{"agreement_reference":"DPA-2025-0042","effective_date":"2025-02-15","controller":{"name":"Acme Supplies SRL","address":"Rue de la Loi 100, 1040 Brussels, Belgium","company_number":"BE0123.456.789","contact_email":"privacy@acme-supplies.eu","dpo_email":"dpo@acme-supplies.eu"},"processor":{"name":"Nimbus Cloud Services BV","address":"Herengracht 200, 1016 BS Amsterdam, Netherlands","company_number":"NL54321098","contact_email":"legal@nimbus.example","dpo_email":"dpo@nimbus.example"},"main_agreement_reference":"Master Services Agreement dated 15 February 2025 between the Parties.","subject_matter":"Hosting and operation of the controller's CRM database, including backup, monitoring and user access management, as described in the main agreement.","duration":"Term of the main agreement, plus a 30-day wind-down period during which the processor returns or deletes data per clause 10.","processing":{"nature_and_purpose":"Storage, backup, indexing and controlled access to customer relationship data so the controller's employees can record interactions with customers and prospects.","data_subjects":["Controller's employees (as CRM users)","Controller's customers (as CRM records)","Controller's prospects (as CRM records)"],"data_categories":["Identification data (name, title)","Business contact details (email, phone, company)","Interaction history (notes, call logs, email threads)","Sales pipeline data (deal stage, value, close date)"]},"sub_processors":[{"name":"Amazon Web Services EMEA SARL","service":"Underlying cloud infrastructure (IaaS)","location":"eu-west-1 (Ireland)"},{"name":"Sendgrid (Twilio Ireland Ltd)","service":"Transactional email delivery","location":"EU with US fallback"}],"sub_processor_notice_period_days":30,"security_measures":["Encryption at rest (AES-256) and in transit (TLS 1.3)","Role-based access control with least-privilege defaults","Mandatory multi-factor authentication for all administrator accounts","Quarterly access reviews and privileged-access logging","Daily encrypted backups retained 30 days, monthly for 12 months","Annual independent penetration test (summary report available to controller)","ISO/IEC 27001 and SOC 2 Type II certified data centres","Documented incident response plan with 24/7 on-call rotation","Security awareness training for all personnel, refreshed annually"],"international_transfers":[{"country":"United States","safeguard":"EU-US Data Privacy Framework; SCCs 2021/914 Module 3 as fallback for any sub-processor not certified under the DPF."}],"breach_notification_hours":48,"audit_rights":"Once per 12 months the controller may audit the processor's compliance with this DPA, either directly or via a mutually agreed third-party auditor, during business hours on at least 30 days' notice. Costs of routine audits are borne by the controller; costs of an audit triggered by a confirmed breach are borne by the processor.","return_or_deletion":"controller_choice","term":{"governing_law":"Belgian law, without reference to its conflict-of-laws rules.","jurisdiction":"Exclusive jurisdiction of the courts of Brussels."},"signatures":{"controller_signatory":"Isabelle Durand","controller_title":"Managing Director, Acme Supplies SRL","processor_signatory":"Jan van den Berg","processor_title":"Chief Operating Officer, Nimbus Cloud Services BV"}}