Data Processing Agreement

between

[Client company name], [business ID], [address], [country], contact person: [name, title, email]; data protection officer, if any: [name, email] ("Controller")

and

Elivance Tmi, business ID 2503638-4, Lappeenranta, Finland, lidia@elivance.eu ("Processor").

1. Purpose and scope

1.1 The Processor provides services to the Controller under the quote [Q-...] dated [date] and Elivance's Terms of Service (the "Main Contract"). In doing so, the Processor processes personal data on behalf of the Controller.

1.2 This agreement sets out the parties' duties under Article 28 of Regulation (EU) 2016/679 (GDPR) and, where it applies, the UK GDPR. The subject matter, nature, purpose, duration, types of personal data and categories of data subjects are listed in Annex 1.

1.3 If this agreement and the Main Contract differ on personal data, this agreement wins.

1.4 Where the processing runs. The quote and Annex 1 say which of these applies:

• (a) Processor's servers (default). The Processor builds and runs the Controller's automations on its own servers in the EU. Its hosting providers are sub-processors and are listed in Annex 3.
• (b) Controller's own server. On the Controller's request, the Processor sets up a server under the Controller's own hosting contract and does all the work there. The hosting provider is the Controller's processor, not a sub-processor of the Processor; the Processor only accesses the server.
• (c) Controller's own cloud accounts. Where the Controller has its own accounts in cloud services (for example file storage, office suites or automation platforms), the Processor works inside those accounts with the access the Controller grants and can revoke. Those services are the Controller's processors under the Controller's own contracts.

1.5 Shared folders. A shared folder for the project is created by the Controller in its own storage; that storage is the Controller's processor. Copies on the Processor's side are deleted at the end of the project under 3.8.

2. Controller's duties

2.1 The Controller decides the purposes and means of the processing and is responsible for its lawfulness, including the legal basis, the information given to data subjects, and any consent needed for messages to its customers.

2.2 The Controller gives its instructions in writing (email is enough). The Main Contract, the written scope and this agreement are the Controller's instructions at signing.

3. Processor's duties

The Processor:

3.1 processes the personal data only on documented instructions from the Controller, including on transfers to third countries, only for the specific purposes and only for the duration set out in Annex 1, unless EU or Member State law requires otherwise; in that case it tells the Controller first, unless the law forbids this;

3.2 tells the Controller at once if, in its opinion, an instruction breaks the GDPR or other data protection law;

3.3 gives access to the personal data only to persons who need it, and only as far as strictly necessary to carry out, manage and monitor the Main Contract; ensures that every person authorised to process the data has committed to confidentiality or is under a statutory duty of confidentiality; at signing, only Lidia Sorokina has access;

3.4 takes at least the technical and organisational security measures described in Annex 2, as required by Article 32 GDPR, to protect the data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access; it keeps them appropriate to the risk, taking into account the state of the art, the costs, and the nature, scope, context and purposes of the processing, and changes them only without lowering the level of protection;

3.5 uses sub-processors only as section 4 allows;

3.6 helps the Controller, with appropriate measures and as far as possible, to answer requests from data subjects exercising their rights (Chapter III GDPR), and forwards any such request it receives to the Controller without delay; it does not answer the request itself unless the Controller authorises it;

3.7 helps the Controller meet its duties under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment and prior consultation), taking into account the nature of the processing and the information available to the Processor, and tells the Controller without delay if it learns that personal data it processes is inaccurate or outdated;

3.8 at the end of the services, at the Controller's choice, deletes or returns all personal data and deletes existing copies, within 30 days, unless EU or Member State law requires storage; it confirms the deletion in writing. Copies in backups are overwritten within 14 days after deletion and are not used in the meantime. Until the data is deleted or returned, the Processor keeps protecting it under this agreement;

3.9 makes available to the Controller all information needed to show compliance with Article 28 GDPR and allows and contributes to audits, including inspections, by the Controller or an auditor it appoints (section 7);

3.10 charges help under 3.6, 3.7 and 6.4 that takes more than 2 hours in a calendar month at the hourly rate in the Main Contract; help with a breach caused by the Processor is free; the charge never delays or conditions the help;

3.11 keeps a record of the processing it carries out for the Controller (Article 30(2) GDPR).

