Data Processing Agreement – Template

Template · version 1.0 · effective from [DATE OF ENTRY INTO FORCE]

concluded on [DATE] between:

[CLIENT NAME] with its registered office in [TOWN], [ADDRESS], tax identification number [NIP], [KRS/REGON], represented by [FIRST NAME AND SURNAME, POSITION] (hereinafter: „the Controller”),

a

TREJKA Sp. z o.o. with its registered office in Białystok, ul. Moniuszki 31a, 15-192 Białystok, KRS 0000423570, NIP 9662085626, REGON 200704864, represented by [FIRST NAME AND SURNAME, POSITION] (hereinafter: the „Data Processor”),

collectively referred to as the „Parties”.

§ 1. Subject-matter of the contract

1. Pursuant to the service agreement dated [DATE] or the accepted quotation (hereinafter: the „Main Agreement”), the Controller entrusts the Processor with the processing of personal data to the extent and for the purpose specified in this agreement (hereinafter: the „Data Processing Agreement”), in accordance with Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: the „GDPR”).
2. The data processor processes data solely for the purpose of performing the Main Contract.

§ 2. Nature, scope and duration of processing

1. Nature and purpose of the processing: the provision of WordPress website maintenance services, IT support, the creation and storage of backups, corporate email services, anti-virus protection and one-off services as specified in the Main Agreement. Processing consists, in particular, of storing, copying, viewing to the extent necessary to rectify faults, transferring (migrating), restoring and deleting data.
2. Categories of data subjects: [tick as appropriate] the Controller’s customers and business partners, users of the website and online shop, the Controller’s employees and associates, persons contacting the Controller, [OTHER].
3. Types of data: [tick as appropriate] identification and contact details (first name, surname, email, telephone number, address), order and transaction data, user account data, the content of email correspondence, data contained in files on workstations and servers, technical data (IP addresses, logs), [OTHER].
4. Special categories of data (Article 9 of the GDPR) and data relating to criminal convictions (Article 10 of the GDPR): [are NOT processed / may be included in data covered by backups or system maintenance – please specify which]. The data processor does not process such data for any purpose other than the technical maintenance of systems and backups.
5. Data processing shall take place for the duration of the Main Agreement and for the period necessary to return or delete the data in accordance with § 9.

§ 3. Obligations of the data processor

The data processor undertakes to:

1. to process data solely on the basis of a documented instruction from the Controller. A documented instruction is deemed to be the Main Agreement, this agreement, and instructions provided in writing (by email or via the Portal). Where processing is required by Union or Member State law, the Processor shall inform the Controller of this before commencing processing, unless such disclosure is prohibited by law;
2. to inform the Controller immediately if, in their opinion, an instruction given breaches the GDPR or other data protection legislation;
3. ensure that persons authorised to process data have undertaken to maintain confidentiality or are subject to a statutory duty of confidentiality;
4. implement the technical and organisational measures required under Article 32 of the GDPR, as described in Annex 1;
5. comply with the terms and conditions governing the use of the services of subsequent data processors as set out in § 4;
6. to assist the Controller, to the extent possible and taking into account the nature of the processing, in fulfilling the obligation to respond to requests from data subjects regarding their rights as set out in Chapter III of the GDPR, in particular by forwarding to the Controller, without undue delay, any request received directly from such a data subject;
7. to assist the Controller in fulfilling the obligations set out in Articles 32–36 of the GDPR, including data protection impact assessments and prior consultations;
8. keep a record of the categories of processing operations referred to in Article 30(2) of the GDPR;
9. provide the Controller with all information necessary to demonstrate compliance with the obligations set out in Article 28 of the GDPR and allow the Controller or an authorised auditor to carry out audits, including inspections, in accordance with the rules set out in § 6.

§ 4. Sub-contracting (sub-processors)

1. The Controller grants the Processor general authorisation to use the services of sub-processors. The current list of sub-processors is published on the website trejka.com/dokumenty/lista-podprocesorow/.
2. The Data Processor shall notify the Data Controller by email of any intended addition or replacement of a sub-processor at least 14 days prior to the change. The Data Controller may raise a justified objection within this period. In the event of an objection, the Parties shall agree on an alternative solution; if this is not possible, the Controller may terminate the Main Agreement in respect of the services affected by the change, with effect from the date on which the change is implemented.
3. The data controller shall, by means of a contract, impose on the sub-processor the same data protection obligations as those imposed on it under this agreement, in particular the obligation to provide sufficient guarantees that appropriate technical and organisational measures will be implemented.
4. The data processor is liable to the data controller for ensuring that the sub-processor fulfils its obligations.
5. Services provided by suppliers with whom the Controller has entered into a contract directly (e.g. the Controller’s hosting service, Microsoft 365 or Google Workspace on the Controller’s account) do not constitute a further sub-processing arrangement by the Processor.

