The Controller determines the purposes and means of processing. The Processor shall process Personal Data only on documented instructions from the Controller and ensure its personnel are bound by confidentiality. 

●  Process Personal Data only on documented instructions from the Controller. 

●  Implement appropriate technical and organizational measures (TOMs) to protect Personal Data. 

●  Assist the Controller in responding to requests from data subjects. 

●  Notify the Controller without undue delay after becoming aware of a Personal Data Breach. 

●  Maintain records of processing activities. – Make available to the Controller information necessary to demonstrate compliance. 

The Controller authorizes the Processor to engage sub-processors as necessary to provide the services. The current sub-processor list includes:  

Microsoft Corporation (Azure Cloud Services)

●  Purpose: Hosting and Storage  

●  Location: Azure West Europe / North Europe 

●  Certifications: ISO 27001, SOC 2, GDPR compliance 

The Processor shall notify the Controller of any intended changes concerning the addition or replacement of sub-processors.   

All processing activities under this DPA will be performed exclusively in Microsoft Azure’s EU datacenters (West Europe and/or North Europe). No transfers of Personal Data outside the EU/EEA will occur under this arrangement. 

The Processor shall not retain Personal Data longer than necessary to perform the services. Temporary data or caches created during migration are purged upon completion of the project, or earlier upon request of the Controller. No archival or backup copies are retained by the Processor. 

The Processor implements the following TOMs: 

●●Encryption in transit (TLS 1.2+) and at rest (AES-256, Azure Storage Encryption). 

●  Role-based access controls (RBAC) with least privilege principle. 

●  Multi-factor authentication for administrative access. 

●  Audit logging of system access and activity.  

●  Physical and network security measures via Microsoft Azure EU datacenters. 

● Employee confidentiality agreements and security training.

The Processor shall assist the Controller in fulfilling its obligations to respond to data subject requests under GDPR, including access, rectification, restriction, portability, and erasure of Personal Data. 

The Controller may, upon reasonable notice, audit the Processor’s compliance with this DPA. Audits may include reviewing documentation or on-site inspections, subject to confidentiality obligations and reasonable limitations to avoid disruption. 

The liability of each party under this DPA shall be subject to the limitations of liability agreed in the underlying Agreement, except where otherwise required by applicable law.