Under Article 28 of Regulation (EU) 2016/679 (GDPR). Version [X], [DATE]. Signed with each client.
Between [CLIENT COMPANY NAME, ADDRESS] (the "Controller") and [FULL COMPANY NAME, ADDRESS] (the "Processor").
1. Subject and duration
- The Processor processes personal data on behalf of the Controller to provide Unbolt DPP under the terms of service and order between the parties (the "Main Agreement").
- This agreement runs as long as the Processor processes personal data for the Controller, including under an archive plan.
- The details of processing are set out in Annex 1.
2. Instructions
- The Processor processes personal data only on documented instructions from the Controller, including for transfers to third countries, unless EU or Member State law requires otherwise; in that case it informs the Controller first, unless that law prohibits it.
- The Main Agreement, this agreement and the Controller's use of the Platform's functions are the Controller's documented instructions.
- The Processor informs the Controller immediately if it believes an instruction infringes data protection law.
3. Confidentiality
Everyone authorised to process the personal data is bound by confidentiality, by contract or by law.
4. Security
The Processor implements the technical and organisational measures in Annex 2, appropriate to the risk under Article 32 GDPR, and may update them provided the level of protection does not fall.
5. Sub-processors
- The Controller gives general authorisation for the sub-processors listed in Annex 3.
- The Processor informs the Controller at least [30] days before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds; if the objection cannot be resolved, the Controller may terminate the affected service.
- The Processor imposes the same data protection obligations on each sub-processor and remains liable for them.
6. Transfers outside the EU
- The Processor is established outside the EU. Personal data made accessible to the Processor or its staff outside the EU is protected by [STANDARD CONTRACTUAL CLAUSES (COMMISSION IMPLEMENTING DECISION (EU) 2021/914) OR THE EU-US DATA PRIVACY FRAMEWORK], attached or referenced in Annex 4.
- Client Content is stored and processed on servers in the EU.
7. Assistance
The Processor assists the Controller in responding to data subject requests, and with security, breach notification, data protection impact assessments and prior consultation under Articles 32 to 36 GDPR.
8. Personal data breaches
The Processor notifies the Controller without undue delay, and no later than [48] hours after becoming aware of a personal data breach affecting the Controller's data, with the information available at the time.
9. Deletion and return
At the end of the services, the Processor deletes or returns all personal data at the Controller's choice, unless law requires storage. Data needed for passports kept online under an archive plan is retained for that purpose only. Backups are deleted within [90] days.
10. Audits
The Processor makes available the information needed to demonstrate compliance with Article 28 GDPR and allows audits by the Controller or its auditor, with at least [30] days' notice and no more than once a year unless a breach or authority requires otherwise.
11. Liability and final provisions
Liability follows Article 82 GDPR and the Main Agreement. This agreement is governed by [GOVERNING LAW] and prevails over the Main Agreement on data protection.
Annex 1: Details of processing
| Item | Description |
|---|---|
| Subject and purpose | Collecting supplier data, generating dismantling guides, creating, hosting and publishing battery passports, keeping an audit trail |
| Nature | Storage, organisation, extraction from uploaded documents, display, transmission to invited users, archiving, deletion |
| Data subjects | Controller's users; contacts at the Controller's suppliers; persons named in uploaded documents or passport fields |
| Personal data | Names, business contact details, roles, login and security events, audit trail entries, names and contact details in documents and passport fields |
| Special categories | None intended |
Annex 2: Technical and organisational measures
| Area | Measures |
|---|---|
| Location | Client Content stored and processed on servers in Germany; encrypted backups in EU-jurisdiction storage |
| Encryption | TLS for all traffic; CAD files and restricted documents encrypted with a key per client |
| Isolation | Each client's data separated at database level, tested automatically |
| Access control | Role-based access; suppliers see only their requested fields; no staff access to CAD files without a logged, client-approved action |
| Authentication | Multi-factor authentication or passkeys; administrative access only over a private network |
| Integrity | Append-only, hash-chained audit log; immutable passport versions and sign-offs |
| Availability | Point-in-time database recovery, nightly off-site backups, monthly restore tests, static passport copy for failover |
Annex 3: Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers, object storage | Germany |
| Ubicloud | Managed database in Hetzner data centres | Germany |
| Cloudflare, Inc. | DNS, content delivery, security, encrypted EU backups | EU storage; US company |
| [LLM PROVIDER] | Extracting values from uploaded documents | [REGION] |
| [EMAIL PROVIDER] | Transactional email | [REGION] |
| [ERROR TRACKING PROVIDER] | Error reports without document content | [REGION] |
Annex 4: Transfer safeguards
[ATTACH OR REFERENCE THE STANDARD CONTRACTUAL CLAUSES OR DATA PRIVACY FRAMEWORK CERTIFICATION.]