Knowledgebase

DPA (Data Processing Agreement linked with GDPR)

(hereunder referred to as the “DPA”) 2025 - v1

Whereas:

1. Pursuant to the Service Agreement to which this DPA is attached (hereinafter the “Service Agreement”), Controller has appointed Processor to carry out certain data processing tasks on behalf of Controller, and in accordance with its instructions.
2. Accordingly, for the purposes of compliance with
   • the European Data Protection Directive 95/46/EC (the “Directive”), which will be repealed and replaced as from 25 May 2018 by the General Data Protection Regulation (EU) 2016/679 (the “GDPR”), and
   • the nationally applicable data protection law,
   (altogether hereunder referred to as the “Data Protection Law”), the Processor will Process Personal Data as a Processor;
3. The Controller determines the purposes for which, and the means by which, such personal data is processed, and is accordingly the Controller for the purposes of compliance with the “Data Protection Law”;
4. In order to comply with article 17 of the Directive (and article 28 of the GDPR), and the relevant transposing provisions of nationally applicable data protection law, it is necessary for a written agreement to be in place between Controller and Processor confirming certain terms on which the Processing will take place. The parties have, therefore, agreed to enter into this DPA to comply with this requirement.

Now it is hereby agreed as follows:

1. Definitions

For the purposes of this DPA, the terms “Controller”, “Processor”, “Representative”, “Data Subject”, “Personal Data”, “Processing”, “Third Party”, “Personal Data Breach”, “Genetic Data”, “Biometric Data”, “Data Concerning Health”, “Supervisory Authority” and “Data Protection Officer”, shall have the meanings given to them under the Data Protection Law.

2. Details of Processing

Categories of Data Subject and types of Personal Data subject to Processing (hereunder referred to as “Processed Personal Data”), and purpose of Processing, pursuant to this DPA, are set out in Appendix 1, which forms an integral part of this DPA.

3. Obligations on all Parties

All parties shall comply with their respective obligations under the provisions of Data Protection Law. All parties and, where applicable, their representatives, shall cooperate, on request, with the supervisory authority in the performance of its tasks.

4. SPECIFIC Obligations of the Processor

4.1 Controller’s instructions

Processor and any person acting under the authority of Processor, who has access to the Processed Personal Data, shall not process the Processed Personal Data except on documented instructions from the Controller (including with regard to transfers of Processed Personal Data to a third country or an international organization), unless Processor is required to do so by Union or Member State law to which Processor is subject (in which case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest). The use of any computer interface, the setting of parameters and the upload of any data into the Processor’s system by the Controller are also Controller’s instructions under the present Section.

4.2 Confidentiality

Processor ensures that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.3 Security of the Processing

Processor takes at all times all measures required pursuant to Article 32 of the GDPR (and any other similar obligation under the Data Protection Law), and provides sufficient guarantees to implement appropriate technical and organizational measures to secure and protect the Processed Personal Data.

The current security measures adopted by the Processor are listed in Appendix 2, which forms an integral part of this DPA. Controller confirms that it deems that such measures currently meet the requirements of the GDPR and ensure the adequate protection of the rights of the data subject.

4.4 Assignment of Subcontractors

Processor shall not be entitled to assign (a) subcontractor(s) for the execution of tasks connected with this DPA without the Controller’s written consent. If consent is given, the Processor shall ensure that any subcontractor complies with the same provisions as established by this DPA and shall remain primarily responsible for the performance of its duties and obligations hereunder and for the performances of sub-contractors.

If Controller gives a general written authorization to assign subcontractors, the processor shall anyway inform Controller of any intended changes concerning the addition or replacement of other subcontractors, thereby giving Controller the opportunity to object to such changes.

4.5 Assistance for the fulfillment of Controller’s obligations

4.5.1 Data subjects’ rights

Data Subjects whose Personal Data are Processed pursuant to this DPA have the right to request access to such Personal Data, and to request correction, erasure and/or blocking of such Personal Data under conditions established by Data Protection Law. Any such requests received by the Processor shall be transmitted to and considered by the Controller.

Taking into account the nature of the processing as described in Appendix 1, Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the controller's obligation to respond to requests for exercising the data subject's rights. In case of request, such assistance shall be invoiced by Processor to Controller as additional pay per hour work.

4.5.2 Security matters

Taking into account the nature and the information available to Processor, and upon specific request of the Controller, Processor shall assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of GDPR (security obligations, obligations in case of Personal Data Breach and obligations to perform, in certain circumstances, Data Protection Impact Assesments). Such assistance shall be invoiced by the Processor to Controller as additional pay per hour work.

Processor shall notify the controller without undue delay after becoming aware of any Personal Data Breach or any detected unauthorized or unlawful access, use, acquisition, or disclosure of Personal Data relating to the Processor’s Services.

If the results of any possible Data Protection Impact Assessment pertaining to the processing of the Processed Personal Data and to the Services imply any substantial modification to the Services provided by the Processor, Controller and Processor agree to renegotiate the terms of the Service Agreement accordingly (taking into account such results as well as any advice that the parties would have received from the Supervisory Authority).

4.6 End of the provision of Services relating to processing

Processor deletes or returns (in accordance with the terms and conditions set forth in the main Service Agreement), all the personal data to the Controller after the end of the provision of Services relating to processing or in case of Termination of the DPA, and deletes existing copies unless Union or Member State law applicable to the Processor requires storage of the personal data. The Processor shall not thereafter Process such Personal Data.

4.7 Accountability and Audit

Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA.

Before the start of Processing subject to this DPA or at any time thereafter during the Performance of the Service Agreement, Processor allows for and contributes to audits (including inspections) conducted by the Controller or another auditor mandated by the Controller, concerning the technical and organizational measures implemented by the Processor and other data protection provisions. Controller must warn the processor with the nature of the audit at least one working day before it’s execution. Controller shall bear all costs for such inspections and audit (including, for instance, bandwidth used by the audit), and any assistance of the Processor shall be invoiced by the Processor as additional pay per hour work.

Processor shall immediately inform the controller if, in its opinion, an instruction of the Controller infringes any provision of the Data Protection Law.

5. Duration

This DPA shall commence on the Effective Date and shall remain in force thereafter for as long as the Service Agreement remains in full force and effect or unless terminated by either Party in accordance with Section 7 herein.

6. Termination

Notwithstanding anything else contained herein, the following will be considered as causes of early termination of this DPA, which will give the parties the right, at their election and in addition to whatsoever other remedies which they may have in law, to terminate this DPA with immediate effect by way of written notification to the other parties:

• Failure to fulfil any of the obligations set out in this DPA, such a failure not having been remedied within thirty (30) days of written notification to the party in breach specifying the failure to comply and seeking fulfilment thereof;
• The extinction of the legal personality of any of the parties, suspension of payments, judicial commencement of insolvency proceedings or declaration of bankruptcy or any other situation of insolvency; or
• The termination of the Service Agreement.

7. Disclosures

Processor will not disclose Personal Data Processed pursuant to this DPA to any third party, or category of third party without the Controller’s consent, unless Union or Member State law applicable to the Processor requires otherwise.

8. Governing Law

The Processor agrees that the laws of Belgium shall apply to any disputes or differences relating to the Processing of Personal Data and that the Courts of such country shall have non-exclusive jurisdiction in relation to such matters.

Whenever there are changes to the legal provisions referred to in this DPA or in regard to requirements of Data Protection Law relevant to the rights or obligations created by this DPA, the parties shall, if necessary, agree upon respective changes to this DPA.

9. Notices

Any notice or other communication under this DPA shall be in writing and shall only be considered valid if sent first by e-mail and then by registered mail to the relevant e-mail and address given above.

10. Data protection officers

Controller has appointed the following person/organisation as Data Protection Officer: [see contract cover page.]

Processor has appointed the following person/organisation as Data Protection Officer: [see contract cover page.]

11. Entry into force

This DPA will come into force as from the Effective Date.

DPA: Appendix 1 of DPA – Details of the Processing

a) Framework and subject-matter of the processing

Outsourced activities: Web Hosting

Processing entailed by these activities:

• Running an application provided by the controller.
• Storage of this application and all it’s data on (the) server(s).
• Setup and manage the operating system of (the) server(s).
• Applying best practice to secure the operating system of the server.

b) Nature and purpose of the processing

Run the application provided by the controller in order to enable its audience (defined by the processor) to reach and use it through Internet.

This application is developed and managed by the controller. The processor has only basic technical knowledge of the application that enable him to setup the server accordingly.

Unless requested otherwise, the processor may duplicate data in order to provide a backup service, as described in “Technical Description of Hosting Services” above.

Running the application may generate logs files. Those logs files are kept 30 days. If the Controller needs a longer retention period, it is responsible for backing up its logs itself or for subscribing to an additional service. Controller may request, at its expenses a description of all logs file that are generated and kept.

Those logfiles may be analyzed by the controller in order to improve its services or detect anomalies. Once anonymized (IP and hostname, http username and email from/to are encrypted) they may be analyzed by third party on other infrastructure than the one of Diogenius.

c) Type of personal data processed

Data provided by the Controller or produced by it’s application:

The processor does not know the nature of the personal data stored or processed on the server. Those data are protected by our Service Provider Confidentiality Agreement.

The processor is not allowed to analyze the data in order to know its nature unless it’s requested by the controller.

Logs file generated by the infrastructure of the controller while running controllers’ application:

Those log file may include:

• IP addresses and hostname of the user
• Any part of an HTTP request
• Email from/to/date fields

Controller confirms that the processed data will not encompass sensitive data (i.e. data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person's sex life or sexual orientation, data relating to criminal convictions and offences, national registration/ social security number).

d) Categories of data subjects

Data provided by the controller or produced by it’s application:

As state above, the Controller does not know nor is allowed to analyze in order to know (unless requested by controller) the categories of data subjects provided by the controller or produced by it’s application

Logs file generated by the infrastructure of the controller while running controllers’ application:

Those data does not permit to distinguish children from adult.

Controller confirms that the processed data will not pertain to children.

e) Duration of the processing

see “6. Termination”, above.

DPA: Appendix 2 of DPA – Security Measures

Technical security measures :

See “Technical Description of Hosting Services” in our GTC, globally we use state of the art datacenters and apply security good practices (firewall, backups) and have extensive monitoring.

Organizational security measure:

• NDA is included within our internal rules which is then included in all employee’s work contract. Breach may be punished by termination of the contract
• Grant & Access : General System administrator access are only granted to direct experienced employee or processor working as system administrator with indefinite period contract.