Gest Peritia
Back to home

Data Processing Agreement (DPA)

Parties and definitions

This Data Processing Agreement (the “DPA” or “Agreement”) governs the relationship between the expert or expert practice that contracts or uses Gest Peritia (the “Controller”) and Gest Peritia (the “Processor”) when the Controller uses the application to process personal data of third parties: persons examined, clients, opposing parties, witnesses and anyone else appearing in their case files.

This DPA is signed electronically on accepting the terms of the service and forms an integral part of them. It applies automatically and is deemed accepted when the Controller enters the first item of third-party personal data into the application.

On the one hand, the Data Controller is the court-appointed expert, expert practice or professional company that contracts or uses Gest Peritia and loads into the application personal data of third parties over which it holds title or a legitimate interest in the processing.

On the other hand, the Data Processor is Tarraco App Lab, S.L.U. (being incorporated), owner of Gest Peritia (a registered trade mark of its property), with registered address at C/ Pau Claris, 2 · 43005 Tarragona (Cowork Tarraco), Spain, with contact address privacidad@tarracoapplab.com.

The definitions in article 4 of Regulation (EU) 2016/679 (GDPR) and in Spanish Organic Act 3/2018 on data protection and the guarantee of digital rights (LOPDGDD) apply.

Subject matter, duration and nature of the processing

Subject matter. Processing by the Processor, on behalf of the Controller, of the personal data that the Controller loads into Gest Peritia for the provision of the contracted services.

Duration. The duration of the processing matches the duration of the contractual services relationship, save for any mandatory legal retention afterwards.

Nature. Automated processing on cloud infrastructure with servers in the European Union: database in Ireland (region eu-west-1), attached documents in Frankfurt (region eu-central-1), encrypted by the application with AES-256-GCM on top of the provider's encryption, server functions in Ireland and daily encrypted backups in Frankfurt, with encryption in transit and at rest in accordance with the technical and organisational measures described below.

Purpose. Solely the provision of the contracted services (management of case files, deadline tracking, production of court writings and expert reports, invoicing and accounting, together with handling the technical support the Controller requests).

Categories of data and of data subjects

The categories of personal data processed and the data subjects affected vary depending on the module used. The most common are:

Expert-witness case files. Data subjects: persons examined, the expert's clients, opposing parties, witnesses and anyone else appearing in the case file. Identifying data: first name, surname, tax ID (NIF/NIE), address, telephone and email. Data on the proceedings: court, case number, subject matter, appointing party, deadlines and status of the case file. Documentation: writings, court decisions, technical reports, photographs and other documentary evidence the Controller adds.

Invoicing and accounting. Data subjects: the Controller's clients and suppliers. Identifying data: name or company name, tax ID and tax address. Financial data: invoices issued and received, taxable base, VAT, withholding, total, date, description and method of payment.

Calendar and reminders. Data subjects: the persons summoned to the steps scheduled by the Controller. Data: name, reason for the appointment, date and place.

The Controller undertakes not to load special categories of data into the application (racial origin, health, ideology, sex life or orientation, genetic or biometric data) except where strictly necessary for the purpose of the expert work and with an appropriate legal basis. For such data, the enhanced measures applied by the Processor are those described in this Agreement: encryption of attached documents by the application itself (AES-256-GCM), storage exclusively in the European Union, access only with an active session on every download and encrypted backups. The Processor offers no measures beyond those described here and it is for the Controller to assess whether they are sufficient for its processing.

Obligations of the Processor (Gest Peritia)

The Processor undertakes to:

  • Process the personal data solely in accordance with the documented instructions of the Controller, including those relating to international transfers, unless Union or Member State law requires otherwise, in which case it will notify the Controller before the processing, unless prohibited by law.
  • Ensure that staff with access to the data have undertaken to respect confidentiality, through a contractual undertaking and periodic training. The duty of confidentiality survives the end of the relationship.
  • Adopt the technical and organisational measures required by art. 32 GDPR, as detailed below.
  • Not subcontract the processing to third parties without the prior authorisation, general or specific, of the Controller. Signing this DPA constitutes general authorisation for the sub-processors listed in this document, with the Controller's right to object to the addition of new sub-processors.
  • Assist the Controller with appropriate technical and organisational measures to deal with data subjects' rights (access, rectification, erasure, restriction, objection, portability). Where a data subject addresses a request to the Processor, it will be passed on to the Controller within a maximum of 5 calendar days.
  • Help the Controller to comply with its obligations under arts. 32 to 36 GDPR (security, breaches, impact assessments and prior consultation).
  • Notify the Controller without undue delay and, in any event, within a maximum of 48 hours from becoming aware of any personal data security breach, describing the nature of the breach, the data and categories of data subjects affected, the likely consequences and the measures taken or proposed.
  • Make available to the Controller, on its reasonable request and with at least 4 weeks' notice, all the information needed to demonstrate compliance with art. 28 GDPR. Also allow audits once a year, during working hours and in a way that does not interrupt the service.
  • Return or delete, at the Controller's choice, all personal data once the service ends, save for the copies strictly required by applicable law. Return will be made in a structured, commonly used format (CSV, JSON) and deletion will be documented in writing. The maximum period from the end of the contract is 90 calendar days.

Authorised sub-processors

The Controller generally authorises the Processor to use the following sub-processors, all bound by a GDPR-compatible contract:

The Processor will notify the Controller at least 30 calendar days in advance of any addition or replacement of a sub-processor. The Controller may object, giving reasons, within that period and, if the objection is reasonable, the Processor must offer an alternative or the Controller may terminate the contract without penalty.

