Data processing agreement (DPA)

These templates follow the GDPR in general. They do not claim to satisfy the national law of every country. English is not a Member State. The competent authority is that of the controller’s main establishment (for example the CNIL in France, or the DPC for many controllers whose main establishment is in Ireland). Competence still follows the controller’s main establishment (GDPR Article 56).

Between the customer of the service, as controller (the Controller),

and Atelier Exemple, 10 rue de l'Exemple, 75002 Paris, France, contact@exemple-saas.example (the Processor).

This agreement applies when the Processor processes personal data on behalf of the Controller for the service at https://exemple-saas.example. It does not cover processing for which the provider is itself the controller.

1. Subject matter, nature, duration

The Processor hosts, stores and displays the data needed to provide the service, and generates the files the product generates. Duration: the contract, then deletion or return as in Article 8, unless a statute that applies to the Processor requires a longer archive.

2. Documented instructions

The Processor acts only on the Controller’s documented instructions, including this agreement, unless Union or Member State law requires otherwise. In that case the Processor informs the Controller before processing, unless the law prohibits the information.

3. Confidentiality

Persons authorised to process the data are under a confidentiality duty.

4. Security

The provider implements technical and organisational measures that are appropriate under GDPR Article 32 (access control, HTTPS, minimisation, professional providers), without promising that residual risk is gone. No ISO 27001 or SOC 2 box was ticked: neither certification is claimed.

5. Sub-processors

The Controller authorises the sub-processors in Annex 3. The Processor informs the Controller before adding or replacing one. The Controller may object within 30 days. If the objection is not resolved, the Controller may stop the affected processing.

6. Assistance

The Processor assists the Controller, as far as possible, with data-subject requests, security, breach notices, and impact assessments, taking into account the nature of the processing.

7. Breach

The Processor notifies the Controller of a personal-data breach without undue delay after becoming aware of it. The template does not invent a fixed number of hours.

8. Deletion and return

At the end of the service the Processor deletes or returns the data, at the Controller’s choice, and deletes remaining copies unless the law requires storage.

9. Audits

The Controller may audit, including by a mandated reviewer bound by confidentiality, on reasonable notice, no more often than once a year unless there is a breach or a request from an authority. The Processor may refuse a reviewer who is a competitor.

10. Transfers

Transfers outside the EU/EEA use a mechanism of GDPR Chapter V. Annex 3 repeats what the vendor publishes. It does not add a mechanism the sheet marks as not disclosed.

11. Liability

Article 82 GDPR applies toward data subjects. The contract does not shift a party’s own fine onto the other party. No national fixed indemnity is added.

Annex 1 — Description

• Subject: the service at https://exemple-saas.example.
• Operations: hosting, authentication where used, storage, file generation, support, logs.
• People: the Controller’s users and the Controller’s staff. Categories beyond that are not disclosed by this template.

Annex 2 — Security

The provider implements technical and organisational measures that are appropriate under GDPR Article 32 (access control, HTTPS, minimisation, professional providers), without promising that residual risk is gone. No ISO 27001 or SOC 2 box was ticked: neither certification is claimed.

Annex 3 — Authorised sub-processors

1. Scaleway, S.A.S. (Scaleway) — European Union — Cloud (compute, storage, databases). The DPA covers data uploaded to a service ordered through the account. A more detailed list is not published. The DPA (1 June 2024) says services are located in the European Union by default. Scaleway is not registered under the Data Privacy Framework.

1. Stripe Payments Europe, Limited (Stripe) — Ireland (Stripe, Inc. group, United States) — Payment and invoicing. Payment data, transaction identifiers, billing email. The provider does not store full card numbers. Stripe Payments Europe acts as controller or processor depending on the flow; intra-group transfers are covered by SCCs.

1. Resend, Inc. (Resend) — United States — Transactional email. Recipient email addresses, subject and body of messages, sending logs. Transfer outside the EU covered by SCCs.

1. Plausible Insights OÜ (Plausible) — Estonia — Cookie-free audience measurement. Aggregated page views, approximate country, user agent, referrer. No advertising cookie. Processing in the EU (Estonia). Check the hosting selected on your account.

Notice. This file is a template generated by StackLégal from the information you entered. It is not legal advice and not a certificate of compliance. Review it, adapt it to your actual activity and, if the stakes are high (health, finance, children, sensitive data, enterprise customers), have a lawyer read it.

Template dated 6 October 2026. Structure only: Regulation (EU) 2016/679, in particular Articles 12 to 14, 28, 32 and 82; Directive 2011/83/EU on withdrawal where a consumer is involved; Regulation (EU) 2022/2065 (DSA) if users publish content. No national statute is cited as if it applied everywhere.

Template filled for: Atelier Exemple — https://exemple-saas.example