Data Processing Agreement (DPA) — Neocliniq
This English translation is provided for convenience only. In case of any discrepancy, the Romanian version prevails.
1. The parties, the nature of the agreement, and its conclusion
1.1. This data processing agreement (hereinafter the “DPA”) is entered into between:
- Microsec International SRL, with its registered office at Str. Lungă, Nr. 53, Sibiu, Sibiu County, Romania, registered with the Trade Registry under no. J32/937/2022, CUI 46116608 (VAT: RO46116608), e-mail: contact@neocliniq.com — the operator of the Neocliniq platform, hereinafter “Neocliniq” or “the Processor”; and
- the Customer — the entity (typically a dental laboratory) that has accepted the Platform’s Terms and Conditions (hereinafter “the Terms”), hereinafter also referred to as “the Controller”.
1.2. The DPA forms an integral part of the Terms (see arts. 7.4 and 15.4 of the Terms) and is concluded automatically, without a separate signature, upon acceptance of the Terms — by creating the account, by ticking the acceptance option at registration, or by actually using the Service. Capitalized terms not defined here have the meanings given in the Terms.
1.3. The DPA governs the processing by Neocliniq, in its capacity as processor within the meaning of Art. 28 of Regulation (EU) 2016/679 (the “GDPR”), of the personal data that the Customer, in its capacity as controller, enters into its Workspace (“the Processed Data”, part of the Customer Data). For the data that Neocliniq processes in its own capacity as controller (account, billing, and technical data), the Privacy Policy applies, not this DPA.
1.4. In the event of any inconsistency between the DPA and the Terms with regard to the protection of personal data, the DPA prevails.
2. Description of the processing
2.1. Subject matter and nature of the processing: the hosting, storage, structuring, display, transmission, backup, and deletion of the Processed Data, as well as the related technical operations necessary for providing the Service, including technical support at the Customer’s request.
2.2. Purpose of the processing: exclusively the provision of the Service to the Customer, in accordance with the Terms. Neocliniq does not process the Processed Data for its own purposes.
2.3. Duration of the processing: for the term of the contract (Subscription or Trial Period), plus the grace period of 90 days provided for in art. 8.4 of the Terms, until the data is deleted or returned in accordance with art. 10 below.
2.4. The categories of data subjects and the categories of data are described in Annex A. They may include data concerning health (Art. 9 GDPR) to the extent that the Customer chooses to enter such data (for example, the clinical details of a dental restoration); the Customer alone determines what data it enters.
3. Obligations of the Customer (the Controller)
3.1. The Customer warrants that it holds the legal grounds necessary for processing the Processed Data and for transmitting it to Neocliniq, including, where applicable, having adequately informed the data subjects (Arts. 13–14 GDPR) and, where necessary, having obtained their consent.
3.2. The Customer shall ensure that it enters into the Platform only the data necessary for its purposes (the principle of data minimization) and that its processing instructions comply with the applicable legislation.
3.3. The Customer fulfils its own obligations as controller: the record of processing activities, impact assessments where required, responding to data subjects, and notifying breaches to the supervisory authority and to the data subjects, with Neocliniq’s assistance in accordance with arts. 7 and 9 below.
4. Processing instructions
4.1. Neocliniq processes the Processed Data only on the basis of the Customer’s documented instructions. The instructions are embodied in: (a) this DPA and the Terms; (b) the configuration and use of the Platform’s features by the Customer and its Users; (c) specific requests submitted in writing (including by e-mail) in the course of technical support.
4.2. By way of exception, Neocliniq may process the Processed Data without the Customer’s instructions where the obligation arises under Union law or Romanian law; in such a case, Neocliniq shall inform the Customer before processing, unless the law prohibits such information on important grounds of public interest.
4.3. Neocliniq shall immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions, without this constituting legal advice.
5. Confidentiality
The persons authorized by Neocliniq to process the Processed Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and their access is limited to what is necessary for providing the Service (the need-to-know principle).
