Data Processing Addendum

1. 01

   Institutional processing of personal data requires a written agreement identifying the controller, processor, purpose, duration, data categories and people concerned. Contact us to prepare the agreement for your deployment. This information page is not an executed data-processing contract.

2. 02

   The agreement must cover documented instructions, confidentiality, access control, security measures, subprocessors, processing locations and transfers, incident notification, assistance with rights requests and impact assessments, audits, and return or deletion at the end of processing. The technical annex and actual supplier arrangements must be verified before sensitive data is enabled.