1. Scope
This Data Processing Agreement applies when Network, Telecom and Services, LLC ("Processor") processes personal data on behalf of a client ("Controller") while providing services or subscription solutions, in accordance with Article 28 GDPR and the LOPDGDD. It forms part of the service contract.
2. Processor obligations
Process personal data only on the Controller's documented instructions.
Ensure persons authorised to process the data are bound by confidentiality.
Implement the security measures required by Article 32 GDPR.
Assist the Controller in responding to data subject requests and in meeting its obligations under Articles 32–36 GDPR.
Notify the Controller of any personal data breach without undue delay and, where possible, within 48 hours.
3. Sub-processors
The Controller grants general authorisation to engage sub-processors (e.g. cloud hosting). The Processor will inform the Controller of any change, allowing objection, and will impose equivalent data protection obligations on them.
4. International transfers
Transfers to the USA or other third countries are carried out under the EU-US Data Privacy Framework or the Standard Contractual Clauses (Commission Decision 2021/914), with supplementary measures where needed.
5. Audits
The Processor will make available the information necessary to demonstrate compliance and allow audits by the Controller or an appointed auditor, with reasonable notice.
6. End of service
At the end of the service, the Processor will delete or return all personal data at the Controller's choice, unless retention is required by law.
7. Signature
A signed copy of this DPA, including the annex describing the data, purposes and security measures, is provided to every client before processing starts. Request it at info@netelcomservices.com.