Brisa Works

Data processing agreement (template)

Between the customer (the controller) and Brisa Works, Spain (the processor), under article 28 GDPR. It applies automatically when the customer uses a tool that processes personal data on its behalf; a signed copy is available on request at support@brisaworks.com.

  1. Subject and duration. Processing of the data described in the tool's row of the privacy policy, for as long as the tool is installed, plus up to 30 days for deletion.
  2. Nature and purpose. Only to provide the tool's functions the customer triggers; no other purpose.
  3. Categories. As listed per tool (e.g. email metadata and content, page content, order and address data). Data subjects: the customer's users, contacts and customers.
  4. Instructions. The processor acts only on the customer's documented instructions (the tool's configuration and actions), unless law requires otherwise, and informs the customer if an instruction seems unlawful.
  5. Confidentiality. Only the processor, bound by confidentiality, has access. Support access to content happens only with the customer's explicit permission for a specific ticket.
  6. Security (art. 32). As described on the security page: encryption in transit, minimal storage, least-privilege scopes, secrets in managed storage, dependency updates.
  7. Sub-processors. The list in the privacy policy (Cloudflare; Anthropic where a tool uses AI). The customer authorises them generally; we give 30 days' notice of changes, during which the customer may object and cancel.
  8. Assistance. We help with data-subject requests, breach notification (without undue delay, and within 48 hours of becoming aware) and DPIAs, as far as the tool's data allows.
  9. Deletion and return. On uninstall or request, we delete stored personal data within 30 days, except where the law requires retention.
  10. Audits. We provide the information needed to demonstrate compliance; on-site audits at the customer's cost with reasonable notice.
  11. Transfers. Outside the EEA only under the EU-US Data Privacy Framework or Standard Contractual Clauses.