6. Security of processing
6.1. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risks to the rights and freedoms of natural persons, Neocliniq implements the appropriate technical and organizational measures provided for in Art. 32 GDPR, described in Annex C.
6.2. Neocliniq may update the security measures, provided that the overall level of protection is not diminished during the term of the contract.
7. Assistance to the Controller
7.1. Data subjects’ rights. Taking into account the nature of the processing, Neocliniq assists the Customer, by appropriate technical and organizational measures (primarily through the Platform’s features — access, rectification, export, deletion), in fulfilling its obligation to respond to data subjects’ requests (Arts. 12–23 GDPR). If a data subject contacts Neocliniq directly in connection with data for which the Customer is the controller, Neocliniq shall forward the request to the Customer without undue delay and shall not respond to it on the merits except on the Customer’s instruction or where required by law.
7.2. Obligations under Arts. 32–36 GDPR. Neocliniq assists the Customer, insofar as the necessary information is available to it, in ensuring compliance with the obligations regarding the security of processing, the notification of breaches, data protection impact assessments, and prior consultation of the supervisory authority.
7.3. The assistance provided for in this article is included in the price for reasonable and occasional requests; for requests that are repeated or disproportionate, or that require specific development work, the parties may agree on a reasonable fee, communicated in advance.
8. Sub-processors
8.1. The Customer grants Neocliniq a general written authorization for the use of sub-processors in the provision of the Service. The list of sub-processors authorized as at the date of this DPA is set out in Annex B; the up-to-date list is available at any time on request, at contact@neocliniq.com.
8.2. Neocliniq shall inform the Customer, through the application and/or by e-mail, at least 30 days before adding or replacing a sub-processor that processes the Processed Data. The Customer may object, within 15 days of being informed, on reasonable and documented grounds relating to data protection. If the objection cannot reasonably be resolved (for example, through an alternative measure), the Customer may terminate the contract in accordance with the Terms, with effect from the date on which the new sub-processor would begin processing, without any termination penalties (amounts already paid remain subject to art. 6.7 of the Terms).
8.3. Neocliniq imposes on each sub-processor, by way of a contract or other legal act, data protection obligations at least equivalent to those set out in this DPA, and remains fully liable to the Customer for the performance of its sub-processors’ obligations.
9. Notification of personal data breaches
9.1. Neocliniq shall notify the Customer without undue delay after becoming aware of a personal data breach affecting the Processed Data.
9.2. The notification shall include, insofar as the information is available: the nature of the breach, the categories and approximate number of data subjects and of records affected, the likely consequences, the measures taken or proposed for remediation and mitigation, and a point of contact. The information may be provided in phases, as it becomes available.
9.3. The obligations to notify the supervisory authority (Art. 33 GDPR) and the data subjects (Art. 34 GDPR) rest with the Customer, in its capacity as controller; Neocliniq shall provide it with reasonable assistance for this purpose and shall not notify the authority or the data subjects on the Customer’s behalf except on the Customer’s instruction or where required by law.
10. Deletion or return of the data upon termination
10.1. Throughout the term of the contract, the Customer may at any time export its essential data in a structured format (CSV), through the Platform’s features (art. 7.3 of the Terms).
10.2. After the contract ends, regardless of the reason, the Processed Data is retained for the 90-day grace period provided for in art. 8.4 of the Terms, during which the Customer may request its export or the reactivation of the Subscription. Upon expiry of the grace period, Neocliniq permanently deletes the Processed Data from the active systems and, from backups, in accordance with their normal rotation cycle.
10.3. By way of exception, Neocliniq may retain data whose storage is required by Union law or by Romanian law, exclusively for the duration and for the purpose provided for by law.
11. International transfers
The Processed Data is hosted in the European Union. To the extent that a sub-processor carries out, for certain operations, transfers to third countries, such transfers take place only in compliance with Chapter V of the GDPR: adequacy decisions (including the EU–U.S. Data Privacy Framework, where applicable) and/or standard contractual clauses (SCCs) adopted by the European Commission, supplemented, where necessary, by additional measures (see also art. 7 of the Privacy Policy).
