Last Updated: May 12, 2005
1. Introduction
This Data Processing Agreement (“DPA”) is incorporated into our Terms of Service with you, the Client (“Data Controller”), and governs how Despertare Agile Solutions processes personal data on your behalf in compliance with the GDPR, Spain’s LOPDGDD, and other applicable laws.
2. Definitions
- Data Controller: The client who determines the purposes and means of processing personal data.
- Data Processor: Despertare Agile Solutions, which processes personal data on behalf of the Data Controller.
- Personal Data: Any information relating to an identifiable individual.
- Processing: Any operation performed on personal data (e.g., collection, storage, use, transfer).
1. Scope & Purpose
We process personal data solely to:
- Deliver our consulting services.
- Facilitate communication and billing.
- Comply with contractual and legal obligations.
4. Processor Obligations
We commit to:
- Process personal data only based on your documented instructions.
- Ensure that all personnel with access to the data are bound by confidentiality obligations.
- Implement technical and organizational security measures (e.g., encryption, multi‑factor authentication, and regular assessments).
- Assist you in handling data subject requests within 30 days.
- Notify you and, if applicable, Spain’s AEPD within 72 hours of discovering any personal data breach.
- Delete or return all personal data upon termination, unless retention is legally mandated.
5. Subprocessors & International Transfers
- Subprocessors: We may engage subprocessors only with your prior written approval. All subprocessors are bound by data protection obligations at least as protective as those in this DPA.
- International Transfers: Personal data transferred outside the EEA is done so only with appropriate safeguards, by utilizing the EU Commission’s 2021 Standard Contractual Clauses along with supplementary measures (e.g., AES‑256 encryption, pseudonymization) and TIAs.
6. Audit Rights & Data Retention
- Audit Rights: You have the right to audit our data processing practices with reasonable notice (minimum 14 days) and minimal disruption.
- Data Retention: We retain personal data only as long as necessary to provide our services or to comply with legal obligations, as specified in our Privacy Policy.
7. Termination & Amendments
- Termination: Upon termination, we shall securely delete or return all personal data as instructed, subject to any legal retention requirements.
- Amendments: This DPA may be amended to reflect changes in data protection laws, with significant modifications communicated to you.
8. Governing Law & Contact
This DPA is governed by Spanish law. For any data processing inquiries or requests under this DPA, please use our secure online contact form:
