Data processing agreement

1. Parties, scope and completed schedules

This agreement applies when the customer and Novasean identify and accept this version for a service under which Novasean processes personal data on the customer’s behalf. The customer is the controller or is itself a processor authorised by the controller. Novasean acts as processor or subprocessor accordingly. The service Order identifies the parties and authorised contacts.

Before processing starts, the parties must complete and agree four schedules: I, processing details and instructions; II, actual technical and organisational measures; III, authorised subprocessors and locations; and IV, international transfers and safeguards. The required fields are in Processing schedules. This standard text without those service-specific schedules is not a completed Article 28 arrangement.

Schedule I must state the subject matter, duration, nature and purpose of processing, types of personal data, categories of data subjects, controller rights and obligations, and return/deletion instructions. The obligations below continue for as long as Novasean retains customer personal data.

2. Documented instructions

Novasean must process customer personal data only on documented instructions from the customer, including instructions on transfers outside the EEA, unless Union or Member State law binding on Novasean requires processing. In that case, Novasean must inform the customer before processing unless the law prohibits that information on important grounds of public interest.

Novasean must immediately tell the customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data-protection law. The parties must resolve the issue; Novasean must not treat the service agreement as permission for a new independent use such as advertising or model training. The customer remains responsible for its lawful purposes, instructions and information to data subjects.

3. Confidentiality and security

Novasean must ensure that persons authorised to process the data commit to confidentiality or are subject to an appropriate statutory duty. Access must be limited to what their role requires. Novasean must implement and maintain the technical and organisational measures required by Article 32 GDPR, taking account of the nature, scope, context and purposes, the risks, the state of the art and implementation costs.

Schedule II must describe implemented measures specifically, including access, authentication, confidentiality, integrity, availability, resilience, restoration and periodic testing where appropriate. A website statement or proposed control is not evidence that a service has that control. Changes must not lower the agreed protection unlawfully; material changes affecting the customer must be communicated.

4. Subprocessors

Novasean must not appoint a subprocessor without the customer’s prior specific written authorisation or a separately agreed general written authorisation. Schedule III must name the authorised legal entities, their processing activity, data, processing and access locations, and relevant safeguards. If general authorisation is agreed, Novasean must give advance written notice of an intended addition or replacement with enough information and time for a meaningful objection. Novasean must resolve an objection or refrain from the affected new processing; it cannot treat a website edit alone as authorisation.

Novasean must bind each subprocessor to the same data-protection obligations in substance through a contract or other lawful act, including sufficient guarantees for appropriate measures. Novasean remains fully liable to the customer for the subprocessor’s performance of those obligations. The customer must have access to the information needed to understand and oversee the processing chain.

5. Rights requests and compliance assistance

Taking account of the nature of processing, Novasean must assist the customer through appropriate technical and organisational measures, insofar as possible, with requests under GDPR Chapter III. Novasean must promptly forward requests concerning customer-controlled data and must not decide the customer’s response independently unless authorised or legally required.

Taking account of the nature of processing and information available to it, Novasean must assist the customer with Articles 32–36: security, breach assessment and notification, data-protection impact assessments and prior consultation. The service schedule must identify a working contact and access to information. Any separately agreed reasonable assistance charges must not defeat a statutory right or excuse a legally required response.

6. Personal-data breaches

Novasean must notify the customer without undue delay after becoming aware of a personal-data breach affecting customer personal data. It must provide available information on the nature of the breach, affected categories and approximate numbers where possible, the contact for further information, likely consequences, and measures taken or proposed, including mitigation. Information may follow in phases without undue further delay if it is not yet available.

Novasean must preserve relevant evidence, take appropriate containment and recovery action and cooperate with the customer. It must not wait for a complete investigation before the initial notification. The controller’s potential 72-hour authority-notification period is not a 72-hour allowance for Novasean to notify the customer. The customer retains decisions assigned to the controller; Novasean retains any legal duties that apply directly to it.

7. Information and audits

Novasean must make available all information necessary to demonstrate compliance with Article 28 and allow and contribute to audits, including inspections, conducted by the customer or its mandated auditor. The parties may agree proportionate arrangements protecting other customers, confidentiality and security; those arrangements must not prevent effective audits or urgent regulatory access.

Independent reports may support the audit, but no certification or report replaces these rights automatically. Novasean must identify and remedy deficiencies within its responsibility and provide the customer with relevant results. Neither a prohibitive fee nor an absolute frequency limit may frustrate legally required oversight.

8. International transfers and authority requests

Transfers must follow the customer’s documented instructions and GDPR Chapter V. Schedule IV must identify the exporter and importer, their roles and legal entities, destination and access countries, data, transfer mechanism and any required assessment and supplementary measures. A supplier’s location alone does not establish a valid mechanism. Canada’s adequacy coverage is limited to recipients covered by the relevant adequacy decision; it is not a blanket clearance for every Canadian backup arrangement.

Where applicable, the parties must execute the correct European Commission international-transfer standard clauses without altering their mandatory substance and complete their annexes. These DPA terms are not those transfer clauses. Novasean must assess requests for access or disclosure, seek clarification or challenge where legally warranted, minimise disclosure, and notify the customer unless legally prohibited. See authority requests.

9. Return, deletion and ending processing

At the customer’s choice, Novasean must return or delete all customer personal data after the end of processing services and delete existing copies, unless Union or Member State law requires retention. Schedule I must state the return method, period, deletion sequence and any limited backup expiry. A generic “backup exception” cannot justify indefinite retention.

During any justified residual retention, data must remain protected and used only for the permitted purpose. If an older copy is restored, applicable deletion instructions must be reapplied. Novasean must identify legally required retention and, on request, provide appropriate completion evidence. Switching and retrieval arrangements must be reconciled with the customer’s instructions before deletion.

10. Precedence and responsibilities

This DPA prevails over conflicting general service wording on personal-data processing. Nothing here limits data-subject rights, regulator powers, Article 82 liability or other mandatory obligations. A customer acting as processor must ensure its instructions and appointment of Novasean are authorised by the controller. Each party remains accountable for the duties assigned to it by law.