Template – to be completed and reviewed by a lawyer before going live. Placeholders are in [square brackets].
Data processing agreement
1. Subject matter
The processor processes personal data on behalf of the customer pursuant to Art. 28 GDPR for the provision of the DPP Creator software.
2. Type of data and data subjects
Contact data of the customer’s employees and suppliers (name, e-mail address), log data. Product data is generally not personal data.
3. Technical and organisational measures
Encrypted transmission (TLS), tenant separation at database level (row-level security), password hashing (scrypt), logging of changes, regular backups, hosting in data centres in the EU. [Add detailed TOMs as an annex]
4. Sub-processors
[List: hosting, database, file storage, e-mail, Stripe, possibly Anthropic for the AI function]
5. Instructions, deletion, control
The customer can export and delete data in the software at any time. After the end of the contract, data is deleted unless statutory retention obligations apply.