Personal Data Protection¶
Roles under GDPR, scope of processing by the Provider, and data subject rights
Version: 1.0.0
Classification: Confidential
Owner: Managing Director, MAZEVAULT s.r.o.
Last Updated: 2026-05-01
Review Cycle: Annual and upon any change to the contractual documentation or legal framework
1. Roles of the Contracting Parties¶
The processing of personal data in connection with the Product is governed by the tripartite Data Processing Agreement (DPA, Annex 2), which the Customer concludes with the Partner and the Provider.
| Party | Role under GDPR | Scope |
|---|---|---|
| Customer | Controller | Determines the purposes and means of processing in the Product; is responsible for the legal basis of the data entered, retention, backups and access in its environment (DPA Art. 2.1, 5) |
| Partner | Processor | Only if it accesses the Customer's environment or diagnostic data during implementation, support or operation (DPA Art. 2.2) |
| Provider (MAZEVAULT s.r.o.) | Conditional sub-processor | No standard access to the environment or data. Processes only personal data that the Partner makes available to it during upstream escalation on the Customer's documented instruction, exclusively for diagnosing a defect or a security issue (DPA Art. 2.3) |
| Provider | Independent controller | Technical license server metadata necessary for License management (DPA Art. 2.4; License Terms Art. VII) — see Section 2 |
No provision entitles the Provider or the Partner to request private keys, passwords, tokens or the unencrypted content of Security Assets (DPA Art. 2.5).
2. What the Provider Processes¶
2.1 As an Independent Controller — License Server¶
| Parameter | Data |
|---|---|
| Data | Installation/organisation identifier, organisation name, license key and status, Product version, timestamps of license activation and verification, license usage metrics, license administrator contact e-mail |
| Purpose | Conclusion and management of the License, license control, security of the license server, invoicing via the Partner, protection of the Provider's rights |
| Legal basis | Art. 6 para. 1 point (b) GDPR (performance of a contract) and point (f) (legitimate interest in protecting the license and security) |
| Recipients / processor | Hosting provider of the license server in the EU — see Subprocessor and Supplier List |
| Transfers outside the EU/EEA | No |
| Retention period | For the duration of the License and thereafter for the period necessary to protect the Provider's rights (limitation period) |
| What is not processed | Customer Data or Security Assets (certificates, keys, secrets, passwords) — these do not leave the Customer's environment for the license server |
This metadata is neither Customer Data nor Security Assets and will not be used for marketing without a separate legal basis (DPA Art. 2.4).
2.2 As a Conditional Sub-processor — Diagnostics during Upstream Escalation¶
| Parameter | Data |
|---|---|
| When | Only if the Partner, on the Customer's documented instruction, hands over diagnostic materials to the Provider, or the Customer expressly approves temporary diagnostic access |
| Data | Per DPA Annex A: identification and contact data of users, authentication and access data (not passwords or MFA secrets), audit and operational records, data in certificates (CN, SAN) |
| Purpose | Diagnosis of a defect or a security issue, or provision of product support |
| Retention period | Diagnostic copies for no longer than 30 days after the ticket is closed, unless a longer period is necessary due to an incident or a legal obligation (DPA Annex A) |
| Measures | DPA Annex B; the Customer minimises the materials before handover where possible (DPA Art. 5.1) |
3. What the Product Processes in the Customer's Environment¶
The Product processes personal data exclusively in the Customer's infrastructure and under the Customer's control. Typical categories: user and administrator accounts (name, work e-mail, role, MFA status), audit records (who, when, what), data in the subject and SAN of certificates. Special categories of data (Art. 9 GDPR) are not an intended subject of processing.
Product features supporting the controller's obligations (implementation described in the Security section):
- encryption of data at rest and in transit, encryption keys under the Customer's control (Encryption),
- role-based access control and MFA (RBAC, Authentication),
- integrity-protected audit log with export to SIEM (Audit Logging),
- configurable retention of audit records and export/erasure of data by the Customer's administrator.
4. Data Subject Rights¶
Data subject requests concerning data processed in the Product are handled by the Customer as controller. If the Provider or the Partner receives such a request, it forwards it to the Customer without undue delay and does not respond to it substantively without the Customer's instruction (DPA Art. 6.1).
Requests concerning license metadata (Section 2.1) are handled by the Provider at info@mazevault.com. The data subject has the right to lodge a complaint with the Czech Office for Personal Data Protection.
The Provider has not appointed a data protection officer (the obligation under Art. 37 GDPR does not apply to it); the contact point for personal data protection is info@mazevault.com.
5. Personal Data Breach¶
| Who → whom | Time limit | Basis |
|---|---|---|
| Partner → Customer | Without undue delay, no later than 24 hours from the moment it becomes aware of the breach | DPA Art. 7.1 |
| Provider → Partner and simultaneously Customer | Same, if the breach concerns data made available to the Provider under DPA Art. 2.3 | DPA Art. 7.1 |
| Provider → data subjects / ÚOOÚ | For license metadata as an independent controller under Art. 33–34 GDPR | GDPR |
The controller's notification obligations towards the ÚOOÚ (Czech Office for Personal Data Protection) and data subjects for processing in the Product remain with the Customer (DPA Art. 7.3).
6. Sub-processors and Transfers¶
- The Partner concludes written contracts with further sub-processors imposing equivalent obligations (DPA Art. 8.3); it notifies changes 30 days in advance, and the Customer may object within 15 business days (DPA Art. 8.1–8.2).
- Personal data are processed in the EU/EEA; transfers outside the EU/EEA only on the Customer's documented instruction and with a mechanism under Chapter V GDPR (DPA Art. 9).
- Current overview: Subprocessor and Supplier List.
7. Audit and Erasure¶
- Materials demonstrating compliance and cooperation with an independent auditor in accordance with DPA Art. 10.
- After the end of the service, the Partner and the Provider return or erase the personal data obtained for the Customer; the Customer performs its own export from the operated environment (DPA Art. 11).