Data processing agreement — summary
Last updated: [À REMPLIR : date]
Summary only. A full Article 28 DPA is provided to clients for signature. Review by a lawyer is required.
1. Roles
For personal data processed on behalf of a client, the client is the controller and Floskee is the processor. Floskee processes data only on documented instructions from the client.
2. Scope
The processing covers hosting, maintenance, security monitoring and any automation configured for the client. The categories of data and individuals are defined in the service agreement.
3. Subprocessors
Current subprocessors include hosting, email and monitoring providers. [À REMPLIR : liste nominative des sous-traitants]. The client is informed of any addition and may object on reasonable grounds.
4. Security measures
Measures include least-privilege access, MFA on administrative accounts, encryption in transit, daily backups, logging and isolation between clients. Access is reviewed when a project ends.
5. Breach notification
Floskee notifies the client within 48 hours of confirming a personal data breach, with the available details and the measures taken. The client remains responsible for notifying its own supervisory authority where required.
6. International transfers
Where data is transferred outside the EU, the parties rely on adequacy decisions or standard contractual clauses, supplemented by technical measures where necessary.
7. Return and deletion
At the end of the agreement, data is returned in CSV or JSON within 30 days of a request, then deleted, unless a legal retention obligation applies.
8. Audit
The client may request reasonable information to demonstrate compliance. On-site audits are subject to prior notice, confidentiality and a scope agreed by both parties.