DATA PROCESSING AGREEMENT
Pursuant to Article 28, EU General Data Protection Regulation (GDPR)

This template is provided for convenience and is not legal advice. Review with qualified counsel before signing.

PARTIES

Between:

[CONTROLLER NAME]
[CONTROLLER ADDRESS]
[CONTROLLER REGISTRATION NUMBER (if applicable)]
("the Controller")

and

[PROCESSOR NAME]
[PROCESSOR ADDRESS]
[PROCESSOR REGISTRATION NUMBER (if applicable)]
("the Processor")

Together referred to as "the Parties".

1. SUBJECT MATTER AND DURATION

1.1 The Processor will process personal data on behalf of the Controller in connection with:

[DESCRIBE THE SERVICE, e.g. "the collection and management of business contact details using the CardScan scanning service"]

1.2 This Agreement commences on [START DATE] and continues until [END DATE] or until the termination of the main services agreement between the Parties, whichever is earlier.

2. NATURE AND PURPOSE OF PROCESSING

The Processor will process personal data for the following purpose(s):

[DESCRIBE, e.g. "Scanning physical business cards presented to the Processor's personnel, extracting the contact details printed on those cards, and forwarding those details to the Controller's designated CRM or data systems."]

3. CATEGORIES OF PERSONAL DATA

The Processor will process the following categories of personal data:

- Full name (first name, last name)
- Job title
- Employer / company name
- Business email address
- Business telephone / mobile number
- Business postal address
- Website URL
- Notes and tags added by the Processor's personnel at the point of scanning
- [OTHER CATEGORIES]

4. CATEGORIES OF DATA SUBJECTS

The personal data relates to the following categories of individuals:

- Business contacts whose cards are scanned by the Processor
- Prospective customers or partners
- Event attendees
- [OTHER]

5. OBLIGATIONS OF THE PROCESSOR

The Processor shall:

(a) Process personal data only on documented instructions from the Controller, including with regard to transfers outside the EU/EEA, unless required to do so by EU or Member State law;

(b) Ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

(c) Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR;

(d) Respect the conditions for engaging sub-processors set out in clause 6;

(e) Taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures in fulfilling its obligations to respond to requests from data subjects exercising their rights under the GDPR;

(f) Assist the Controller in ensuring compliance with its obligations under Articles 32-36 GDPR (security, breach notification, data protection impact assessments, prior consultation);

(g) At the choice of the Controller, delete or return all personal data to the Controller on termination of the services, and delete existing copies unless EU or Member State law requires storage of the data;

(h) Make available to the Controller all information necessary to demonstrate compliance with this clause, and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

6. SUB-PROCESSORS

6.1 The Controller grants general authorisation for the Processor to engage the following sub-processors:

- CardScan / Nörtti Paikalle Oy (Finland) — card scanning platform
- Anthropic, PBC (United States) — AI-based text extraction from card images
- Stripe, Inc. (United States / Ireland) — payment processing
- [ADD YOUR OWN: e.g. Zapier Inc. (US) — automation routing; HubSpot, Inc. (US) — CRM; etc.]

6.2 The Processor shall notify the Controller of any intended changes concerning the addition or replacement of sub-processors, thereby giving the Controller the opportunity to object to such changes.

6.3 Where the Processor engages a sub-processor, it shall impose the same data protection obligations as set out in this Agreement on that sub-processor.

7. INTERNATIONAL TRANSFERS

7.1 Where personal data is transferred to a country outside the EU/EEA that does not benefit from an adequacy decision, the Processor shall ensure that an appropriate transfer mechanism is in place, such as Standard Contractual Clauses (SCCs) adopted by the European Commission.

7.2 Current international transfers and the mechanisms relied upon:

- Anthropic, PBC (United States): [SCCs via Anthropic's Data Processing Addendum / adequacy decision / other]
- [OTHER DESTINATION]: [MECHANISM]

8. PERSONAL DATA BREACH

The Processor shall notify the Controller without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting the Controller's personal data. The notification shall include, to the extent possible, the information listed in Article 33(3) GDPR.

9. AUDITS AND INSPECTION

9.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with this Agreement.

9.2 The Controller may conduct audits, including inspections, on reasonable prior written notice. Audits shall be conducted no more than once per calendar year unless required by a supervisory authority or following a data breach.

10. LIABILITY AND INDEMNIFICATION

[DEFER TO MAIN SERVICES AGREEMENT, or insert specific liability provisions here.]

11. TERMINATION AND DATA RETURN

On termination of the services for any reason, the Processor shall, at the election of the Controller:

(a) Return to the Controller all personal data processed under this Agreement; or
(b) Delete all such personal data and confirm deletion in writing;

unless EU or Member State law requires continued retention of the data.

12. GOVERNING LAW AND JURISDICTION

This Agreement is governed by the laws of [COUNTRY / e.g. Finland]. Any dispute arising out of or in connection with this Agreement shall be subject to the exclusive jurisdiction of the courts of [JURISDICTION].

13. ENTIRE AGREEMENT

This Agreement constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior agreements, understandings, and communications relating to data processing.

SIGNATURES

For the Controller:

Signed: ___________________________
Name:   [NAME]
Title:  [TITLE]
Date:   [DATE]

For the Processor:

Signed: ___________________________
Name:   [NAME]
Title:  [TITLE]
Date:   [DATE]

This template is provided for convenience only and does not constitute legal advice. It should be reviewed and adapted by qualified legal counsel before use. Nörtti Paikalle Oy accepts no liability for its use.