Data processing agreement

Roles of the parties

The client acts as data controller for the personal data it enters into the platform. Violet Solutions S.L. acts as processor and processes that data only on the documented instructions of the controller.

Subject matter and duration

Processing is limited to providing the contracted service and lasts as long as the contract, plus the agreed return or deletion period.

Location of processing

The agreement names the hosting provider and the specific region in which information is processed, and processing associated with the platform is confined to that region. Any processing outside it — a sub-processor acting from a third country included — requires the safeguards of chapter V GDPR: an adequacy decision, or standard contractual clauses with whatever supplementary measures are appropriate, and it is recorded in the sub-processor list before it happens. Changing the processing region means amending the agreement.

Sub-processors

The agreement incorporates the current list of sub-processors — hosting, transactional email and error monitoring — with each one’s identity and location. You can ask for it before signing, and any addition or change is notified far enough in advance to allow objection.

Confidentiality

The people authorised to process the data are bound by an express duty of confidentiality that survives the end of the relationship, and access only what their role requires.

Security measures

Encryption in transit and at rest, strict tenant isolation in the data layer, role-based access control on a least-privilege basis, and an activity log the client can query directly.

Assistance to the controller

We assist the client in handling data subject rights, in impact assessments and in breach notification, making available the information we hold and notifying any security breach without undue delay once we become aware of it.

Demonstrating compliance and audits

We make available to the controller the information needed to demonstrate compliance with the article 28 obligations, and we allow audits or inspections, whether its own or by an appointed third party, on reasonable notice and without compromising the security of other clients.

Return and deletion

On termination, the client chooses between the return of the data in an open format or its deletion. In either case it is removed from our systems within the agreed period, unless there is a legal obligation to retain it.