Data processing agreement
The terms on which we process a customer’s data on their behalf.
DRAFT: this page is a preliminary outline, not a binding legal document. The content is to be drafted by a lawyer before launch.
1. Parties and roles
DRAFT (for the lawyer): the customer is the controller, Oden Grupp OÜ is the processor; definition and scope.
2. Subject matter and duration
DRAFT (for the lawyer): what is processed, for how long, what happens when the contract ends.
3. Categories of data subjects and data
DRAFT (for the lawyer): the customer’s technicians, the customer’s own clients, site residents; which fields for each group.
4. Processor obligations
DRAFT (for the lawyer): following instructions, confidentiality, staff obligations.
5. Security measures
DRAFT (for the lawyer): technical and organisational measures, backups, access control.
6. Sub-processors
DRAFT (for the lawyer): the sub-processor list, notice of changes and the right to object.
7. Breach notification
DRAFT (for the lawyer): notification deadline and procedure.
8. Audit
DRAFT (for the lawyer): the customer’s audit right and how it is exercised.
9. Return and deletion of data
DRAFT (for the lawyer): export, deletion deadline, confirmation of deletion.
10. Data location
DRAFT (for the lawyer): where the data is held and whether it is transferred outside the EEA.