This page describes the framework for a data processing agreement under GDPR Article 28. The signed DPA and its annexes specify the processing for each customer; this overview does not replace them.
1. Parties and scope
The customer acts as controller and Blackbone SRL as processor where Blackbone processes personal data on the customer's documented instructions. The subject matter, purpose, nature and duration follow the main service agreement and statement of work.
2. Data and people concerned
The annexes identify the types of data and categories of people, which may include the customer's staff, users, prospects or other people relevant to the service. Special-category processing must be expressly identified with appropriate safeguards.
3. Processor obligations
• Process data only on documented instructions, unless applicable law requires otherwise.
• Ensure authorised personnel are bound by confidentiality.
• Apply appropriate technical and organisational security measures.
• Meet the agreed conditions for appointing subprocessors.
• Assist with data subject rights, security, breach response, impact assessments and consultation as required by Articles 28 and 32–36.
• Return or delete data at the end of the service, subject to legal retention requirements.
• Provide information and support audits necessary to demonstrate compliance.
4. Subprocessors
The agreement identifies authorised subprocessors and the applicable authorisation procedure. Where general authorisation is used, the standard arrangement provides advance notice, normally 30 days, of relevant changes and a reasonable opportunity to object. Equivalent data protection obligations apply to subprocessors.
5. International transfers
Transfers outside the EEA require an applicable legal mechanism and any necessary supplementary safeguards. The transfer arrangements and processing locations are documented for the service.
6. Rights requests and incidents
Blackbone assists the controller in responding to rights requests within the applicable deadline and forwards requests received directly as agreed. Personal data breaches are reported to the controller without undue delay; the standard operational target is within 24 hours of awareness, with available information and subsequent updates.
7. Audits
Audit arrangements balance the controller's verification rights with security and confidentiality. Standard arrangements provide 30 days' notice and one routine audit per year, with exceptions for incidents, material concerns or legal requirements. Evidence may include questionnaires, documentation and agreed on-site reviews.
8. End of processing and liability
At the controller's choice, data is returned in an agreed structured format or securely deleted, except where lawful retention is required. Completion can be documented. Liability is governed by the main agreement without restricting mandatory rights under GDPR Article 82.
9. Request a DPA
Email contact@blackbone.ro with DPA request in the subject, your company and the proposed service. We aim to provide a draft within two working days. Data protection questions: dpo@blackbone.ro.