  • Turso (turso.tech): the database of the service, where case files, deadlines, court writings, reports, invoicing and accounting live. Data hosted in AWS region eu-west-1 (Ireland), in the European Union. Company headquarters: United States. Safeguards: standard contractual clauses.
  • Netlify, Inc.: hosting of the site, execution of the server functions (region eu-west-1, Ireland) and storage of the documents attached to case files (Netlify Blobs, region eu-central-1, Frankfurt), encrypted by the application with AES-256-GCM on top of the provider's encryption. Headquarters: United States. Safeguards: standard contractual clauses and supplementary measures.
  • Brevo (Sendinblue SAS): delivery of sign-in emails and service notices. Headquarters: France (EEA).
  • Supabase, Inc.: destination of an internal administration copy of the database, which only the administrator of the installation can run. It is not a feature the Controller switches on or sees. Data hosted in region eu-central-1 (Frankfurt, Germany). Company headquarters: United States. Safeguards: standard contractual clauses.
  • Google Ireland Ltd.: aggregated usage analytics (Google Analytics 4). It is only involved if the user expressly accepts the analytics cookies and it never has access to the content of the case files. Headquarters: Ireland (EEA).

Technical and organisational measures (art. 32 GDPR)

Encryption. TLS 1.2/1.3 mandatory on all communications, with HSTS enabled. Provider encryption at rest in the database and in the document store and, in addition, encryption of every attached document by the application itself with AES-256-GCM before it is stored. No passwords: access is by link and single-use code, of which only the cryptographic fingerprint is kept.

Access control. Strict separation of each organisation's data: every query is restricted to the organisation of whoever makes it, so one expert cannot reach another expert's case files. httpOnly session cookie, not readable by browser scripts. Every document download requires an active session and membership of the owning organisation. CSRF protection on sign-in with external providers. Administrative access by the Processor limited to designated persons and under the principle of least privilege.

Resilience and availability. Daily encrypted backup of the database, kept in the European Union (region eu-central-1) for thirty days. Provider infrastructure with its own availability commitments. Recovery time objective (RTO) under 24 hours and recovery point objective (RPO) of 24 hours, matching the daily frequency of the backup.

Staff confidentiality. A perpetual confidentiality undertaking signed by anyone with access to the systems, periodic training in data protection and security, with revocation of access at the moment the employment relationship ends.

Verification and audit. Periodic review of logs and dependencies (lockfiles and vulnerability alerts), penetration testing whenever a new critical component is added, plus an internal record of incidents and breaches with analysis and corrective measures.

International transfers

Working data is hosted in the European Union: the database in region eu-west-1 (Ireland) and the attached documents and backups in region eu-central-1 (Frankfurt, Germany). Where a sub-processor is headquartered outside the EEA, the Processor will apply the safeguards provided for in Chapter V GDPR: in particular, the standard contractual clauses approved by the European Commission by Decision 2021/914, supplemented by the additional measures arising from the impact assessment (Schrems II judgment).

The Processor will make available to the Controller, on reasonable request, a copy of the safeguards applied to any international transfer.

Security breach: detailed procedure

In the event of a breach affecting the Controller's personal data, the procedure is as follows:

  • The Processor records the incident internally with a timestamp of detection.
  • Within a maximum of 48 hours it notifies the Controller by email to the designated contact, with a full description of the incident.
  • The Processor immediately adopts reasonable corrective measures and keeps the Controller informed of how they progress.
  • The Controller decides whether to notify the Spanish Data Protection Agency (art. 33 GDPR) and the data subjects (art. 34 GDPR). The Processor provides technical and documentary assistance for that notification.
  • Once resolved, both parties document the lessons learned and the additional measures adopted.

Audit

The Controller may audit compliance with this DPA once a year, on at least 4 weeks' written notice, during working hours and without interrupting the provision of the service.

To keep the impact to a minimum, the Processor may offer the Controller an up-to-date external audit report (ISO 27001, SOC 2 or equivalent) if one is current. The audit may not, under any circumstances, reach the data of other user organisations.

The costs of the audit are borne by the Controller, unless the audit reveals material breaches by the Processor, in which case the Processor will bear them.

Liability and financial terms

Each party is liable for the damage arising from a breach of its obligations, in accordance with art. 82 GDPR and other applicable rules.

The limitation of liability and indemnity regime is governed by the general terms of the service. The Processor will maintain professional liability insurance appropriate to the size of the service.

Duration and termination

This DPA remains in force for as long as the Controller's contractual relationship with Gest Peritia for the processing of third-party personal data lasts.

Termination of the main contract entails termination of the DPA, without prejudice to the obligations that by their nature survive: perpetual confidentiality of staff and legal retention of data.

Amendments

The Processor may amend this DPA where a change in the rules or a substantial improvement of the security measures requires it.

Amendments will be published on this page with the date of revision and notified to the Controller with reasonable notice. The Controller may object, giving reasons; if the objection is not settled by agreement, it may terminate the contract without penalty.

Governing law and jurisdiction

This DPA is governed by Spanish law (GDPR, LOPDGDD and other applicable rules).

The parties submit, expressly waiving any other venue, to the jurisdiction of the Spanish Courts and Tribunals having jurisdiction under the applicable procedural rules.

Governing version

This text is an English translation provided for convenience. In the event of any discrepancy between this version and the Spanish one, the Spanish version prevails, as it is the version drafted under the Spanish law that governs this Agreement.

Last updated

4 November 2026.