Data processing agreement — Article 28 template

This is a data processing agreement template, not evidence of a signed agreement or activated customer processing. It must be completed, accepted by the parties and linked to an identified contract before the first data transfer. The business acting as controller and the legal entity operating Loocas must be identified, together with their authorised representatives and contacts.

The template applies only to operations performed by Loocas on the business’s instructions. Processing for Loocas’s own purposes and any joint controllership must be assessed separately on the facts. Hosting, moderation and network sharing do not automatically become a single processor relationship merely because of a contractual label.

Under the signed agreement, Loocas will process data only on the controller’s documented instructions, including for international transfers, unless applicable law requires otherwise; in that case, the controller will be informed before processing unless the law prohibits this. Instructions considered to breach data-protection rules will be brought to the controller’s attention immediately.

The controller will determine purposes, lawful basis, authorised recipients and retention periods. It will ensure that people receive the necessary information and that collection, publication and network-sharing permissions are in place. A content licence is not a substitute for a GDPR lawful basis. No reuse for Loocas’s own purposes, direct marketing or AI-model training on entrusted data is authorised by default.

AI complaint analysis requires its own documented instructions and allocation of responsibilities. Moderation decisions made for Loocas’s own purposes must not be artificially described as merely following client instructions. No instruction may remove free remedies or required human intervention, or require deletion solely because a review is negative.

The signed schedule will describe the operations actually purchased. The following are required scoping fields, not a list of processing already taking place.

• Contract, parties, representatives, data-protection contacts and effective date: to be completed.
• Subject matter and purposes: specify only the selected functions, such as post-purchase invitations, review management and authorised publication.
• Nature of operations: specify the receipt, matching, sending, storage, moderation, aggregation, display, export and deletion actually authorised.
• Categories of data subjects: specify customers, review authors and authorised staff of the business.
• Data types: select strictly necessary order and product identifiers, contact details, pseudonyms, reviews, ratings, dates and proportionate evidence.
• Sensitive or criminal-offence data: no intentional processing by default; define a specific procedure if such data is necessary or detected.
• Duration, frequency, volume, network scope and recipient categories: to be completed; no indefinite retention by default.
• Processing locations, support access, possible transfers and subprocessors: to be completed and cross-checked against Schedule C.
• For AI complaints: specify the necessary grounds, references, text, proportionate evidence, follow-up details, decisions and version records; exclude unrelated data and secret credentials. Describe roles, lawful bases, possible effects and remedies.

Loocas must restrict access to people who need it for authorised operations and ensure they are bound by an appropriate confidentiality obligation. Access rights must be documented, reviewed and withdrawn when no longer justified.

Orders, private contact details and evidence will not become accessible to other shops merely because they participate in the network. The publishable part of a review must be separated from management data and supporting documents.

Security must be appropriate to the risks under Article 32 GDPR. The measures actually implemented, their owner and supporting evidence must be described in the schedule before activation. The following list identifies areas to cover; it does not assert an existing certification or technical guarantee.

• Separation between organisations and environments; least-privilege permissions and authentication appropriate to sensitive access.
• Protection of transfers, backups, evidence and secrets; key management and encryption appropriate to documented risk.
• Prevention of unauthorised exports, data minimisation and checks on incoming media.
• Proportionate logging without passwords, authentication codes or unnecessary sensitive content.
• Updates, vulnerability management, integrity checks and access reviews.
• Backups, restoration testing, continuity, recovery and measurable objectives to agree.
• Incident detection, handling and traceability; regular testing of the measures’ effectiveness.
• Deletion and revocation propagated to authorised copies, with explicit rules for backups and offline media.

Publication of this template does not approve any supplier or country. The agreement must provide for specific or general prior written authorisation. With general authorisation, Loocas will inform the controller of planned additions or replacements early enough to allow an effective objection within the agreed period.

Each subprocessor will be bound by equivalent data-protection obligations for its service. Loocas will remain responsible to the controller for that subprocessor’s performance of those obligations.

No AI moderation provider is identified or deemed authorised at this stage. Before sending a case, its identity, processing locations and access, possible transfers, confidentiality, retention, subprocessors and absence of unauthorised reuse, including training, must be settled.

• For each supplier: legal name, service, accessible data, hosting and access countries, safeguards and contact.
• For each change: notification date, agreed objection period, response and resolution where an objection remains unresolved.
• Any AI-model provider or analysis service receiving personal data must be included within the appropriate scope; training use or supplier retention must not be assumed acceptable.

Storage locations and remote access must be inventoried. A statement that hosting is in the European Union does not by itself rule out transfers arising from support or a subprocessor elsewhere.

Any transfer governed by Chapter V GDPR must have the applicable mechanism and checks: an adequacy decision, appropriate safeguards or another genuinely relevant basis. Necessary assessments and supplementary measures will be documented. A generic compliance statement or this template alone will not justify a transfer.

Taking the nature of processing into account, Loocas will assist the controller, through appropriate technical and organisational measures insofar as possible, in responding to individuals’ requests. Channels, internal recipients and proportionate verification procedures will be agreed in Schedule D.

A request received directly by Loocas concerning processor-held data will be forwarded to the authorised contact without undue delay, unless instructions authorise Loocas to respond. Access, rectification, erasure, restriction, objection and portability will respect their legal scope and third-party rights. A response must not be made impracticable by the number of receiving shops.

Loocas must notify the controller of a breach affecting entrusted data without undue delay after becoming aware of it, then supplement the information available. The notification will describe the incident, affected categories and approximate volumes where known, likely consequences, measures taken or proposed and a follow-up contact.

Schedule D will specify the emergency channel and update arrangements. No numerical contractual deadline is fixed here. The controller’s possible deadline for notifying an authority must not be confused with the processor’s duty to alert it without undue delay. External communications will be coordinated without preventing a party from meeting its own legal duty.

Taking account of the information available to it and the nature of processing, Loocas will assist the controller with security, breach management, impact assessments and prior consultation. Relevant information must be supplied in time for those obligations to be exercised effectively.

Necessary records will be maintained and lawful requests from competent authorities addressed. A new purpose, sensitive profiling or a substantial subprocessor change will not be activated as a mere technical update without reassessing the applicable framework.

The complaint process must incorporate an Article 22 GDPR assessment, useful information for individuals, bias checks and, where necessary, an impact assessment. Human intervention must allow genuine consideration and revision; AI must not turn submitted evidence into processing instructions. This template does not state that these requirements are already implemented.

Loocas will make available the information necessary to demonstrate compliance with the agreement’s obligations and will allow and contribute to audits, including inspections, by the controller or its appointed auditor.

Practical arrangements must protect confidentiality, other customers and service security without neutralising audit rights or an authority’s powers. A general assurance statement is not a substitute for the evidence needed to assess the actual processing entrusted.

At the end of the service, at the controller’s choice, Loocas must return or delete entrusted data and delete copies unless applicable law requires retention. Data retained by law will be isolated, restricted to that purpose and deleted when the required period expires. The backup schedule and evidence of completion must be specified.

Before signing, the parties will complete the following items. This template authorises no customer-data import or transfer until the scope, means and responsibilities have actually been settled.

• Authorised contacts, instruction channel and change-approval procedure.
• Rights-request and incident channels; operational availability and agreed update timing.
• Export format, recipient, return/deletion choice, copy and backup schedule, and completion checks.
• Approved schedules, versions, effective date, duration, related contracts and signatures of authorised representatives.
• Document hierarchy: applicable data-protection duties take precedence over incompatible instructions or terms; individuals’ rights and authorities’ powers remain protected.