12. Audits and demonstrating compliance
12.1. Neocliniq makes available to the Customer the information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR, including, on request, descriptions of the security measures and certifications or audit reports of the infrastructure providers.
12.2. The Customer (or an auditor mandated by it, who is not a competitor of Neocliniq and is bound by confidentiality) may carry out an audit at most once a year, with 30 days’ prior notice, during normal working hours, without disrupting Neocliniq’s operations and without access to the data of other customers. Each party bears its own costs; if the audit finds no significant breaches, Neocliniq’s reasonable costs may be invoiced to the Customer. In the event of an established breach or at the request of a supervisory authority, the frequency limitation does not apply.
13. Liability
The parties’ liability in connection with this DPA follows the regime set out in art. 11 of the Terms, to the extent permitted by law. Nothing in this DPA limits liability towards data subjects under Art. 82 GDPR, nor data subjects’ rights.
14. Term, governing law, and final provisions
14.1. The DPA enters into force upon acceptance of the Terms and remains in force for as long as Neocliniq processes Processed Data for the Customer (including during the grace period).
14.2. The DPA is governed by Romanian law; disputes follow the regime set out in art. 14 of the Terms.
14.3. Amendments to the DPA follow the regime for amending the Terms (art. 13 of the Terms). If any clause is declared null, the remaining clauses remain in force.
Annex A — Description of the processing
- Subject matter of the processing: the Customer Data entered into the Workspace, to the extent that it contains personal data.
- Nature and purpose: hosting, storage, structuring, display, transmission, backup, export, and deletion — for the provision of the Service (art. 2).
- Duration: the term of the contract + the 90-day grace period (arts. 2.3 and 10).
-
Categories of data subjects:
- patients of the Customer’s partner clinics/collaborating doctors, insofar as they are associated with orders/cases;
- collaborating doctors and the staff of partner clinics (professional contact details);
- the Customer’s Users (name, e-mail, role, activity in the Platform);
- other persons whose data is included by the Customer in uploaded documents or files.
-
Categories of data:
- identification and contact data (name, e-mail, telephone, professional addresses);
- data regarding orders/cases: patient identifiers associated with a case, technical details of the work, deadlines, statuses;
- financial data relating to the Customer’s relationship with the clinics (prices, balances, collections, estimates);
- files attached to cases (for example, scans, photographs, STL files), which may contain data concerning health (Art. 9 GDPR), to the extent that the Customer chooses to upload them.
Annex B — Authorized sub-processors
| Sub-processor | Role | Processing location |
|---|---|---|
| Microsoft Azure (Microsoft Ireland Operations Ltd.) | hosting of the infrastructure, databases and files | West Europe region (Netherlands), EU |
| Auth0 / Okta | authentication and identity management services | tenant in the EU region |
| Stripe (Stripe Payments Europe Ltd.) | card payment processing and subscription management | EU, with possible transfers to Stripe Inc. (USA) in accordance with art. 11 |
| Microsoft Azure Communication Services | sending transactional e-mails | Microsoft infrastructure, with processing directed towards the EU |
Annex C — Technical and organizational measures (Art. 32 GDPR)
- encryption of data in transit (TLS/HTTPS) and encryption at rest provided by the cloud infrastructure;
- authentication through a specialized provider (Auth0), with no storage of plain-text passwords; support for modern authentication mechanisms;
- logical separation of each Workspace’s data (multi-tenant architecture with tenant-level isolation);
- role-based access control, both within the application and internally, on a need-to-know basis;
- logging, monitoring, and periodic backups, with defined rotation cycles;
- hosting in certified data centres (Microsoft Azure, EU), with industry-grade physical and organizational measures;
- vendor assessment and the conclusion of data processing agreements with each sub-processor;
- internal procedures for managing security incidents and notifying breaches (art. 9).
Contact
Microsec International SRL
Str. Lungă, Nr. 53, Sibiu, Sibiu County, Romania
CUI: 46116608 (VAT: RO46116608) | Trade Registry: J32/937/2022
E-mail: contact@neocliniq.com
Last updated: August 2026