Template. Your personalised DPA is generated from your onboarding answers and signed in the platform together with your Service Agreement.

Data Processing Agreement (Art. 28 GDPR)

Version 2026-11-12 · Generated 2026-11-12 · Package: DPOne DPO Service

Parties

Controller: [Customer legal name], [Customer address], [Country], represented by [Authorised signatory].

Processor: MBZ Compliance, Vegelinsoord 148, 3079KN Rotterdam, the Netherlands (KvK 98446932, VAT NL005331884B84), trading as DPOne ("Provider").

1. Subject matter, duration, nature and purpose (Art. 28(3))

Processor processes personal data only to provide the DPOne services (assessment, reporting, monitoring, DPO support, notifications) for the duration of the Service Agreement plus the retention period below.

Categories of data subjects: Controller's employees and contact persons; where uploaded by Controller, data subjects described in documents (e.g. customers, users).

Categories of personal data: names, business contact details, account data, and personal data contained in documents uploaded by Controller. Controller shall not upload special-category data unless strictly necessary for an assessment.

2. Processor obligations

(a) Process personal data only on documented instructions from Controller, including regarding transfers, unless required by EU or Member State law (Art. 28(3)(a)).

(b) Ensure persons authorised to process personal data are bound by confidentiality (Art. 28(3)(b)).

(d) Engage sub-processors only with Controller's general written authorisation; the current list is in Annex 1. Processor informs Controller at least 30 days in advance of changes, giving Controller the opportunity to object (Art. 28(2), (4)).

(e) Assist Controller with data subject requests (Art. 12-22) by appropriate measures.

(f) Assist Controller with Art. 32-36 obligations (security, breach notification, DPIA, prior consultation).

(g) At the choice of Controller, delete or return all personal data at the end of the services, and delete existing copies unless storage is required by law. Default: export window of 30 days, then secure deletion within 60 days.

(h) Make available all information necessary to demonstrate compliance and allow for audits, including inspections, by Controller or an auditor mandated by Controller, with reasonable notice.

3. Personal data breaches

Processor notifies Controller without undue delay and in any event within 36 hours after becoming aware of a personal data breach, with the information required by Art. 33(3) as far as available.

4. International transfers

Primary data storage is in the EU (Firebase eur3). Transfers outside the EEA take place only under Chapter V GDPR (adequacy decision including the EU-US Data Privacy Framework, or Standard Contractual Clauses 2021/914 with a transfer impact assessment).

5. Liability

The limitation of liability in the Service Agreement applies, without prejudice to Art. 82 GDPR towards data subjects.

Annex 1 - Authorised sub-processors

- Cloudflare, Inc.: Hosting (Workers), DNS, CDN, bot protection (Turnstile), email routing (EU edge / global network; EU-US DPF + SCCs)

- Google Ireland Ltd. (Firebase): Authentication and database (Firestore, location eur3 – Europe) (EU (eur3); SCCs/DPF for support access)

- Stripe Payments Europe, Ltd.: Payments, subscriptions and invoicing (Ireland/EU; DPF + SCCs)

- Sendinblue SAS (Brevo): Transactional and consent-based marketing email (France/EU)

- OpenRouter, Inc.: AI model routing (paid tier, no-training providers only) (USA; SCCs)

- Google Ireland Ltd. (Gemini API, paid): AI drafting fallback (paid tier, no training) (EU/US; DPF + SCCs)

- Telegram FZ-LLC: Opt-in notifications via @DPOneBot (non-sensitive summaries only) (UAE/global; opt-in only)

Annex 2 - Technical and organisational measures

- Encryption in transit (TLS 1.2+, HSTS) and at rest (provider-managed).

- Strong authentication; MFA mandatory for administrator and DPO roles; role-based access and tenant isolation.

- Bot protection, rate limiting, strict Content-Security-Policy and security headers.

- Tamper-evident (hash-chained) audit logs for sign-ins, signatures, exports and admin access.

- Data minimisation: only company-level facts are sent to AI providers; paid tiers with no training on data.

- Backups, incident response plan with breach log, documented retention and secure deletion.