countersigned PDF is available on request from legal@handsforagents.com.

## 1. Subject, duration, nature and purpose

We process personal data only to perform the task you ordered: receiving, making, testing, verifying, documenting and shipping, and keeping the task record. Processing lasts for the task and the record-keeping period of 24 months after the task ends (terms of service, section 14).

## 2. Data and data subjects

Typical data: name, address, phone and e-mail of recipients and contact persons; images of persons who consented to being documented; personal data contained in files or devices you give us. Data subjects: your employees, customers, recipients and other persons named in the task. Special categories of data (Article 9 GDPR) must not be sent to us.

## 3. Our obligations

1. We process the data only on your documented instructions; the task description, the accepted quote and your messages in the task are the instructions. We tell you if we think an instruction breaks the law.
2. Persons who handle the data are bound by confidentiality, as set out in section 10 of the terms of service.
3. Security measures: access limited to the persons doing the task; devices encrypted and protected by password; data stored in the EU.
4. We help you, as far as the nature of the processing allows, to answer data subjects' requests and to meet your obligations under Articles 32 to 36 GDPR.
5. We notify you of a personal data breach affecting your data without undue delay, at the latest within 48 hours of becoming aware of it, to the e-mail address of the task.
6. At the end of the record-keeping period we delete the data, except invoices and accounting records, which we keep for 10 years for accounting and tax purposes. On request we delete earlier whatever we are not required to keep, or return it to you.
7. We give you the information needed to show compliance with Article 28 GDPR and allow an audit once a year, on 30 days' notice, during business hours, at your cost.

## 4. Sub-processors

You give general authorisation for these sub-processors:

- INTERNET CZ, a. s. (Forpsi), Czech Republic: web and e-mail hosting, EU.
- Stripe Payments Europe, Limited (Ireland): payment processing.
- Carriers chosen for the shipment (named in the quote or in the tracking information).
- Manufacturing subcontractors named in the quote, when a file containing personal data must be passed to them. We avoid this wherever possible.

We announce new sub-processors on this page at least 14 days before they start. You may object by e-mail; if we cannot resolve the objection, you may cancel the affected tasks under the dispute and refund policy.

## 5. Transfers outside the EU

We store data in the EU. Shipping outside the EU necessarily transfers the recipient's shipping data to the carrier and the customs authority of the destination country, on your instruction. Other transfers happen only under the safeguards of Chapter V GDPR.

## 6. Liability and law

Liability follows Article 82 GDPR and the terms of service. Czech law governs this agreement.

## 7. Version

Version 2026-09-29.