Data processing agreement
Draft. This text is still to be reviewed by a lawyer and is not yet binding.
Subject and duration
This agreement applies for as long as the firm uses Belsignal. The firm is the controller; Belsignal is the processor under Article 28 GDPR.
Nature and purpose
Checking the Peppol registration of the firm's clients, reporting, notifications, guided fixes and, if chosen, a managed inbox for e-invoices.
Data and data subjects
Names and contact details of clients and their representatives, sole traders' names, the firm's users, signed authorisations and, with the managed inbox, received invoices.
Processor obligations
Belsignal processes only on the firm's written instructions, binds staff to confidentiality, and helps the firm with data subject requests and impact assessments.
Security
Encryption in transit (TLS) and of stored invoices (XChaCha20-Poly1305), strict separation between firms, two-step verification, audit log and encrypted backups in the EU.
Sub-processors
The firm gives general consent to the sub-processors on the public list. Belsignal announces changes at least 30 days in advance; the firm may object.
Data breaches
Belsignal reports a personal data breach without undue delay and at the latest within 48 hours of discovering it.
End and audit
After the end, Belsignal returns or deletes the data within 30 days. The firm may request information once a year to verify compliance.
[Company name, address, enterprise number]
Contact: [email address]