Data Processing Agreement Application

Data Processing Agreement Application

This Data Processing Agreement Application (the "Application") is made and entered into on by and between Controller: , having its principal place of business at , and Processor: , having its principal place of business at .

Recitals

WHEREAS, Controller determines the purposes and means of the processing of Personal Data and seeks to engage Processor to perform certain processing activities on behalf of Controller;

WHEREAS, Processor has represented that it has the competence, personnel and technical and organizational measures necessary to process Personal Data in accordance with applicable data protection laws and this Application;

WHEREAS, the parties desire to document the terms under which Processor will process Personal Data on behalf of Controller and to apply for a Data Processing Agreement incorporating those terms;

NOW, THEREFORE, in consideration of the mutual covenants set forth herein and other good and valuable consideration, the parties agree as follows:

1. Definitions

In this Application, the following terms have the following meanings: "Personal Data" means any information relating to an identified or identifiable natural person processed under this Application; "Processing" and "process" have the meaning given in applicable data protection law; "Data Subject" means the identified or identifiable natural person to whom Personal Data relates.

2. Scope and Purpose of Processing

Processor shall process Personal Data only for the documented purposes set out in this Application and in accordance with Controller's documented instructions. The parties specify the initial processing activities and purposes as follows:

Provision of products or services to Controller
Cloud hosting and infrastructure management
Analytics and reporting
Customer support and account management
Other:

3. Data Subjects and Categories of Personal Data

4. Duration and Retention

Processor shall process Personal Data for the duration necessary to fulfill the documented purposes, and shall retain Personal Data only for the period specified by Controller or as required by law, after which Processor shall securely delete or return Personal Data in accordance with Controller's instruction.

5. Processor Obligations and Assistance

Processor warrants that it will process Personal Data only on the documented instructions of Controller, implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, assist Controller with data subject requests, and assist Controller to the extent reasonably necessary for Controller to comply with its obligations under applicable data protection law.

6. Subprocessors

Processor shall not engage subprocessors without Controller's prior written authorization. Where authorized, Processor shall impose on each subprocessor data protection obligations no less protective than those in this Application and shall remain liable for the acts and omissions of such subprocessor to the same extent Processor would be liable for its own acts and omissions.

7. International Transfers

Any transfer of Personal Data to a jurisdiction outside the country of the Data Subject shall be subject to appropriate safeguards and lawful transfer mechanisms. Processor will implement and maintain reasonable safeguards to protect Personal Data during and after transfer and will notify Controller of any legal restrictions that would prevent compliance with this clause.

8. Breach Notification and Incident Response

Processor shall notify Controller without undue delay upon becoming aware of a Personal Data breach affecting Controller's Personal Data and shall provide reasonable assistance to Controller in investigating and remediating any breach. Notification shall include sufficient information to allow Controller to meet any regulatory notification obligations.

9. Data Subject Rights

Processor shall, to the extent legally permitted, promptly notify Controller if Processor receives a request from a Data Subject to exercise any rights related to Personal Data processed under this Application, and shall provide reasonable cooperation to enable Controller to respond to such requests in accordance with applicable law.

10. Audit and Inspection

Controller or an independent auditor mandated by Controller shall have the right to conduct audits and inspections, upon reasonable notice and during regular business hours, to verify Processor's compliance with this Application. Processor shall make available all information necessary to demonstrate compliance and shall reasonably cooperate with audits.

11. Confidentiality

Processor shall ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Processor shall not disclose Personal Data to any third party except as directed by Controller or as required by law.

12. Liability and Indemnity

Each party's liability with respect to breaches of data protection obligations shall be determined in accordance with applicable law. Processor shall be liable for damages resulting from breaches of its obligations under this Application and shall indemnify Controller for losses arising from Processor's breach of its data protection obligations, subject to applicable limitations of liability agreed between the parties.

13. Termination

Upon termination of the relationship between the parties or upon Controller's instruction, Processor shall, at Controller's option, return all Personal Data to Controller and delete existing copies unless retention is required by applicable law. Processor shall provide a written certification of deletion upon Controller's request.

14. Notices

15. Governing Law; Entire Agreement; Severability

This Application shall be governed by and construed in accordance with the laws of the governing_jurisdiction specified below without giving effect to conflict of law principles. This Application, together with any executed Data Processing Agreement resulting from this Application, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior discussions and agreements. If any provision of this Application is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

16. Amendments, Waiver and Counterparts

Any amendment to this Application must be in writing and signed by authorized representatives of both parties. No waiver of any provision of this Application shall be effective unless in writing and signed by the waiving party. This Application may be executed in counterparts, each of which shall be deemed an original.

17. Applicant Certifications

Controller and Processor each certify that the information provided in this Application is true and accurate to the best of their knowledge and that they have the authority to enter into this Application and any resulting Data Processing Agreement.

Controller certifies the information provided is accurate.
Processor certifies the information provided is accurate.

Administrative Contacts

Sign Now