Data processing agreement
GDPR Article 28 agreement available to Poland customers who entrust us with processing personal data on their behalf.
When a DPA is needed
A DPA is required whenever you (controller) instruct us (processor) to process personal data — for example when you send us a list of recipient employees and home addresses for direct shipment of welcome kits, or when we operate a redemption portal under your brand where employees self-register. Standard B2B contact data of your procurement team does not normally require a DPA because we are a controller for that data.
What our DPA covers
Our template covers Article 28 mandatory clauses: subject-matter and duration, nature and purpose, categories of data and data subjects, controller obligations, processor obligations, sub-processor list and change notification (30 days), confidentiality, technical and organisational measures (Annex II), assistance with rights requests and breach notification (72 hours), audit rights (one per year, 60-day notice, NDA-bound), deletion or return on termination.
Sub-processors and international transfers
Our current sub-processors include EU print partners, EU and US cloud infrastructure (SCCs 2021/914 module 3 + supplementary measures), a transactional email provider and customer-support tooling. Updates are published on our trust page. For Poland the controller can object to a new sub-processor within 30 days; if not resolved, the controller may terminate without penalty. National specificities under Polish Personal Data Protection Act of 10 May 2018, applying the GDPR are reflected in the DPA where applicable.
FAQ
How do I sign the DPA?
Email [email protected] with your company details and we send a pre-filled PDF for digital signature. Turnaround: 2 business days.
Do you accept our customer DPA paper?
Yes after legal review (usually 5 business days). For mid-size orders our template is recommended to save time.
Where are servers located?
Primary EU (Frankfurt/Amsterdam). Backup encrypted snapshots in the EU. No production data in non-EU regions.
Can I audit you on-site?
Yes, once per year with 60-day notice. We also share SOC 2 / ISO 27001 reports under NDA to satisfy most audit needs without on-site visits.
What is the breach-notification SLA?
We notify the controller without undue delay and in any case within 48 hours of becoming aware, well inside the 72-hour deadline to the supervisory authority.