SITEPULSE · 2026-10-09-v1
Data processing agreement
Prepared document. Operator details and legal review are still pending. This is not a certificate of legal compliance.
Draft for customers collecting third-party data
This prepares the processor agreement under GDPR article 28. Complete customer identity, instructions, annexes, subprocessors, locations and verified safeguards before commercial forms collect personal data. It is neither a certification nor a substitute for an agreed contract.
Scope and instructions
The customer is controller; the SitePulse operator processes form submissions by hosting, storing, displaying and transmitting them through configured channels. Duration is service plus return/deletion. Data consists of authorized contact fields; subjects are customer visitors and contacts. Passwords, banking details, special-category and unlawful data are prohibited.
- Process only on documented instructions, notify apparently unlawful instructions and restrict access to authorized persons under confidentiality.
- Apply access controls, workspace separation, password hashing, backups, updates and encrypted transport before commercial launch. Absolute security is not promised.
- Define each subprocessor, location, function, contract, authorization and change notification with justified objection; the customer also chooses external channels. The list and safeguards remain pending until completed by the operator.
- Assist with rights, security, impact assessments and consultation. Notify customer data incidents without undue delay to support their obligations.
- At termination, return or delete at the controller's choice unless retention is legally required; copies expire through rotation, deletions are reapplied after restoration. Provide compliance information and reasonable article 28 audits.