Data Processing Agreement (DPA)
UNPUBLISHED DRAFT · legal-review-2026-10-22 · Proposed contractual obligations for legal review, not certification of implemented measures. Not concluded through current registration. Open decisions: ../REVIEW-NOTES.md. Translations do not certify national compliance; no prevailing language has been designated.
D01. Parties and applicability
The business customer is identified in the individual contract as controller for the specific operations. Proposed processor: [ФИРМА], company identification number [ЕИК], [СЕДАЛИЩЕ И АДРЕС], represented by [ПРЕДСТАВИТЕЛ], VAT number [ДДС НОМЕР, АКО Е ПРИЛОЖИМО]; contact [КОНТАКТЕН ИМЕЙЛ], personal data [КОНТАКТ ЗА ЛИЧНИ ДАННИ]. The DPA covers only processing on instructions; independent purposes and any joint decisions are assessed separately. If the business is itself a processor, the authorisation chain must be documented before Crafterics is engaged.
D02. Annex A: processing description
The subject matter is provision of the selected SaaS modules. Operations include collection, recording, organisation, storage, access, alteration, disclosure to authorised persons, export and erasure. The purpose is performance of documented instructions for orders, reservations, staff, customer profiles, loyalty and service. Data subjects are the business's customers/guests, staff, representatives and users. Data include names, contacts, addresses, identifiers, roles, order/reservation history, points, vouchers, ratings and entered content. Frequency follows use of enabled modules. Duration follows the actual service and confirmed termination instructions without an invented calendar period. Special categories are not permitted by default; free-text notes and sector-specific issues require separate assessment.
D03. Instructions and lawfulness
The customer determines lawful purposes, bases, information to data subjects and staff access. The processor acts only on documented instructions, including transfers, unless applicable law requires otherwise; it then informs the customer beforehand if the law permits. It immediately informs the customer if it considers an instruction incompatible with data protection rules. It does not use entrusted data for its own marketing or other incompatible purposes.
D04. Confidentiality
Only authorised persons bound by confidentiality or a statutory obligation receive access. The proposed arrangements require task-based access, permission management and revocation when no longer necessary, including for support and external contractors.
D05. Annex B: technical and organisational measures
Before conclusion, a verifiable annex must be completed covering access control, authentication, business isolation, protection in transit/at rest, logging, vulnerability management, backups and recovery tests, erasure and incidents. Under Article 32, measures are risk-based and reviewed. This is a list to agree and substantiate, not a claim of existing encryption, certification, backup frequency or RTO/RPO. An incomplete annex blocks conclusion of this draft.
D06. Annex C: subprocessors
Specific or general written customer authorisation is required before engagement; the choice of regime and list remain to be confirmed. Under general authorisation, the processor informs the customer of planned changes and provides a real opportunity to object before engagement. The period and resolution of objections must be agreed. The register includes legal entity, service, data, countries, access and transfer basis. The same relevant obligations are imposed on the subprocessor; the initial processor remains liable to the customer for their performance. Twilio is not listed as an active subprocessor.
D07. Assistance with rights
Taking account of the nature of processing, the processor assists the controller through appropriate measures with data-subject requests. It forwards received requests and does not independently respond on the customer's behalf without instructions or a legal obligation. Secure channels and requester verification must be established; technical access, correction, portability and erasure operations must be confirmed before conclusion.
D08. Breaches and assessments
The processor notifies the controller without undue delay after becoming aware of a personal data breach, supplies available facts about its scope, consequences and measures, and supplements them in stages. It assists with Articles 32–36 in view of the processing's nature and the information available. The controller's statutory supervisory-notification deadline is not presented as a contractual 72-hour processor deadline. No additional numerical notification SLA is agreed.
D09. Audits and evidence
The processor supplies information necessary to demonstrate Article 28 compliance and allows and contributes to audits, including inspections by the controller or its authorised auditor. Coordination protects other people's data and security without neutralising audit rights. Costs and practical procedures require clarification; there is no pre-agreed fee restricting statutory assistance.
D10. Completion and return
At the controller's choice after services end, the processor returns or deletes the data and deletes existing copies unless retention is legally required. Return format, export window, handling of backups and certification must be agreed and technically verified. No unachievable periods or immediate removal from every copy are promised.
D11. International transfers
Hosting and remote-access countries have not been confirmed. Transfers require documented instructions and an applicable Chapter V GDPR mechanism, assessment and supplementary measures where needed. This DPA is not itself transfer standard contractual clauses under Decision 2021/914 and general acceptance does not create a transfer basis.
D12. Completion and effect
Signature requires completed parties and Annexes A–C, role allocation, communications procedures and expressly approved commercial terms. Mandatory GDPR duties are not postponed by these open decisions. The DPA version and acceptance evidence are stored separately from marketing consent and acknowledgement of a policy.