Data processing agreement (template)
Draft for review by a lawyer. Replace the bracketed items before launch.
Template between [Agency name] (controller) and [Provider name] (processor), under Article 28 of the EU General Data Protection Regulation (GDPR). Fill in the brackets, sign it, and keep a copy.
Subject and duration
The processor processes personal data to provide the parcel tracking service, for as long as the service agreement runs.
Nature and purpose
Storing and retrieving parcel records, staff accounts, the activity log and daily counts. Reading the operator and name from a photo of a label.
Types of data and people
Data: staff names, email addresses and roles; parcel operator and recipient names; spots; timestamps. People: agency staff and parcel recipients.
Instructions
The processor acts only on the controller's documented instructions, which include this agreement and use of the service.
Sub-processors
The controller authorises Cloudflare (hosting, database, live sync) and OpenRouter with the AI model provider behind it (label reading). The processor tells the controller in advance of any new sub-processor, and the controller may object.
Security
Encryption in transit (HTTPS), access limited to the agency's accounts, a role check on every request, and an audit log of changes. [Add further measures.]
Personal data breaches
The processor informs the controller without undue delay, and within [48] hours of becoming aware of a breach, with the information the controller needs to notify the authorities.
Requests from people
The processor helps the controller answer requests from people about their data, within what the service allows.
End of processing
On request or when the agreement ends, the processor returns the data as an export and then deletes it, unless the law requires keeping it.
Information and audits
The processor provides the information needed to show compliance and allows reasonable audits on notice.
Signed for the controller: [name, role, date]. Signed for the processor: [name, role, date].