Data Processing Agreement
This Agreement governs the processing of personal data carried out by the Platform as a data processor on behalf of the Tenant, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).
1. Identification of the parties
The Tenant acts as the data controller with respect to the personal data it enters and manages through the Platform.
The Platform acts as the data processor, processing personal data only in accordance with the Tenant's instructions and exclusively for the provision of the contracted service.
2. Purpose, nature, and duration of processing
The purpose of the processing is to provide the SaaS service offered by the Platform.
The nature of the processing includes the hosting, storage, organization, retrieval, and deletion of personal data.
The duration of the processing will continue for as long as the contractual relationship between the parties remains active.
3. Types of personal data and categories of data subjects
The data processed may include, among others:
Identification data.
Contact information.
Data relating to contracted services or transactions.
Any other data that the Tenant adds to the Platform under its responsibility.
Categories of data subjects may include the Tenant's customers, users, employees, or collaborators.
4. Obligations of the Platform
The Platform undertakes to:
Process personal data only in accordance with the Tenant's documented instructions.
Ensure the confidentiality of persons authorized to process personal data.
Apply appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
Not disclose the data to third parties except where required by law or necessary for the provision of the service.
Notify the Tenant, without undue delay, of any security breach affecting the personal data processed.
Reasonably assist the Tenant in complying with its data protection obligations.
5. Sub-processors
The Platform may engage external providers acting as sub-processors for the proper provision of the service, such as infrastructure, hosting, storage, or technology service providers.
The Platform will ensure that such sub-processors are subject to data protection obligations equivalent to those set out in this Agreement.
6. International transfers
If personal data is transferred outside the European Economic Area, the Platform will implement appropriate safeguards in accordance with applicable regulations, including standard contractual clauses or adequacy decisions.
7. Termination of the service
Once the contractual relationship has ended, the Platform will delete or return the personal data processed on behalf of the Tenant, unless there is a legal obligation to retain it.
8. Liability
Each party will be liable for the responsibilities applicable to it under the relevant data protection regulations.