Data Processing Agreement

Version [1.0] · Effective [DATE] · Between [CUSTOMER] (“Controller”) and [COMPANY] (“Processor”)

1. Subject, duration, nature and purpose

The Processor processes personal data only to provide WeDraw to the Controller under the [Terms / Order Form], for the term of that agreement.

2. Categories of data and data subjects

Account data (name, email), content the Controller's users create (boards, comments), usage and security logs. Data subjects: the Controller's users and guests. [Confirm: no special-category data is expected.]

3. Processor obligations (art. 28(3))

• Process only on documented instructions; inform the Controller if an instruction infringes the law.
• Confidentiality of everyone authorised to process.
• Security measures: see Annex II and the security page.
• Sub-processors: only those listed on the sub-processor page; [N] days' notice of changes, with a right to object.
• Assistance with data-subject requests (the app's data export and account deletion), security, breach notification ([N] hours) and impact assessments.
• Deletion or return of data at the end of the service, within [N] days.
• Audits: information and [audit rights and frequency].

4. International transfers

[Data location; the transfer mechanism (EU SCCs module 2/3, UK addendum) where applicable.]

Annex I — Parties and processing

[Contact details, roles, processing details.]

Annex II — Technical and organisational measures

[Encryption, access control, row-level security per workspace, backups, logging, incident response — matching the actual deployment.]

Annex III — Sub-processors

See the sub-processor list.

Signature

[Signature blocks, or acceptance by order form / click-through as counsel advises.]