Data Processing Agreement (DPA)

1. Terms and introduction

As set out in our PRIVACY POLICY (proreferit.com/en/data), the platform acts for some services as a data controller and for others as a data processor. We act as controller unless it is expressly stated that for a particular product or service we act as processor. Where we state this and act as data processor, we process the data on behalf of another company without deciding the purposes and means of the processing.

We currently act as processor when the PROMAIL service is used. For unregistered users this means that they can assert their rights directly against the controller. This agreement governs the data processing that we carry out as processor in providing our products and services when we process data on behalf of the controller.

2. Parties

The data processor (hereinafter "the processor") processes data on behalf of the data controller (hereinafter "the controller"):

Data processor:

Data controller:

3. Applicable products

The platform acts as processor in the use of the following products:

• PROMAIL

The processor undertakes to process personal data only on the controller's documented instructions and solely for the purpose of providing the applications and functions contracted.

4. Categories of personal data and data subjects

Personal data: name, email address, telephone number, message sent or other data provided through the form.

Categories of data subjects: customers or users who complete the form.

5. Obligations of the processor

The processor undertakes to:

• Process the data only in accordance with the controller's instructions.
• Ensure the confidentiality of the data through confidentiality undertakings signed by all authorised personnel.
• Implement and keep up to date appropriate technical and organisational measures to protect personal data against loss, unauthorised access or alteration (Art. 32 GDPR).
• Not transfer the data to third parties without the controller's prior written authorisation, without prejudice to transfers required by law, administrative order or court order.
• Notify the controller without undue delay of any relevant security breach.
• Assist the controller in ensuring the rights of data subjects (access, rectification, erasure, portability, restriction, objection).
• Assist the controller in audits or reviews of compliance with the GDPR.

6. Obligations of the controller

The controller undertakes to:

• Withdraw, delete, restrict, rectify or otherwise act as provided for by law when the data subject or the competent authority so requires.
• Implement and keep up to date appropriate technical and organisational measures to protect personal data against loss, unauthorised access or alteration (Art. 32 GDPR).
• Implement and keep up to date technical and organisational measures for the secure transfer of the data to the platform's servers.
• Obtain the appropriate consent and inform the data subject of their rights before transmitting their data to the platform.
• Not upload, or facilitate the upload of, data that could be considered to have been obtained illegitimately, unlawfully or contrary to the code of good practice.

7. Suppliers and sub-processors of the processor

The processor may not subcontract the processing to third parties without the controller's written authorisation. A supplier of the processor that provides services necessary for the operation of the contracted services, such as servers, storage, management software, accounting services, invoicing services, etc., is in no case regarded as a subcontractor. In these cases the processor's suppliers must meet equivalent obligations and a level of protection equivalent to that required by the GDPR.

8. Duration of processing

The processor will process the data only for the duration of the main contract or until the controller instructs the deletion or return of the data.

9. Return or deletion of data

At the end of the contractual relationship, the processor must delete all personal data processed in accordance with the controller's instructions. The controller may save and download their processed data at any time and is aware that it is permanently deleted when the contractual relationship with the processor ends.

10. Jurisdiction and applicable law

This agreement is governed by Spanish law, and any dispute will be resolved before the courts of Málaga, Spain. Terms referring to persons include all genders, orientations, legal forms and entities.