4. Sub-processors

4.1 The Controller gives general written authorisation to use the sub-processors listed in Annex 3.

4.2 The Processor informs the Controller specifically in writing at least 14 days before adding or replacing a sub-processor, and gives the information the Controller needs to decide whether to object (name, purpose, location, transfer tool). The Controller may object on reasonable data protection grounds within that time, and the Processor does not engage the new sub-processor before that time has passed. If the parties cannot agree, the Controller may end the affected services without penalty.

4.3 The Processor puts the same data protection duties as in this agreement on each sub-processor by contract, and makes sure the sub-processor meets them. At the Controller's request, it gives a copy of that contract (for standard providers, usually their published data processing terms); business secrets and other confidential information, including personal data, may be blacked out. The Processor remains fully responsible to the Controller for the sub-processor's performance, and tells the Controller if a sub-processor fails to meet its duties under that contract.

4.4 Services that the Controller subscribes to on its own accounts (for example its CRM, phone or email provider, its own server under 1.4(b) or its cloud accounts under 1.4(c)) are the Controller's own processors, not sub-processors of the Processor. The Processor only configures them on the Controller's instructions.

4.5 Video calls. Video call tools are not sub-processors under this agreement and are not listed in Annex 3. The Controller may require any project call to be held on its own video link.

4.6 AI notes on calls. The following rule from the Terms of Service applies to project calls: Calls are held with an AI note-taking assistant (Fireflies) present. It records and transcribes the call so that Lidia can write the plan or notes for your work. This is a condition of the call, stated before you book or pay. It is based on legitimate interest and the contract (GDPR Article 6(1)(f) and (b)), not on consent. If you do not accept it, the call is not booked, or the normal cancellation rule applies; there is no special refund. Recordings and transcripts are kept for up to 12 months. Please tell anyone who joins from your side. Where Controller personal data is discussed on such a call, Fireflies acts as a sub-processor (Annex 3).

4.7 If the Processor disappears. Where the sub-processor's terms allow it, the Processor agrees with the sub-processor that, if the Processor has factually disappeared, ceased to exist in law or become insolvent, the Controller may end the sub-processor's contract and instruct the sub-processor to delete or return the personal data. Standard terms of large providers may not allow this; on request, the Processor tells the Controller which sub-processors in Annex 3 do.

5. Transfers outside the EU/EEA

5.1 The Processor transfers personal data outside the EU/EEA only on the Controller's documented instructions, or where EU or Member State law to which the Processor is subject requires it (3.1 then applies), and always in compliance with Chapter V GDPR, with a valid transfer tool: an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or the European Commission's Standard Contractual Clauses. For data under the UK GDPR: a UK adequacy regulation or the UK International Data Transfer Addendum.

5.2 Transfers at signing are listed in Annex 3. Ticking a sub-processor in Annex 3 is the Controller's documented instruction for the transfer shown there.

5.3 Where the Processor engages a sub-processor that processes personal data in a third country, the Controller agrees that the Processor and the sub-processor may meet Chapter V GDPR by using the European Commission's Standard Contractual Clauses (Article 46(2) GDPR), provided the conditions for their use are met.

6. Personal data breaches

6.1 The Processor notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Controller's data.

6.2 The notice includes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact person. Information not yet known is given as soon as it is.

6.3 The Controller decides on notifying the supervisory authority and data subjects.

6.4 For any personal data breach relevant to the processing, including one in the Controller's own systems, the Processor helps the Controller to notify the supervisory authority within the 72 hours set by Article 33 GDPR and, where needed, to tell the data subjects (Article 34 GDPR), by obtaining and giving the information listed in 6.2 that is available to it.

7. Audits

7.1 The Processor answers the Controller's reasonable written questions on compliance promptly and adequately, and in any case within 14 days.

7.2 The Controller, or an auditor it appoints, may audit the processing, including by inspection on site or remotely, at reasonable intervals (normally at most once a year) and also whenever there are indications of non-compliance, after a breach, or when a supervisory authority requires it. A routine audit is announced at least 30 days in advance; an audit on indications of non-compliance or after a breach is announced with reasonable shorter notice. Audits take place during normal working hours, and the auditor is bound by confidentiality. In deciding on an audit, the Controller may take into account relevant certifications held by the Processor. Each party bears its own costs, unless the audit finds a material breach by the Processor.

7.3 The Processor makes the information under 3.9 and 7.1, including the results of any audit, available to the competent supervisory authority on request.

