Data processing agreement
Version 2026-10-10.1 · Draft for reviewCompany details, operational schedules and legal review must be completed before this document is published for acceptance.
Parties, scope and instructions
Company identity pending; Romanian trade register: pending; CUI/VAT identifier: pending; registered address: pending. Contact: not yet configured; telephone: pending. The customer is controller, or processor acting for its controller, of personal data placed in the ordered service. DCS is processor or subprocessor as appropriate. Processing consists of hosting, transmission, access support and deletion for the duration of the service and agreed exit period. Data subjects and data types depend on the customer workload (for example users, employees, customers and their contact or application data). Customer orders and documented lawful instructions define the scope. Special-category or criminal-offence data requires a suitability assessment before upload.
DCS obligations
DCS processes personal data only on documented instructions, including transfers, unless legally required otherwise; in that case it informs the customer before processing unless prohibited. DCS informs the customer if an instruction appears to infringe data protection law. Authorised personnel are bound to confidentiality. DCS implements appropriate risk-based security measures and assists with rights requests, security obligations, breach handling, impact assessments and supervisory consultations, taking account of the nature of processing and available information.
Security and incidents
A verified technical and organisational measures schedule must be completed before this agreement takes effect. DCS notifies the customer without undue delay after becoming aware of a personal data breach, shares available details and supplies further information as investigation progresses. This does not replace the customer’s controller obligations.
Subprocessors and transfers
The customer gives general written authorisation for the listed subprocessors, subject to advance notification of additions or replacements and an opportunity to object on data-protection grounds. DCS imposes equivalent data-protection obligations and remains responsible for subprocessor performance. Subprocessor schedule pending. Transfer safeguards pending. If a justified objection cannot be resolved, the parties agree an alternative or enable termination of the affected service.
Evidence and end of service
DCS makes information needed to demonstrate Article 28 compliance available and permits and contributes to audits, including inspections by the customer or a mandated auditor, under reasonable security arrangements that do not defeat these rights. At the customer’s choice DCS returns or deletes personal data after the service, and deletes remaining copies unless law requires retention. The switching schedule and verified residual-copy retention schedule describe practical completion. Customers must not treat an account JSON download as a workload export.