Get Free Consultant + 10% Off!
GDPR Data Processing Addendum (DPA)
This Data Processing Addendum (DPA) outlines how StedyDesk (“Processor”) complies with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) when handling personal data on behalf of our clients (“Controllers”).
1. Purpose
This DPA supplements any existing service agreements and governs the processing of personal data of individuals located in the EU/EEA.
2. Scope of Processing
Nature of Processing: Accounting, billing, data entry, and administrative support services
Categories of Data Subjects: Employees, customers, and patients (for healthcare-related services)
Types of Personal Data: Names, contact information, financial details, and medical records (where applicable)
Duration: For the duration of the engagement or as required by applicable law
3. Obligations of Processor (Stedy Desk)
- Process personal data only under documented instructions from the Controller
- Implement appropriate technical and organizational security measures (e.g., encryption, access controls)
- Ensure all personnel are trained and bound by confidentiality agreements
- Assist Controllers in fulfilling data subject rights, including access, rectification, and deletion
- Promptly notify the Controller of any personal data breaches
- Cooperate with supervisory authorities where legally required
4. Subprocessors
Stedy Desk will not appoint subprocessors without prior notice and will ensure any subprocessors are fully GDPR-compliant.
5. International Transfers
In the event that personal data is transferred outside the EEA, such transfers will be safeguarded through the use of Standard Contractual Clauses or other approved mechanisms.
6. Termination and Deletion
Upon termination of services, Stedy Desk will return or securely delete all personal data unless retention is required by applicable law or regulation.
7. Governing Law
This Addendum is governed by the laws of the European Union and the jurisdiction of the applicable supervisory authority.