What is a data processing agreement?

In a data processing agreement, the data controller and data processor set terms for what the data processor can or cannot do with the personal data provided by the data controller. Think of terms about the kind of data, notifications about abnormalities, and opposition and deletion periods.

How

In a data processing agreement, we record the description of the subject, duration, nature, and purpose of the data processing, the type of personal data, the categories of data subjects, and our rights and duties on both sides.

Customers

With the data processing agreement, you can show how you comply with your duties as a data controller towards your subscribers (data subjects). You can use the agreement if your subscribers (data subjects) exercise their privacy rights (such as right to access, rectify, erasure, and data portability).

Laposta as a data processor

Laposta complies with the enshrined instructions, such as:

Confidentiality

Laposta will never use the personal data for our own purposes. Persons employed by or working for Laposta are bound by our Ethics Code and the duty of confidentiality.

Security

The processor implements adequate technical and organisational measures to secure the processing of personal data. For instance: pseudonymisation and encryption of personal data, permanent information security, the restore of availability and access to personal data in case of an incident, regular testing.

Sub-processors

Laposta does not employ sub-processor(s) before obtaining your written permission. In a sub-processor agreement, we bind our sub-processor to the same agreements as we have made with you. And we are liable for the compliance with these agreements by the sub-processor (Article 28(4) GDPR).

Deleting data

Upon completion of the processing services, Laposta deletes the data 3 month after the end of the agreement, or, if desired, we return the data to you.

Audits

Under ISO27001, Laposta commissions internal and external audits (see checks and audits), and cooperates with you audits or those of a third party upon request.