Security, data and GDPR
Is there a data processing agreement (DPA)? Does it have to be signed separately?
Yes, there is one, and it is included in our terms and conditions (Annex 1). You accept it at the same time as the contract: no separate signature is needed.
Annex 1 covers all the points in Article 28 of the GDPR: subject matter, duration, categories of data and data subjects, instructions, confidentiality, security, sub-processors, assistance, data breaches, audits and end of processing. For data protection matters, it takes precedence over the rest of the contract.
Reference : clause 2.2, clause 17.2, Annex 1 of the terms and conditions