AXON Cloud · EN
DPA — Data processing agreement
Version 1.6 · Effective 2026-10-10
This document is a data processing agreement (Art. 28 GDPR) between:
- Controller — the Customer using AXON Cloud (your company)
- Processor — AXON CLOUD, obrt za računalno programiranje, vl. Leonard Fedetov (AXON Cloud), Ulica Giuseppea Trombe 102, 52203 Šišan, Republika Hrvatska, OIB 17445628019
It applies automatically to AXON Cloud as SaaS unless you signed a separate DPA.
1. Subject and duration
The Processor processes personal data only to provide the ERP / SaaS service, for the contract term and a reasonable period after (export / deletion).
2. Nature and purpose
Hosting, storage, display, export, backup and support for data the Controller enters into modules (e.g. partners, HR, RAC, hospitality, CRM, accounting).
3. Types of data and data subjects
Depending on modules: identity and contact data, contractual / accounting data, employees, guests, members, drivers / renters, etc. — as determined and entered by the Controller.
4. Processor obligations
The Processor shall:
- process data only on the Controller’s documented instructions (use of the software = instructions)
- ensure confidentiality of authorised persons
- implement appropriate technical and organisational measures — see Security
- engage sub-processors under equivalent duties (see §4a); list updates on request
- assist with data-subject rights to a reasonable extent
- assist with security and breach notification
- delete or return data after end of service, per instructions and law
- make available information needed to demonstrate compliance (reasonable audit)
4a. Sub-processors (current)
| Sub-processor | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Cloud hosting, servers, storage, backups | European Union / EEA (Hetzner data centres) |
| Google LLC / Google Workspace (Gmail SMTP/IMAP where configured) | Transactional / support e-mail | EEA / SCC where applicable |
The Processor may replace or add sub-processors with equivalent protection; material changes are published or notified on request. Details: Security.
5. Controller obligations
The Controller warrants a lawful basis for entering data, informs data subjects, and will not instruct processing contrary to the GDPR.
6. International transfers
Primary hosting is in the EEA (Hetzner Online GmbH). If the Processor or a sub-processor transfers data outside the EEA, a lawful transfer mechanism is used (e.g. SCCs).
7. Contact
DPA / privacy: [email protected] · [email protected]
Customer support: [email protected]
For a signed DPA PDF or updated sub-processor list: [email protected] · [email protected]