Data Processing Agreement

This Data Processing Agreement ("DPA") applies whenever the billing owner of a Green Dot Team or Green Dot Club plan acts as data controller for the personal data of the seats within that workspace. The DPA is entered into between the billing owner ("Controller") and GreenDotPlay d.o.o. ("Processor").

1. Definitions

Terms used in this DPA have the meanings given to them in Regulation (EU) 2016/679 ("GDPR"). "Personal Data" means personal data processed under this DPA. "Sub-processor" means any third party engaged by Processor to process Personal Data on Controller's behalf.

2. Scope

The Processor processes Personal Data solely for the purpose of providing the Green Dot Team or Green Dot Club service to the Controller, in accordance with Controller's documented instructions as reflected in these Terms and the Privacy Policy.

3. Nature and purpose of processing

Subject-matter: providing the online Green Dot puzzle account service to Controller's seats. Duration: for as long as the Controller has an active Team or Club plan, plus fourteen days after cancellation for the grace window, then erasure. Nature and purpose: hosting each seat's Green Dot account, processing sign-ins, tracking solve-time statistics for each seat, running the private team or club board. Categories of data subjects: the natural persons occupying each seat of the Controller's workspace. Categories of personal data: email address, display name, city (from IP), solve-time records, session cookie, subscription payment status.

4. Processor obligations (Article 28 GDPR)

The Processor commits to:

• Process Personal Data only on Controller's documented instructions, including regarding international transfers, unless required by EU or Montenegrin law (in which case the Processor notifies the Controller unless prohibited from doing so).
• Ensure that persons authorised to process Personal Data are bound by confidentiality obligations.
• Implement the technical and organisational measures set out in Annex A of this DPA (see below).
• Only engage Sub-processors with prior general authorisation from the Controller; the current Sub-processor list is published at /security-whitepaper and updated with thirty-day advance notice for any change.
• Assist the Controller in complying with its own obligations under GDPR Articles 32 to 36 (security, breach notification, DPIA, prior consultation).
• At the Controller's choice, delete or return all Personal Data at the end of the service, plus copies, unless retention is required by law.
• Make available all information necessary to demonstrate compliance with Article 28, and allow for audits, in the form set out in Section 8 below.

5. Sub-processors

Controller authorises the Processor to engage the Sub-processors listed on the current /security-whitepaper page — an EU cloud infrastructure provider, an EU email delivery provider, an EU payment provider and an EU backup provider. Any change of Sub-processor is notified to Controller by email at least thirty days in advance; the Controller may object on legitimate grounds within that window, in which case the parties will negotiate in good faith a resolution.

6. International transfers

No Personal Data is transferred outside the EU/EEA under normal operations. If a transfer becomes necessary (for example a new Sub-processor located in a third country), the Processor will implement adequate safeguards under Article 46 GDPR, primarily Standard Contractual Clauses (Decision 2021/914) with a transfer impact assessment made available to the Controller on request.

7. Security measures (Annex A)

The Processor maintains: encryption in transit (HTTPS with HSTS, TLS 1.3), encryption at rest (AES-256), passwordless sign-in (no password hashes stored anywhere), signed session tokens with a maximum ninety-day lifetime, least-privilege production access limited to three named individuals, mandatory two-factor authentication for every production access, immutable audit logs of production access retained for one year, quarterly restore tests of encrypted backups, and a documented incident-response process with a 72-hour supervisory-authority notification target and prompt data-subject communication where required.

8. Audit

The Controller may audit the Processor once per twelve-month period, on thirty days' written notice, at the Controller's expense, without disrupting the Processor's operations or the confidentiality of other customers' data. In practice, the Processor makes available on request a copy of its most recent independent security audit report and answers reasonable follow-up questions in writing.

9. Personal-data breaches

The Processor notifies the Controller of any Personal Data breach affecting the Controller's workspace without undue delay and in any case within 48 hours of becoming aware. The notification includes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. The Processor supports the Controller in fulfilling its own Articles 33 and 34 obligations.

10. Data-subject rights

The Processor assists the Controller in responding to data-subject requests under GDPR Articles 12–23. For seats occupied by Controller's team members, the individual seat holder may exercise their own rights directly via dpo@greendotplay.org — the Controller does not need to intermediate.

11. Liability

Each party is liable to the other for damage caused by its own non-compliance with this DPA, subject to the liability caps and exclusions in the Terms of Service, provided that no such cap or exclusion applies to gross negligence, wilful misconduct, or breach of the Processor's confidentiality obligations.

12. Termination

This DPA terminates automatically on termination of the underlying Team or Club subscription. On termination, the Processor deletes all Personal Data within fourteen days, except for records the Processor is required by law to retain (invoices, anti-fraud logs).

13. Governing law and jurisdiction

This DPA is governed by the laws of Montenegro. Disputes fall under Osnovni sud u Podgorici. Nothing in this clause deprives an EU-domiciled Controller of the protection of mandatory provisions of its country of establishment.

14. Confidentiality

Each party undertakes to keep confidential any Personal Data and any technical or commercial information disclosed by the other party in connection with this DPA, and to protect such information with the same standard of care as it applies to its own confidential information (and in any event with reasonable care). This obligation continues for a period of five years after termination of the underlying subscription. Confidentiality does not apply to information already lawfully in the receiving party's possession without a confidentiality obligation, to information rightfully received from a third party free of confidentiality restrictions, to information required to be disclosed by law or by a competent authority, or to information that has entered the public domain other than through breach of this DPA.

15. Order of precedence

In case of conflict between this DPA, the Terms of Service and the Privacy Policy, on matters relating to processing of Personal Data on behalf of the Controller, this DPA prevails over the Terms of Service and the Privacy Policy. On matters not addressed in this DPA, the Terms of Service and the Privacy Policy continue to apply.

16. Notification and record-keeping obligations

The Processor maintains a record of all categories of processing activities carried out on behalf of each Controller in accordance with Article 30(2) GDPR. The record includes the name and contact details of the Processor and of the Controller, the categories of processing, transfers of Personal Data to a third country (if any) and a general description of the technical and organisational security measures. The record is made available to the supervisory authority on request.

17. Deletion or return of data

Within fourteen days of termination of the underlying subscription, and at the Controller's written election, the Processor either deletes all Personal Data (default) or returns it in JSON export format and then deletes it. The Controller may verify deletion by requesting a signed statement from the Processor's DPO. The exception in Section 12 concerning invoice retention and anti-fraud logs applies.

18. Assistance with DPIA and prior consultation

The Processor provides reasonable assistance to the Controller in carrying out data-protection impact assessments (Article 35 GDPR) and prior consultations with the supervisory authority (Article 36 GDPR), where such assessments or consultations concern Personal Data processed under this DPA. Assistance is provided at cost for extensive requests exceeding one working day of Processor staff time per calendar year, notified in advance.

19. Insurance

The Processor maintains professional-indemnity and cyber-liability insurance appropriate to the scale of its operations and the nature of the Personal Data processed. Details of policy limits are available on written request to the Controller for legitimate contractual or due-diligence purposes.

20. Contact

DPA-specific matters: dpo@greendotplay.org. Postal: GreenDotPlay d.o.o., ul. Slobode 27, 81000 Podgorica, Crna Gora. Supervisory authority: Agencija za zaštitu ličnih podataka (AZLP) reg. no. 05-030/24-2718.