Data Processing Terms (DPA)

Parties and acceptance

These Data Processing Terms form an agreement under Article 28 GDPR, accepted online, and constitute an integral part of the BizCup Terms of Use (the “Main Agreement”). No separately hand-signed copy is required.

Controller: the Company (business) that creates or administers a league on the BizCup Platform and thereby accepts the BizCup Terms — the “Controller”. The Controller is identified from the data provided at registration or league creation; no separate company-name entry or handwritten signature is required.

Processor: Pro-Sharp Hungary Zrt. (registered seat: 1145 Budapest, Bácskai utca 29/A, Hungary; company reg. no.: 01-10-143757; tax no.: 33095424-2-42; EU VAT no.: HU33095424; e-mail: bizcup@pro-sharp.hu) — the “Processor”.

By using the Platform — creating or administering a league — the Controller is deemed to accept these terms without separate signature. The following applies between the Parties under Article 28 GDPR.

1. Subject matter and duration

The Processor processes the personal data needed to operate the BizCup league on behalf of and per the written instructions (documented on the Platform) of the Controller. These terms remain in force for the term of the Main Agreement and while the Processor processes the Controller’s data.

2. Details of processing

• Subject matter: operating the corporate prediction contest (league) on the Platform.

• Nature and purpose: account management, league/team organisation, handling predictions and points, rankings, notifications.

• Data subjects: the Controller’s employees and participants invited by it.

• Data categories: name / display name, company e-mail, company/department, predictions, points, ranking, log data, optionally profile picture. No special-category data.

3. Processor’s obligations (Art. 28(3) GDPR)

The Processor shall:

a) process data only on the Controller’s documented instructions (including transfers to a third country), unless required otherwise by law — in which case it informs the Controller beforehand;

b) ensure persons accessing the data are bound by confidentiality;

c) implement risk-proportionate technical and organisational security measures under Art. 32 GDPR (Annex 2);

d) engage sub-processors only with the Controller’s general prior authorisation (Annex 3); notify the Controller of new sub-processors, who may object on reasonable grounds; impose equivalent data-protection obligations on the sub-processor;

e) assist the Controller with appropriate measures in responding to data-subject requests (access, rectification, erasure, etc.);

f) assist the Controller with obligations under Arts. 32–36 (security, data-breach notification, impact assessment); in case of a breach, notify the Controller without undue delay, within 48 hours at the latest;

g) on termination of the Main Agreement, at the Controller’s choice return or delete the data (and existing copies), unless storage is required by law;

h) make available to the Controller all information needed to demonstrate compliance with Art. 28, and allow for audits (at reasonable times, without disrupting operations, under confidentiality).

4. Transfers to third countries

Processing takes place primarily within the EU/EEA. Transfers outside the EU/EEA only with appropriate safeguards under Chapter V GDPR (e.g. an adequacy decision, the EU–US Data Privacy Framework or the EU Standard Contractual Clauses), informing the Controller.

5. Liability

Liability is governed by Art. 82 GDPR and the Main Agreement. The Processor is liable for damage caused by breaching its GDPR processor obligations or the Controller’s lawful instructions.

6. Annexes

• Annex 1: detailed description of processing (per Section 2 above).

• Annex 2: technical and organisational measures (encryption in transit and at rest, access control, logging, backups, access reviews, incident-response process).

• Annex 3: list of approved sub-processors (Microsoft Azure — EU; Google Analytics; sports-data provider; Slack — per actual vendors, published on the Platform).