On this page
Template. Bracketed values are completed per relationship before execution, including the role each party takes. This is not executed legal advice — have counsel review before signature.
§ Parties
Party A
Reg. No. HE 495384
Aiolou & Panagioti Diomidou 9, Katholiki
3020 Limassol, Cyprus
Party B
[reg. no.]
[address]
This DPA forms part of the [main agreement] dated [date].
1 Subject matter & duration
Processing of personal data as needed to perform the main agreement, for its duration.
2 Nature & purpose
As described in Annex A (description of processing): [hosting / analytics / campaign delivery / CRM services / development].
3 Data subjects & data categories
Set out in Annex A:
- Data subjects [end users, subscribers, leads]
- Data categories [contact details, device and advertising IDs, usage and event data, engagement data]
4 Processor obligations
- Documented instructions Process only on documented instructions of the controller.
- Confidentiality Ensure personnel confidentiality.
- Security Implement appropriate technical and organisational measures (Annex B).
- Assistance Assist the controller with data subject rights requests and with Articles 32–36 obligations.
5 Sub-processors
General written authorisation subject to prior notice of any addition or replacement, with a right to object on reasonable grounds; the processor remains fully liable for its sub-processors. Current list: Annex C.
6 Breach notification
The processor notifies the controller without undue delay after becoming aware of a personal data breach, and in any event within 72 hours, with the information needed for the controller's own notification duties.
7 Audits
The processor makes available all information necessary to demonstrate compliance and allows audits (including inspections) by the controller or its mandated auditor, on reasonable notice, no more than once per year absent cause.
8 International transfers
Transfers outside the EU/EEA occur only under an adequacy decision or the European Commission's 2021 Standard Contractual Clauses (appropriate module attached as Annex D), with supplementary measures where required.
9 Deletion / return
On termination, at the controller's choice, the processor deletes or returns all personal data and deletes existing copies, unless retention is required by law, and certifies deletion in writing.
10 Liability & order of precedence
This DPA prevails over the main agreement for data protection matters. Liability follows the main agreement, except that no cap applies to fines arising from a party's own breach of this DPA.
§ Annexes
- Annex ADescription of processing
- Annex BSecurity measures
- Annex CSub-processor list
- Annex DSCCs (2021 modules)