Data processing agreement (DPA)
A draft document structure. Legal wording, company details and jurisdiction are marked [LAWYER: review] and must be approved by a lawyer before sign-up opens.
Draft version dated 2026-10-17
This agreement applies when a customer company enters its own clients' personal data into ImportOS. The customer is the controller and ImportOS acts as the processor. [LAWYER: review compliance with GDPR Art. 28 and Ukrainian law.]
1. Subject matter and duration
Processing takes place to provide the service for the duration of the subscription. [LAWYER: clarify.]
2. Categories of data and data subjects
- Contact details of the company's clients (name, phone, email, messengers).
- ID document data the company uploads to complete deals.
- Data about deals, payments and car delivery.
3. Security measures
- Isolation of each tenant's data at the database level (row-level security).
- Encryption of sensitive ID document data at the database level.
- An access log for sensitive data.
- Files are served through signed links with a limited lifetime (15 minutes).
- [LAWYER/owner: confirm the actual state of each measure at the time of signing.]
4. Subprocessors
The list of subprocessors and the procedure for notifying changes to it: [LAWYER/owner: complete before sign-up opens].
5. Security incidents
[LAWYER: the deadline and procedure for notifying the customer of a data breach.]
6. Return and deletion of data
After the agreement ends the customer may export its data; deletion takes place within the periods in the privacy policy. [LAWYER: clarify.]
7. Transfers outside the EU/EEA
[LAWYER: the transfer mechanism (standard contractual clauses, etc.).]