Data Processing Agreement

This Data Processing Agreement (DPA) is a template you can request and (after legal review) sign as an addendum to your Manisma subscription, in line with Article 28 of the General Data Protection Regulation (GDPR).

1. Parties

This agreement is entered into between the customer (your company, the data controller) and Manisma (the processor), as an addendum to the main agreement (the terms of service) the customer entered into when subscribing.

2. Subject matter & duration

Manisma processes personal data on the customer's behalf for the sole purpose of delivering the Manisma planning service. This agreement runs for as long as the underlying subscription is active, and ends automatically upon its termination (subject to the retention period in the privacy policy).

3. Nature & purpose of the processing

The processing consists of storing, displaying, editing and sending data needed to schedule appointments, direct technicians, generate work orders, let clients approve slots and send related email notifications through the Manisma application and its automation service.

4. Types of personal data & categories of data subjects

• Data subjects: the customer's own clients (end-clients), contacts at those end-clients, and the customer's technicians/staff.
• Data: name, address, phone number, email address, job data, location data, photos and signatures on completed work. No special categories of personal data (e.g. health or biometric data) are intentionally processed.

5. Processor obligations (Art. 28 GDPR)

• Processes personal data only on the customer's documented instructions.
• Ensures persons with access to the data are bound by confidentiality.
• Implements appropriate technical and organizational security measures (Art. 32 GDPR). See "Security" in the privacy policy.
• Does not engage subprocessors without the customer's prior general or specific authorization, and informs the customer of changes (see the subprocessor list below).
• Assists the customer in responding to data subject requests (access, rectification, erasure, etc.).
• Notifies the customer of a (suspected) data breach without undue delay, so the customer can meet its own notification obligations.
• Deletes or returns all personal data after the service ends, per the retention period in the privacy policy, unless the law requires further storage.
• Makes available the information necessary to demonstrate compliance with this agreement, and allows audits within reasonable limits.

6. Subprocessor list

The current list of subprocessors, with name, purpose, location and what data they receive, is on the privacy policy (§4). The customer is informed in advance of any new subprocessor and may object.

7. International transfers

Where a subprocessor processes data outside the EU (see §6), this relies on the European Commission's Standard Contractual Clauses (SCCs) or an equivalent recognized transfer mechanism.

8. Requesting this agreement

Want a signed data processing agreement as an addendum to your subscription? Get in touch at hello@manisma.com. We will send you a finalized, legally-reviewed version.