Data processing agreement

Working draft — requires legal review before launch.

Subject matter and duration of processing
Categories of data and data subjects
Sub-processors (hosting, email, AIS, payments) — kept up to date
Technical measures: encryption, per-company isolation, immutable audit log, tested backups
Assistance with data subject requests

Contents