This Data Processing Agreement ("Agreement") is entered into by and between ### (COMPANY_NAME), a ### (COMPANY_JURISDICTION) entity ("Processor"), and the customer entity identified in the applicable Order or agreement ("Controller").
1. Subject Matter
This Agreement governs the Processing of Personal Data by Processor on behalf of Controller as part of providing the backup-as-a-service platform ("Service").
2. Definitions
- "Personal Data" means any information relating to an identified or identifiable natural person.
- "Processing" means any operation performed on Personal Data, whether or not by automated means.
- "Data Protection Laws" means applicable privacy and data protection legislation, including the GDPR.
- "Subprocessor" means a third party engaged by Processor to Process Personal Data.
3. Roles of the Parties
Controller is the data controller and determines the purposes and means of processing. Processor acts as a data processor and will process Personal Data only on Controller’s documented instructions.
4. Duration
This Agreement remains in effect for as long as Processor processes Personal Data on behalf of Controller under the main agreement.
5. Obligations of Processor
- Process Personal Data only as instructed by Controller.
- Ensure that persons authorized to process Personal Data are subject to confidentiality obligations.
- Implement appropriate technical and organizational measures to protect Personal Data.
- Assist Controller with data subject requests, security incidents, and Data Protection Impact Assessments.
- Delete or return Personal Data at the end of the service provision, unless legal retention applies.
6. Subprocessing
Processor may engage Subprocessors listed at ### (SUBPROCESSOR_URL) and shall notify Controller of any changes. Processor shall ensure Subprocessors are bound by data protection obligations substantially similar to those in this Agreement.
7. International Transfers
If Personal Data is transferred outside the EEA or other adequate jurisdictions, Processor will ensure appropriate safeguards under Data Protection Laws, such as Standard Contractual Clauses.
8. Audit Rights
Controller may audit Processor’s compliance with this Agreement up to once annually, with reasonable notice and during business hours, subject to confidentiality obligations.
9. Liability
The liability of each party under this DPA is subject to the limitations of liability in the main agreement between the parties.
10. Governing Law
This Agreement shall be governed by the laws of ### (GOVERNING_LAW).
IN WITNESS WHEREOF, the parties have caused this Data Processing Agreement to be executed by their duly authorized representatives.
Controller: ______________________
Name: ### (CONTROLLER_NAME)
Title: ### (CONTROLLER_TITLE)
Date: ______________________
Processor: ### (COMPANY_NAME)
Name: ______________________
Title: ______________________
Date: ______________________