Data processing agreement (DPA)

1. Parties and roles

The customer is the controller of the data it puts into KAPSA. The provider TODO: company name is the processor under Art. 28 GDPR.

2. Subject and duration

Processing personal data to provide the KAPSA service for the term of the agreement and afterwards until the data is deleted or returned.

3. Categories of data and data subjects

• Data subjects: the customer's team members, its clients and contacts mentioned in the content.
• Data: identification and contact data, work content, call and e-mail records the customer adds. TODO: exclude special categories

4. Processor obligations

• Processes data only on documented instructions from the customer.
• Binds people with access to confidentiality.
• Implements technical and organisational measures: TODO: encryption, off-site backups, access control, logging.
• Assists the customer with data subject requests (export, deletion).
• Notifies personal data breaches without undue delay TODO: deadline, e.g. within 48 hours.

5. Subprocessors

The customer gives general authorisation for the subprocessors listed on the Subprocessors page. We announce changes in advance TODO: notice period and the customer may object.

6. Transfers outside the EEA

TODO: standard contractual clauses / EU-US Data Privacy Framework for subprocessors outside the EEA

7. Termination

After termination the provider deletes the data including backups TODO: deadline unless law requires retention. Export stays available to the customer after the trial ends.

8. Audit

TODO: audit scope and conditions