§ 5. Transfer of data outside the EEA

1. Backups of the Controller’s data are stored within the European Economic Area.
2. A data processor may transfer data to a third country only on the documented instruction of the data controller or via a sub-processor included on the list, and only by applying the mechanisms set out in Chapter V of the GDPR (a decision establishing an adequate level of protection, standard contractual clauses).

§ 6. Audit

1. The Controller is entitled to monitor compliance with this agreement, initially by means of written queries, to which the Processor must respond within 14 days.
2. An on-site inspection at the data processor’s premises may be carried out, subject to at least 14 days’ prior notice, during working hours, no more than once a year, unless a data breach has occurred or the supervisory authority so requires. The external auditor must undertake to maintain confidentiality.
3. The costs of the audit shall be borne by the Controller. Any time spent by the Processor on the audit in excess of [4] hours per year shall be charged at the hourly rate set out in the Price List.

§ 7. Data protection breaches

1. Upon discovering a personal data breach, the data processor shall notify the data controller without undue delay, no later than [24] hours after it has been discovered, by email to [CONTROLLER’S EMAIL ADDRESS] and by telephone.
2. The notification shall include, where possible: a description of the nature of the breach, the categories and approximate number of individuals and data records affected, the possible consequences, the remedial measures taken or proposed, and the contact details of the contact person. Any information that cannot be provided immediately shall be provided by the data processor in stages.
3. The processor shall take immediate action to minimise the impact of the breach and shall cooperate with the controller in reporting the breach to the supervisory authority and notifying the data subjects.
4. It is the Controller’s responsibility to notify the supervisory authority and the data subjects.

§ 8. Liability

1. The processor shall be liable for any damage caused by the processing if it has failed to fulfil the obligations imposed by the GDPR directly on processors, or has acted outside the lawful instructions of the controller or contrary to those instructions.
2. The provisions of the Main Agreement, including the limitations of liability, shall apply to the Parties’ liability to the extent permitted by law.

§ 9. Duration and termination

1. The Entrustment Agreement shall remain in force for the duration of the Main Agreement.
2. Once the provision of services has been completed, the Data Processor shall, depending on the Controller’s decision communicated within 14 days, either return the data (in particular, provide the most recent backup copy) or delete it. Failure to provide a decision within this timeframe shall be deemed to constitute an instruction to delete the data.
3. The data processor shall delete the data, including any copies thereof, within 30 days of the cessation of the provision of services, subject to backup copies, which shall be deleted upon expiry of the retention period, not exceeding [90] days, and shall not be used until that time. Upon request, the data processor shall confirm the deletion of the data in writing.
4. The obligation to delete data does not apply to data which must be retained in accordance with Union or Member State law.

§ 10. Final provisions

1. In matters not covered herein, the provisions of the GDPR, the Personal Data Protection Act and the Civil Code shall apply.
2. In the event of any conflict between this agreement and the Master Agreement in relation to the protection of personal data, this agreement shall take precedence.
3. Any amendments to the agreement must be in writing, otherwise they shall be null and void, with the exception of changes to the list of sub-processors made in accordance with § 4.
4. Data protection contact persons: on the part of the Controller – [FIRST NAME AND SURNAME, EMAIL, TELEPHONE]; on the part of the Processor – Bartosz Stępniewski, well****@****ka.com, +48 695 423 811.
5. This Agreement has been drawn up in electronic form or in two identical copies, one for each of the Parties.

Appendix 1 – Technical and organisational measures

1. Access control: individual accounts, the principle of least privilege, two-factor authentication for administrative systems, a password manager, and the immediate revocation of access rights for staff leaving the organisation.
2. Encryption: encrypted connections (SSL/TLS, SSH, VPN), encryption of backups at rest and in transit, and encryption of work devices’ hard drives.
3. Backups: the 3-2-1 rule, storage in at least two locations within the EEA, periodic recovery tests, retention in accordance with the Master Agreement.
4. System security: updates following tests on a copy, monitoring of file availability and integrity, application firewall and attack blocking, centrally managed anti-virus protection, logging of administrative activities.
5. Physical security: backup infrastructure (TREJKA Backup Centre in Białystok) housed in locked premises with restricted access and an emergency power supply [ADD: CCTV, alarm].
6. Organisation: authorisations and confidentiality obligations, data protection training, incident and breach handling procedures, data processing agreements with sub-processors, and periodic reviews of the effectiveness of security measures.
7. Minimisation: access to the Controller’s data solely to the extent necessary to process a request or resolve a fault.