Data Protection (GDPR) for Clients

This document complements our Privacy Policy (which covers the data of Site visitors) and describes our data protection commitment as a managed IT service provider for business clients — a role in which ONEGEST often processes personal data on the client's behalf (for example, when managing the email, backups, ERP or CRM of a company which, in turn, contains personal data of its employees and customers).

1. ONEGEST's role: controller versus processor

Under Article 4 GDPR, when the client (the "controller") engages ONEGEST to manage infrastructure, email, backups, its ERP or its CRM, ONEGEST acts as a processor — it processes personal data exclusively on the client's documented instructions, for the purpose of providing the contracted service, and never for its own purposes.

2. Data Processing Agreement (DPA)

For clients on the Cloud Productivity and Total Management packs, or of any service involving access to personal data managed by the client (email, backups, ERP, CRM), we provide a Data Processing Agreement (DPA), in accordance with Article 28 GDPR, which is signed at the time of contracting. This agreement sets out, among other things: the subject matter and duration of the processing, its nature and purpose, the type of personal data and categories of data subjects, and the obligations and rights of the controller (the client).

3. Sub-processors

To provide its services, ONEGEST uses suppliers and technology partners that may process personal data on behalf of the end client:

• Hostinger — web hosting, domains, VPS/Cloud and professional email;
• Microsoft — Microsoft 365 (email, files, productivity);
• Google — Google Workspace (email, files, productivity);
• Cegid — business management software (ERP) and invoicing;
• CRM platform providers — when the Sales Management and CRM service is contracted; the specific provider is stated in the Data Processing Agreement;
• Managed backup and cybersecurity providers — on-premise and SaaS backup, managed antivirus, EDR, firewall and VPN.

The full, up-to-date list of sub-processors relevant to the contracted service is set out in the corresponding Data Processing Agreement. ONEGEST undertakes to notify the client of any change to this list, giving the client the opportunity to object, save where there is a justified technical or contractual impediment.

4. Technical and organisational security measures

• Encryption of data in transit (HTTPS/TLS) across all managed services;
• Role-based access control, with authentication appropriate to each system;
• Backup policy with periodic, documented restore testing — not just copying the data, but regularly confirming that it can be recovered;
• Managed antivirus and, at the advanced tiers, endpoint detection and response (EDR);
• Logging and monitoring of security incidents.

5. Notification of personal data breaches

In the event of a security breach affecting data processed on behalf of a client, ONEGEST undertakes to notify the client (the controller) without undue delay, so that the client can meet its own obligation to notify the supervisory authority within 72 hours, in accordance with Article 33 GDPR.

6. Return or deletion of data at the end of the contract

At the end of the contractual relationship, ONEGEST returns to the client, or securely deletes — as instructed by the client — all personal data processed on its behalf, including copies held in backup systems, unless there is a legal obligation to retain it.

7. International data transfers

Some sub-processors (in particular Microsoft and Google) may process data in data centres located outside the European Economic Area. In such cases, ONEGEST ensures that valid transfer mechanisms are in place under Chapter V GDPR, such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, as appropriate.

8. Relationship with the NIS2 Directive

For clients subject to Directive (EU) 2022/2555 (NIS2) — or forming part of the supply chain of companies that are subject to it — ONEGEST provides an NIS2 assessment and action plan service, which complements, but does not replace, the data protection obligations described here — NIS2 governs cybersecurity risk management and incident reporting at organisational level, with objectives that are different from (although overlapping with) those of the GDPR.

9. Contact for data protection matters

To request the Data Processing Agreement applicable to your contract, or for any question about the processing of personal data in our services, write to us at info@onegest.com or call +351 965853634.