Data processing agreement
A data processing agreement is a legally binding contract that states the rights and obligations of NHe4a GmbH (acting as a data processor) and your company (acting as a data controller) concerning the protection of personal data. It completes NHe4a GmbH’s Terms and Conditions and applies to personal data processing activities subject to GDPR.
In accordance with GDPR Article 28(new window), Section 3, our data processing agreement includes assurances that:
- NHe4a GmbH agrees to process personal data only on written instructions of your company.
- Everyone who comes into contact with data at NHe4a GmbH is sworn to confidentiality.
- NHe4a GmbH uses appropriate technical and organizational measures are used to protect the security of the data.
- NHe4a GmbH will not subcontract to another processor unless instructed to do so in writing by your company, in which case another DPA will need to be signed with the sub-processor (pursuant to Sections 2 and 4 of Article 28).
- NHe4a GmbH will help your company uphold its obligations under the GDPR, particularly concerning data subjects’ rights(new window).
- NHe4a GmbH will help your company maintain GDPR compliance with regard to Article 32(new window) (security of processing) and Article 36(new window) (consulting with the data protection authority before undertaking high-risk processing).