Data Processing Agreement (DPA) for companies
What the DPA covers for customers who host personal data, how it is accepted and how to get a signed copy.
On this page
The Data Processing Agreement (DPA) sets out the terms under which Click Expert S.R.L., the company that manages the BLACKBOX brand, processes personal data on your behalf when you host your own application, website or service at BLACKBOX. The full text is on the “Acord privind prelucrarea datelor (DPA)” (Data processing agreement) page (blackbox.md/info/dpa), which you open from the website footer with the “Acord privind prelucrarea datelor” (Data processing agreement) link. This article summarizes it.
Available to: any visitor to blackbox.md (the page is public). The agreement applies to customers who use a BLACKBOX hosting service, VPS or dedicated server to host applications or websites that process personal data.
The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.
How to open the agreement
- Open any blackbox.md page and scroll down to the footer.
- On the last line, next to “Termeni și condiții” (Terms and conditions) and “Politică de confidențialitate” (Privacy policy), click “Acord privind prelucrarea datelor” (Data processing agreement). The link does not appear in the “Informații” (Information) menu.
- The “Acord privind prelucrarea datelor (DPA)” (Data processing agreement) page opens. The revision date is shown at the top: “Ultima actualizare: 21 septembrie 2026” (Last updated: September 21, 2026).
The Russian version is at blackbox.md/ru/info/dpa. The Terms and Conditions also refer to the DPA, in chapter 13, “Protecția datelor și solicitările autorităților” (Data protection and requests from authorities).
Important The legally binding text is the Romanian one at
blackbox.md/info/dpa. The Russian version is a translation provided for convenience, and this article is only a summary. If anything differs, the text on the page applies.
Who it applies to and what your roles are
The DPA is concluded under Article 28 of Law No. 195/2024 and covers only the data in the applications and websites you host.
| Data | Controller | Role of Click Expert S.R.L. | Document |
|---|---|---|---|
| Data of the end users of your applications and websites (for example, the website's visitors or customers) | you, the customer | processor | DPA |
| Your blackbox.md account data (name, email, phone, invoices) | Click Expert S.R.L. | controller | Privacy Policy |
In the Romanian text, the controller is called the “operator” and the processor the “persoană împuternicită de operator”; in GDPR terminology, these are the “controller” and the “processor”. As the controller, you are responsible for complying with the law for the data you process in the hosted services (Terms, chapter 8, “Date cu caracter personal” (Personal data)). Details: Responsibility for server data and backups.
How it is accepted
The DPA is not signed separately and has no checkbox of its own. You accept it through two actions:
- You accept the Terms and Conditions: on the order's payment page, you tick the box “Am citit și accept Termenii și Condițiile și Politica de Confidențialitate” (I have read and accept the Terms and Conditions and the Privacy Policy). The same box appears when you create an account with email.
- You activate a service (for example, the server you ordered).
For most customers, this acceptance replaces a separately signed agreement.
How to get a signed copy
If your company needs a signed copy (for example, for its own compliance process):
- Write to support@blackbox.md, preferably from your account's email address.
- State the company that signs (its name and IDNO) and the email address of your blackbox.md account.
- The BLACKBOX team sends you the signed copy.
The “Aveți nevoie de o copie semnată a DPA-ului?” (Do you need a signed copy of the DPA?) block at the end of the page says the same; its “Contactați-ne” (Contact us) button opens the “Contacte” (Contacts) page. Below the page title there are also the “Contactați-ne” and “Politica de confidențialitate” (Privacy policy) buttons. The details of Click Expert S.R.L.: Legal details and BLACKBOX company details.
