Data processing agreement

This data processing agreement ("DPA") applies to order the order placed through Busyzero between the client ("Controller") and the seller ("Processor"). It is part of the order and follows the General Data Protection Regulation (GDPR), in particular article 28.

1. Subject. To carry out the order (building, delivering and maintaining the automation described in it) the Processor may get access to personal data for which the Controller is responsible. The categories of data subjects and personal data are those present in the systems, files and accounts the Controller makes available, such as customers, employees, suppliers and contacts, and data such as names, contact details, order and invoice data and messages.

2. Instructions. The Processor processes personal data only on documented instructions of the Controller, as set out in the order, its brief and its messages, and only for that purpose. The Processor informs the Controller if it believes an instruction infringes the GDPR.

3. Confidentiality. The Processor ensures that everyone it authorises to process the personal data is bound by confidentiality.

4. Security. The Processor takes appropriate technical and organisational measures, considering the state of the art and the risks, including working in the Controller's own accounts where possible, strong passwords and two-factor authentication, not keeping copies of personal data longer than needed, and encrypted storage where copies are needed.

5. Sub-processors. The Processor does not engage other processors without the Controller's prior written permission (a message in the order counts). Tools the Controller itself chose for the solution are not sub-processors of the Processor. Where the Processor uses a sub-processor, it imposes the same obligations on it and remains responsible for it.

6. Transfers. The Processor does not transfer personal data outside the European Economic Area unless the Controller agrees and the GDPR's transfer rules are met.

7. Assistance. Taking into account the nature of the processing, the Processor helps the Controller to respond to requests from data subjects and to meet its obligations on security, breach notification and data protection impact assessments.

8. Breaches. The Processor informs the Controller without undue delay, and where possible within 24 hours, after becoming aware of a personal data breach, with the information the Controller needs to meet its own obligations.

9. End. When the order and any maintenance have ended, the Processor deletes all personal data, or returns it at the Controller's choice, and deletes existing copies, unless the law requires storage. Access the Controller provided is handed back or revoked.

10. Audits. The Processor makes available the information needed to demonstrate compliance with this DPA and contributes to reasonable audits by the Controller, at the Controller's cost and with reasonable notice.

11. Liability. Liability is governed by the Busyzero terms and the GDPR.

12. Priority. If this DPA conflicts with other agreements between the Parties about personal data, this DPA prevails, unless the Parties agreed on a custom DPA for this order through Busyzero.

Accepted electronically by both Parties through Busyzero on the dates shown below.