What agreements are included in a data processing agreement?
In a data processing agreement, the data controller and the data processor agree on what the processor may, may not, or must do with the personal data provided by the data controller. This includes the type of data, notifications about deviations, and retention and deletion periods.
What is in the data processing agreement?
The data processing agreement sets out:
- a description of the subject matter, duration, nature, and purpose of the processing
- the type of personal data and the categories of data subjects
- the mutual rights and obligations of you and Laposta
What do you use the agreement for?
With the data processing agreement, you can demonstrate how you meet your obligations as a data controller towards your subscribers (data subjects). You can also use the agreement if they exercise their privacy rights, such as the right of access, rectification, erasure, and data portability.
What does Laposta agree with you?
Laposta complies with the instructions set out in the agreement:
- Duty of confidentiality: for example, Laposta will never use the personal data for its own purposes. Persons employed by or working for Laposta are bound by Laposta’s Code of Ethics and a duty of confidentiality.
- Security: Laposta takes appropriate technical and organisational measures to secure the processing. Examples include the pseudonymisation and encryption of personal data, permanent information security, restoring the availability of and access to data in the event of incidents, and regular security testing.
- Sub-processors: Laposta does not engage any sub-processor(s) without your prior written consent. In a sub-processing agreement, Laposta imposes the same obligations on a sub-processor as Laposta has towards you, and is liable for the sub-processor’s compliance with the agreements (under Article 28(4) of the GDPR).
- Deleting data: upon completion of the processing services, Laposta deletes the data three months after termination of the agreement, or returns the data to you if you wish.
- Audits: Laposta has internal and external audits carried out under its ISO 27001 certification and, upon request, cooperates with your audits or those of a third party.
You can read how to accept and find the agreement with Laposta, and when you can have your own agreement reviewed, in Data processing agreement with Laposta.