8. Liability

8.1 Each party's total liability for all claims under a contract, including claims about personal data, is limited to the price of that contract. For a support plan without a fixed total, the price is the fees paid under it. This limit does not apply to the customer's duty to pay the fees, to intent or gross negligence, or to liability that cannot be limited by law. In this agreement, the contract is the Main Contract, and this agreement does not add a separate or higher limit.

8.2 Each party bears any administrative fine imposed on it.

8.3 This section does not limit the rights of data subjects under Article 82 GDPR. If one party has paid full compensation to a data subject for damage the other party caused, it may claim back from the other party the part of the compensation corresponding to that party's responsibility (Article 82(5) GDPR).

8.4 The same rule is written in sections 11.2 and 11.4a of Elivance's Terms of Service; neither text refers to the other for its content.

9. Term, non-compliance and end

9.1 This agreement applies for as long as the Processor processes personal data for the Controller.

9.2 The Processor tells the Controller at once if it cannot comply with this agreement for any reason. If the Processor breaches this agreement, the Controller may instruct it to suspend the processing until it complies again or this agreement ends.

9.3 The Controller may end this agreement and the affected services under the Main Contract, as far as they involve processing personal data, if: (a) the processing was suspended under 9.2 and compliance is not restored within a reasonable time, and in any case within one month; (b) the Processor substantially or persistently breaches this agreement or its duties under the GDPR; or (c) the Processor does not comply with a binding decision of a competent court or supervisory authority about its duties under this agreement or the GDPR.

9.4 The Processor may end this agreement and the affected services if, after it has told the Controller under 3.2 that an instruction breaks the law, the Controller insists on that instruction.

9.5 Payment for work already done follows the Main Contract. After the end, 3.8 applies. Sections 3.8, 6 and 8 continue to apply after this agreement ends.

10. Law and disputes

This agreement is governed by the laws of Finland. Disputes are settled as stated in the Main Contract.

Signed:

Annex 1 - Description of the processing (filled per project)

Annex 2 - Technical and organisational measures (Processor)

• Access: only Lidia Sorokina; two-factor sign-in on the work computer; strong unique passwords and two-factor authentication on accounts where offered; server access by SSH keys (password login switched off on the website server).
• Credentials: client logins and API keys stored in an encrypted vault; never in email, chat or code; revoked at the end of the work.
• Least data: work on test data where possible; production data only as needed for the agreed task.
• Encryption: all transfers over encrypted channels (TLS, SSH); Processor-side copies on encrypted disks.
• Infrastructure (mode 1.4(a)): Processor-run components run on servers in the EU - Hetzner Online GmbH (Germany) and OVH SAS (France) - with firewalls and updates. Backups stay on the same server, 14 days rotating; there is no copy outside that server.
• Notifications: notifications to the Processor's phone (Telegram) and task list (Asana) contain only internal reference numbers and links, never Controller personal data.
• AI providers: only business or API plans that do not use customer data for training; no personal data in prompts beyond what the task needs.
• Devices: work computer with full-disk encryption, screen lock and current updates.
• Logging and incident handling: breach procedure as in section 6. Server logins and administrative actions are logged by the operating system (auth log, kept about 4 weeks, weekly rotation); web server access logs are kept 14 days.
• Availability and restore: backups as above; restoring from a backup is tested at least every 6 months.
• Physical security: provided by the hosting providers' data centres (mode 1.4(a)) (ISO/IEC 27001 certified data centres, per the providers' published certificates); Controller personal data is not printed or kept on paper.
• Review: these measures are reviewed at least once a year and after any incident, and the date of the review is recorded.
• Assistance to the Controller (3.6, 3.7): on the Controller's instruction, the Processor finds, exports in a common machine-readable format (for example CSV or JSON), corrects or deletes a data subject's records in Processor-run components.
• Deletion: Processor-side copies deleted within the period in 3.8; backups overwritten within 14 days. Returned data is given in a common machine-readable format.

Annex 3 - Authorised sub-processors (filled per project; tick those used)

Not used for Controller personal data: DeepSeek (storage in China, no transfer tool), Perplexity API (retention and location not stated, left the Data Privacy Framework on 8.10.2026). xAI Grok only under an enterprise agreement with zero data retention, agreed in writing per project; not listed by default.

Mode 1.4(b) or (c): the hosting and cloud services are the Controller's processors and are not listed here. Video call tools: see 4.5.