What the agreement covers
| Section on the page | In brief |
|---|---|
| “Obiectul și sfera prelucrării” (Subject matter and scope of processing) | Hosted data (VPS, dedicated server, storage) is processed only as far as hosting requires: storage on disk, running the processes you configure, backup “dacă este activat de dvs.” (if enabled by you) and technical administration of the infrastructure. |
| “Prelucrare numai pe bază de instrucțiuni documentate” (Processing only on documented instructions) | Your instructions are the configuration you chose when ordering and the settings in the administration panel. The application's content is not accessed or read, except for technical support at your explicit request or because of a legal obligation. In the second case, you are informed in advance, unless the law forbids it. |
| “Confidențialitatea personalului” (Confidentiality of personnel) | Every employee with access to the infrastructure that holds your data is bound by a confidentiality obligation. Access is limited to the minimum needed for operations and support. |
| “Măsuri de securitate (art. 32)” (Security measures, Art. 32) | The measures in the “Cum protejăm datele” (How we protect data) section of the Privacy Policy: encryption in transit, isolation at the virtualization level, mandatory two-factor authentication for staff with access to production, and regular security audits. |
| “Recrutarea de sub-persoane împuternicite” (Engaging sub-processors) | The infrastructure sub-processor is the cloud infrastructure provider FoxCloud. New sub-processors for hosted data are not engaged without prior notice if the change significantly alters the nature of the processing. The current list is in the Privacy Policy. |
| “Asistență pentru îndeplinirea obligațiilor dvs.” (Assistance with meeting your obligations) | Reasonable assistance, as far as the hosting infrastructure allows, with security (Art. 32), incident notification (Art. 33–34), impact assessment (Art. 35) and your end users' requests about their rights (Chapter III of Law No. 195/2024). |
| “Ștergerea sau returnarea datelor la finalul serviciului” (Deletion or return of data at the end of the service) | When the service ends, the hosted data is deleted or returned, as you choose, and any existing copies are removed, unless the law requires them to be kept. |
| “Audit și informare” (Audit and information) | You receive the information you need to verify compliance with the agreement. Audits, including inspections, take place under reasonable conditions: prior notice, business hours, and a scope that does not compromise the security of other customers. |
| “Notificarea incidentelor” (Incident notification) | If there is a security breach affecting the data hosted on your service, you are notified without undue delay from the moment BLACKBOX becomes aware of the incident, so that you can meet your obligations as controller (Art. 33–34). |
What remains your responsibility
- Backups. The DPA mentions backup only “dacă este activat de dvs.” (if enabled by you). BLACKBOX does not currently offer an automatic backup service, so make your own copies and keep them off the server: Backup strategy for your server.
- Server security. The measures in the DPA concern the BLACKBOX infrastructure. You manage the operating system, the applications and their updates, with root access: Securing a new server: checklist.
- Your users' requests and impact assessments. As the controller, you handle requests from your application's users and any data protection impact assessment (DPIA). BLACKBOX helps with the information it has at the infrastructure level.
At the end of the service: deletion or return
For keeping data after termination, the DPA refers to the Terms. The Terms do not give a number of days: after a suspension, data is kept for “o perioadă rezonabilă” (a reasonable period) and may then be permanently deleted. For the exact time frame, contact support.
- If you want your data back, copy it before the deletion: you have root access to the server (Transferring files to the server (scp, rsync, SFTP)).
- If you choose to have BLACKBOX return your data, write to support@blackbox.md before you delete the server or cancel the order.
- Delete the server: the “Terminate” button in the app.blackbox.md panel (the deletion is carried out after a 24-hour grace period) or “Anulează comanda” (Cancel the order) on blackbox.md (the server is deleted immediately). Details: Permanently deleting a server and Closing your BLACKBOX services: the steps in the right order.
Irreversible Once the server is deleted, its disks and the data on them cannot be recovered, so they cannot be returned either. Copy your data beforehand.
Frequently asked questions
Do I have to sign the DPA for it to be valid? No. Accepting the Terms and activating a service is enough. The signed copy is for cases where your company needs one, for example for its own compliance process.
Does the DPA also apply to my blackbox.md account data? No. For account data, Click Expert S.R.L. is the controller and the Privacy Policy applies: Privacy policy in brief.
Does the BLACKBOX team read the data in my application? Under the DPA, no: the application's content is accessed only for technical support that you explicitly request or because of a legal obligation. However, the BLACKBOX management key is on the server, and the panel uses it to carry out the actions you request: BLACKBOX keys on your server.
Where can I find the list of sub-processors?
The DPA names FoxCloud as the infrastructure provider. The current list is in the Privacy Policy (blackbox.md/info/privacy); the recipients of the data are listed in its “Partajare cu terți” (Sharing with third parties) section.
How do I request an audit? Write to support@blackbox.md and describe the purpose and scope of the audit. The audit takes place under the conditions set in the DPA: with prior notice, during business hours and without affecting the security of other customers.