Data processing agreement

Version 0.1 (draft) · part of the terms of service

This agreement applies when [Company AS] ("the processor") processes personal data on behalf of the customer ("the controller") in Sats, as required by GDPR art. 28.

1. Subject and duration

The processor produces documents from templates and data the controller sends, and stores the controller's templates and assets, for as long as the customer agreement lasts.

2. Nature of the processing

• Data sent for rendering is processed in memory to produce the document and is not stored. Rendered PDFs are returned in the response and not stored.
• Templates and assets (fonts, images, PDFs) are stored until the controller deletes them or the agreement ends.
• Render metadata (time, template, pages, size, warnings; no content) is kept for the workspace's retention period, by default 24 hours. Monthly counts of documents are kept for billing.

3. Categories of data and data subjects

Determined by the controller: whatever personal data its templates and render requests contain, typically names, addresses and order or customer details of the controller's own customers and employees. The controller must not send special categories of data (art. 9) unless it has assessed that this is lawful and secure.

4. Processor obligations

The processor shall:

• process personal data only on documented instructions from the controller, which are this agreement and the controller's use of the service;
• ensure that people with access are bound by confidentiality;
• implement the security measures in section 6;
• use sub-processors only as in section 5;
• help the controller respond to requests from data subjects and with impact assessments, as far as the nature of the processing allows;
• notify the controller without undue delay, and within 48 hours, after becoming aware of a personal data breach;
• delete or return all personal data when the agreement ends, within 30 days, unless law requires storage;
• make available the information needed to demonstrate compliance and allow audits, at the controller's cost and with reasonable notice.

5. Sub-processors

The controller gives general authorisation to the sub-processors listed at /subprocessors. The processor announces new sub-processors by e-mail at least 30 days in advance; the controller may object and, if no solution is found, terminate the agreement.

6. Security measures

• Hosting in data centres in the EU; encrypted connections (TLS) for all traffic.
• Rendered documents and rendering data are not written to disk or storage.
• Every database query is scoped to one workspace; isolation is covered by automated tests.
• Passwords hashed with Argon2, API keys hashed with a server-side secret; keys can be revoked.
• Remote images and PDFs are fetched only over HTTPS and never from internal networks.
• Logs contain ids, counts and durations, never document content or request data.
• Daily encrypted database backups kept for 30 days, with regular restore tests.

7. Transfers

Personal data is stored in the EU. Transfers outside the EEA happen only to sub-processors with a valid transfer mechanism (standard contractual clauses or an adequacy decision).

8. Law

Norwegian law applies, with the venue in the terms of service.