Sign in

Data processing agreement

Template. Written for the EU GDPR, the Digital Services Act and the Data Act, and the New Zealand Privacy Act 2020. Fill in your company details in the server settings and have a lawyer review it before launch. Last updated: [date].

This data processing agreement (“DPA”) forms part of the terms of service between the customer (controller) and [Company name] (processor) and applies whenever Stellate processes personal data in customer content. It implements Article 28(3) GDPR.

1. Subject matter, duration, nature and purpose

The processor hosts and processes project content so the customer and its invited partners can plan, write and manage research proposals and projects. Processing lasts for the term of the agreement plus the deletion period in clause 9.

2. Types of personal data and data subjects

Names, professional contact details, roles, CV-type information on researchers, meeting attendance and notes, comments, file contents uploaded by users, and security log data. Data subjects: the customer’s staff, consortium partners’ staff, researchers named in proposals, meeting participants. Special categories are not expected; the customer must not upload them unless necessary and lawful.

3. Instructions

The processor processes personal data only on the customer’s documented instructions, which are these terms, this DPA and the customer’s use of the service’s features, unless EU or Member State law requires otherwise (in which case the processor informs the customer unless the law forbids it). The processor tells the customer if it believes an instruction infringes data protection law.

4. Confidentiality

Everyone authorised to process the data is bound by confidentiality. Staff access customer content only to provide requested support or where required by law, and such access is logged.

5. Security (Art. 32)

The processor implements the technical and organisational measures in Annex II and keeps them up to date with the state of the art.

6. Sub-processors

The customer gives general authorisation to use the sub-processors listed on the sub-processors page. The processor informs the customer at least 30 days before adding or replacing a sub-processor; the customer may object on reasonable data protection grounds and, if no solution is found, terminate the affected service. The processor imposes the same data protection obligations on each sub-processor and remains liable for them.

7. Assistance

The processor helps the customer respond to data subject requests (the service provides export, correction and deletion functions), and with security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing.

8. Personal data breaches

The processor notifies the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer data. The notice describes the nature of the breach, categories and approximate numbers of data subjects and records, likely consequences, measures taken or proposed, and a contact point, and is updated as more is known, so the customer can meet its 72-hour duty under Art. 33.

9. Deletion and return

The customer can export all data at any time. At the end of the service, the processor deletes customer data from live systems within 30 days and from backups as they expire (at most 30 further days), unless law requires storage, and confirms deletion on request.

10. Audits

The processor makes available the information needed to demonstrate compliance (including this DPA, the security description and, where available, independent reports) and allows audits by the customer or an auditor it mandates, with reasonable notice, at most once a year unless there is a breach or a supervisory authority requires it.

11. International transfers

Transfers outside the EU/EEA take place only under an adequacy decision or the Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), with supplementary measures where needed. The customer’s use of AI drafting, which is optional and off by default, involves a transfer to the AI provider listed on the sub-processors page.

Annex I — Parties

Controller: the customer organisation identified in its account. Processor: [Company name], [registered address], contact [privacy email].

Annex II — Technical and organisational measures

Annex III — Sub-processors

See the sub-processors page.