Data processing agreement

Effective from: 13 November 2026 · Version 2

This agreement is made under Article 45 of the Serbian Law on Personal Data Protection ("Official Gazette of RS", No. 87/2018, the "Law") between:

• the business using LagerOS, as the controller (the "business"), and
• Milan Milić, the provider of LagerOS, as the processor ("LagerOS").

This agreement is part of the Terms of use and the business accepts it together with them. On request, we also send a copy signed on our side.

1. Subject and duration

LagerOS processes the personal data that the business and its users enter into the app, solely to provide the service. The agreement lasts while the business uses the service, and its obligations remain until the data is deleted (point 4.9).

2. Nature and purpose of processing

Storing, displaying, searching, changing and deleting data; printing receipts; export to Excel; sending emails and notifications to the business's users; reading an image or PDF with an AI model when a user starts “Import from image”; backups. The types of data and data subjects are described in Annex 1.

3. The business's instructions

LagerOS processes data only on the business's instructions. The instructions are this agreement, the Terms of use, and what the business does in the app (entering, changing, deleting, settings). If we believe an instruction is unlawful, we will inform the business immediately.

4. LagerOS's obligations

1. Confidentiality. Only people bound to confidentiality who need it to run the service have access to the data.
2. Security. We apply the measures in Annex 2 and keep improving them.
3. Sub-processors. The business gives general authorisation for the sub-processors in Annex 3. We inform the business of a new sub-processor at least 30 days in advance; the business may object and, if we cannot agree, terminate the agreement. We have a contract with each sub-processor carrying the same protection obligations.
4. Transfers outside Serbia only as listed in Annex 3, with the safeguards required by the Law (Art. 64 and 65).
5. Data subject rights. We help the business respond to requests (access, correction, erasure, portability). The business does most of this itself in the app. Requests that reach us directly are forwarded to the business.
6. Data breaches. We notify the business of a data breach without undue delay, and no later than 48 hours after becoming aware of it, with the information needed to notify the Commissioner (Art. 52).
7. Assistance with data protection impact assessments and prior consultation with the Commissioner, where needed (Art. 54 and 55).
8. Audits. On request, we provide the information needed for the business to verify compliance with this agreement and allow inspections with reasonable notice.
9. End of processing. When the service ends, the business has 30 days to export its data. We then delete it, and it disappears from backups within the following 30 days, unless the law requires longer retention.

5. The business's obligations

• Has a legal basis for the data it enters and informs data subjects about the processing (Art. 23).
• Enters only the data it needs and decides how long to keep it.
• Gives users only the permissions they need and makes sure they keep their passwords safe.

6. Liability

Liability is governed by the Terms of use, unless the Law provides otherwise.

Annex 1: Data subjects and types of data

The app does not ask for special categories of data (Art. 17 of the Law), and the business should not enter them.

Annex 2: Security measures

• HTTPS for all traffic; server in a secured data centre in the EU.
• Each business's data kept separate, enforced at the database level.
• Roles and permissions per user; passwords stored as a secure hash; temporary lockout after 5 wrong attempts; two-step sign-in.
• Change history and access log visible to the business.
• Uploaded files are checked and hidden data is removed from images.
• Daily backups, also at a second location in the EU; database backups kept 14 days, and 30 days at the second location.
• Only the provider (with an SSH key) and the automated release process can access the server; passwords and keys exist only on the server.
• Technical logs kept 30 days, without the content of entered data.

Annex 3: Sub-processors

The AI assistant (Anthropic PBC, USA) does not receive the business's data, only the user's question or the text of a problem report; we are the controller for that (Privacy policy, section 5). Camera scanning is done by the user's browser; images never leave the device.