Pharos
Data Processing Agreement
1. Parties
The controller is the team, or κλιμάκιο (the association or body that runs it), as declared by the administrator who created it and accepted this agreement. The processor is DANIAS EVANGELOS LP ("the processor"). The agreement is made when it is accepted in the app and runs as long as the Terms of Use do.
2. Subject matter
The processor hosts and processes the team's data to provide it with the Pharos app: managing members, shifts, vehicles, equipment, incidents, training, events and finances.
| Data subjects | The team's members (active, inactive, former), emergency contacts, third parties named in incidents or equipment issues. |
|---|---|
| Categories | Identity (full name, father's name, photo, date of birth, identity number, tax number, social security number, registry number, identity card scans), contact, degrees and licences, shifts and attendance, equipment each member holds, incidents, finances (dues, expenses), activity log. |
| Special categories | Health data: blood type, medical notes, medical certificates. |
| Duration | While the agreement runs, and until the deletion in section 9. |
3. Instructions
The processor processes the data only on the team's documented instructions. These terms and the team's actions in the app (entering, changing, removing a member, deleting) are those instructions. The processor tells the team if it considers an instruction to breach the GDPR. It does not use the data for its own purposes, and neither sells nor shares it.
4. Confidentiality
Only those who need the data to run and support the service have access to it, and they are bound to confidentiality. The processor opens a team's data only for support the team asked for, for the security of the service, or where the law requires it.
5. Security measures (Article 32)
- Teams kept apart in the database: each request sees only its own team's rows (row-level security).
- Access within the team by role and permission, the most sensitive fields visible only to those the team names.
- Encryption on every connection (TLS) and of stored data by the providers.
- Files are not public: they are served only through the app, to whoever may see them.
- An activity log, backups, and checks that backups restore.
- The providers' keys are held only by the server, never the browser.
6. Subprocessors
The team gives general approval to the subprocessors listed in the Privacy Policy (section 4). The processor tells the team at least 30 days before adding or changing a subprocessor, and the team may object and end the agreement. Each subprocessor is bound by equivalent obligations. Transfers outside the EEA rest on the EU-US Data Privacy Framework or the Standard Contractual Clauses, and for the United Kingdom on the European Commission's adequacy decision.
7. Data subjects' rights
The processor helps the team answer requests for access, rectification, erasure, restriction and portability. Most are done by the team itself in the app. A request that reaches the processor directly is passed to the team without delay.
8. Personal data breaches
The processor tells the team without undue delay, and at the latest within 48 hours of becoming aware of a breach affecting its data, with the details it has, so the team can notify the Authority within the 72 hours of Article 33.
9. Ending: return and deletion
- On the team's request, the processor hands it a copy of all its data and files in common formats within 30 days.
- After the end, it deletes the team's data and files and its members' accounts within 30 days. Backups taken before the deletion hold the data until they are deleted too, once newer ones replace them. Only what the law requires is kept (such as invoices).
10. Audits
The processor gives the team the information it needs to show compliance with Article 28, and allows audits by the team or an auditor it appoints, with reasonable notice and at the team's cost.
11. Impact assessment
Because the team processes health data and identity numbers, it may need an impact assessment (Article 35). The processor gives it the information about the service it needs for one.