SnoutDeskDraft: have this text reviewed by a lawyer before using it.
Data processing agreement
1. Parties and roles
This agreement applies between the business using SnoutDesk (controller) and [Bedrijfsnaam] (processor).
2. Subject
The processor processes personal data of dog owners and their dogs solely to provide the SnoutDesk service: bookings, intake, vaccination checks, communication, invoices and reminders.
3. Instructions
The processor only processes the data on the documented instructions of the controller, including the use of the service itself, unless required otherwise by law.
4. Confidentiality and security
The processor takes appropriate technical and organisational measures, such as encrypted connections, per-business access restriction, hashed passwords and backups. Staff with access are bound by confidentiality.
5. Sub-processors
The controller authorises Microsoft Azure (hosting, storage, email and Azure OpenAI) within the EU. New sub-processors are announced in advance; the controller may object.
6. Data breaches
The processor reports a personal data breach without undue delay and no later than 48 hours after discovery, with the information needed for any notification to the supervisory authority.
7. Data subject rights
The processor reasonably assists the controller with data subject requests, such as access or erasure.
8. End
When the service ends, the processor deletes the personal data within 30 days, after an export on request, unless retention is required by law.
9. Audit
On request the processor makes available the information needed to demonstrate compliance.