Data Processing Addendum

1. Introduction

This Data Processing Addendum ("DPA") forms part of the Terms of Service between GPSR Kit ("Processor," "we," or "us") and you ("Controller" or "Customer") for the GPSR Kit service.

This DPA applies when we process personal data on your behalf as a data processor under the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Definitions

"Personal Data"

Any information relating to an identified or identifiable natural person that you provide to us through the Service.

"Processing"

Any operation performed on Personal Data, including storage, retrieval, use, or deletion.

"Data Subject"

The individual to whom Personal Data relates.

"Sub-processor"

A third party engaged by us to process Personal Data on your behalf.

3. Scope of Processing

3.1 Categories of Data Subjects

The Personal Data processed concerns the following categories of data subjects:

• Your employees and representatives (names, contact details on GPSR documents)
• Your customers (if you include their information in product documentation)
• Manufacturers and suppliers (contact information for compliance documents)

3.2 Types of Personal Data

We may process the following types of Personal Data:

• Names and business titles
• Business email addresses and phone numbers
• Business addresses
• Any other personal data you include in your product documentation

3.3 Purpose of Processing

We process Personal Data solely to:

• Provide the GPSR Kit service to you
• Generate compliance documentation as instructed by you
• Store and manage your product data
• Provide customer support

4. Our Obligations as Processor

We commit to:

5. Your Obligations as Controller

You are responsible for:

• Lawful Basis: Ensuring you have a lawful basis for processing Personal Data and sharing it with us
• Data Subject Information: Informing data subjects about the processing of their Personal Data
• Data Subject Rights: Handling data subject requests, with our assistance as needed
• Accuracy: Ensuring Personal Data provided to us is accurate and up-to-date
• Instructions: Providing lawful processing instructions

6. Sub-processors

6.1 Authorized Sub-processors

By accepting this DPA, you authorize us to use the following sub-processors:

6.2 New Sub-processors

We will notify you before adding new sub-processors by:

• Updating the list on this page
• Sending an email notification to your account email (for significant changes)

You may object to a new sub-processor within 30 days. If we cannot address your objection, you may terminate the affected services.

7. International Data Transfers

When Personal Data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:

• EU-approved data centers: Our primary database is hosted in the EU
• Standard Contractual Clauses (SCCs): We use EU-approved SCCs with sub-processors that process data outside the EEA
• Adequacy decisions: Where applicable, we rely on EU adequacy decisions

8. Security Measures

We implement the following security measures:

9. Audit Rights

You have the right to audit our compliance with this DPA. We will:

• Make available information reasonably necessary to demonstrate compliance
• Allow for and contribute to audits conducted by you or an auditor you appoint
• Provide copies of relevant certifications or audit reports upon request

Audits must be conducted with reasonable notice, during business hours, and must not disrupt our operations. You bear the cost of any audits you request.

10. Term and Termination

This DPA remains in effect for as long as we process Personal Data on your behalf. Upon termination:

• We will delete or return Personal Data within 30 days, at your choice
• We may retain data required by law for the legally required period
• Confidentiality obligations survive termination

11. Contact

For questions about this DPA or to exercise your rights: