Data processing agreement

1. Parties and roles

This agreement is part of the contract for the KeepUp service. The customer organization is the controller, and KeepUp, LLC is the processor within the meaning of the Law of Georgia on Personal Data Protection.

KeepUp processes data only on the Customer's instructions: the contract, this agreement and the choices the Customer makes in the system's settings (for example switching on the AI advice or the SMS rules).

2. Subject, purpose and duration

Purpose: providing the maintenance management service - receiving reports, notifications, carrying out the work, history and reporting. Duration: the term of the contract plus the deletion period described in section 11.

3. Data subjects and categories of data

Data subjects:

• the Customer's staff (technicians, managers, admins, directors);
• people who report an equipment problem through a QR code (for example a nurse or a receptionist);
• other people users mention in comments.

Categories of data:

• name, phone number, role, on-duty status and notification settings;
• work orders: description, photos, voice notes, comments, status history and times;
• the reporter's name and role (optional);
• assets, locations, preventive maintenance, costs and uploaded documents;
• technical data: sign-in sessions, device push tokens, the notification log (with masked numbers).

Special categories of data, including patients' health data, are not processed. The Customer instructs its staff not to enter such data.

4. Confidentiality

Only KeepUp staff who need it for the service, and who are bound by confidentiality, have access to the data. KeepUp's team enters a Customer's workspace only through support access, which is visible to the Customer, time-limited and can be switched off by the Customer at any time.

5. Security measures

• every connection is encrypted (HTTPS/TLS);
• each organization's data is separated at database level (row-level security), and the system connects to the database with limited rights;
• passwords are stored only as hashes (argon2id); session and invite tokens are hashed too;
• sign-in by SMS code or password, with limits on codes and sign-in attempts;
• files are kept in closed storage and opened only through a signed link valid for 10 minutes;
• servers are in the EU (Germany); an encrypted backup is made every night in another location (Finland), and restoring it is tested every week;
• the servers accept only SSH-key sign-in; security updates install automatically and only the needed ports are open;
• phone numbers, codes and tokens are removed from error reports before they are sent.

6. Sub-processors

The Customer agrees to the following sub-processors:

• Hetzner Online GmbH - servers and backups (Germany, Finland);
• uBill (Georgia) - sending SMS;
• Functional Software, Inc. (Sentry) - error reports (EU), with personal data removed;
• Google (Firebase Cloud Messaging), Apple (APNs) and the browsers' push services - notifications;
• Backblaze, Inc. (if switched on) - a second encrypted backup copy (EU);
• the AI provider (currently Anthropic, PBC, USA) - only if the Customer's admin switches on the AI advice; data is sent after personal data is removed and is not used to train models.

We notify the Customer 30 days before adding a new sub-processor; the Customer may raise a reasoned objection. We bind each sub-processor to data protection obligations at least as strict as these.

7. International transfers

The main data is stored in the EU. Data leaves Georgia (for example error reports, push notifications and, if switched on, the AI advice) only with the safeguards the law requires.

8. Assisting the Customer

KeepUp helps the Customer answer data subjects' requests (access, correction, deletion) and, where needed, assess the impact of the processing. A request that reaches KeepUp directly is forwarded to the Customer within 5 working days.

9. Incidents

When KeepUp discovers a security incident, it informs the Customer without undue delay and no later than 48 hours: what happened, which data is affected and what has been done. This helps the Customer notify the Personal Data Protection Service and the people affected within the period set by law.

10. Audit

KeepUp gives the Customer the information needed to show compliance with this agreement. The Customer may carry out an audit once a year, with 30 days' notice, during working hours and while keeping other customers' data confidential.

11. On termination

For 30 days after the contract ends, KeepUp hands the Customer's data over on request (Excel/CSV, photos in a ZIP archive), and after 90 days deletes it fully from the system. Data disappears from the backups automatically within 6 months at the latest; until then it stays encrypted and is not used for anything else. Data the law requires us to keep is kept for the period the law sets.

12. Contact

E-mail: info@keepup.ge
Phone: +995 599 06 60 05