# Data processing agreement | DameDoklad

> Draft data processing agreement under Article 28 GDPR. Awaiting legal review.

Source: https://damedoklad.cz/en/dpa/

1.  [Home](/en/)
2.  Data processing agreement

Legal documents

-   [Terms](/en/terms/)
-   [Privacy](/en/privacy/)
-   [Cookies](/en/cookies/)
-   [Data processing agreement](/en/dpa/)

Draft, awaiting legal review

This text is a working draft that has not been reviewed by a lawyer and is not binding. The approved wording will replace it before sales open.

# Data processing agreement

Last updated 30 October 2026

This draft summarizes what the data processing agreement should contain. A lawyer will fill in the details in square brackets together with the operator.

## Parties and subject

The customer is the **controller** of the personal data they enter in DameDoklad, such as data on customers, suppliers and employees. The operator \[company name, ID number, registered office\] is the **processor**.

## Purpose and scope

The processor processes data only to provide the service and on the controller’s instructions. Types of data and categories of data subjects: \[to add\].

## Processor’s duties

-   Process data only on the controller’s documented instructions.
-   Ensure confidentiality of the people working with the data.
-   Take technical and organizational measures; see the [Security](/en/security/) page.
-   Help the controller with data subject requests and with security.
-   Report security breaches without undue delay.
-   Delete or return data when the service ends, unless the law requires otherwise.

## Subprocessors

\[To add the list of subprocessors, processing locations and the process for changes.\]

## Audit

\[To add: how the controller can verify the duties are met.\]