Draft: this text has not been legally checked yet.

Data processing agreement

This data processing agreement belongs to the agreement about LTSD Desk. The customer is the controller. Angelista Enterprise B.V. is the processor.

1. Subject and duration

The processor processes personal data only to provide LTSD Desk, for as long as the agreement runs.

2. Nature, purpose and data

Requesting, having signed and keeping supplier's declarations of preferential origin (Implementing Regulation (EU) 2015/2447, Annexes 22-15 and 22-16).

• User e-mail address (sign-in)
• Name and e-mail address of exporters
• Name, e-mail address and language of suppliers, and the products they supply
• Content of the declaration: signer's name and position, company name and address, place, time and IP address of signing

Data subjects: employees, clients or contacts of the customer, as far as they appear in the customer's files.

3. Instructions

The processor processes the data only on documented instructions from the customer. Using the service as intended counts as an instruction.

4. Confidentiality

Everyone with access to the data is bound to confidentiality.

5. Security

The processor takes appropriate measures (GDPR art. 32): encrypted connections (HTTPS), access only after login, servers in the EEA, limited admin access, and backups.

6. Sub-processors

The customer gives general authorisation for these sub-processors:

• OVHcloud SAS, Roubaix, France (hosting of server and database)
• Heinlein Hosting GmbH (mailbox.org), Berlin, Germany (sending and receiving e-mail)
• Mollie B.V., Amsterdam, Netherlands (payments)

The processor announces a new sub-processor 30 days in advance. The customer may object and then cancel.

7. Assistance

The processor helps the customer with requests from data subjects and with the duties of GDPR art. 32 to 36.

8. Breaches

The processor reports a personal data breach to the customer without undue delay, and at the latest 48 hours after discovery (GDPR art. 33).

9. End

After the agreement ends, the customer can export the data for 30 days. Then the processor deletes it, also from backups within 30 days, unless the law requires keeping it.

10. Audits

The processor gives the customer all information needed to show compliance and cooperates with reasonable audits.

11. Transfers

No data is transferred to countries outside the EEA.