Data Processing Agreement (DPA)
What the Article 28 GDPR agreement covers and how to get a copy.
What this is about
When you use Hunzi, we process personal data on your behalf and on your instructions: your guests' messages, what they tell the agent, and the logs that result. Article 28 GDPR requires a contract for exactly that arrangement, between you as the controller and us as the processor. That contract is the DPA (in German, Auftragsverarbeitungsvertrag).
You remain the controller. We process the data solely to operate the service you have subscribed to.
What the agreement covers
- Subject matter, duration and purpose of the processing.
- Types of data and categories of data subjects.
- Processing only on your documented instructions.
- Confidentiality of the people involved.
- Technical and organisational measures under Article 32 GDPR.
- Sub-processors: the current list, our duty to inform you before any change, and your right to object.
- Assistance with data-subject rights, data protection impact assessments and breach notification.
- Deletion or return of the data when the contract ends.
- Evidence and audits.
Processing in the EU
Processing and storage take place in the EU. The complete, current list of sub-processors with service, region and purpose forms part of the DPA and is provided together with it. We announce changes in advance so that you can object.
Requesting the DPA
We provide the DPA executed for your company before the contract starts, usually together with the quote. Send us a note through the contact form and we will forward it.
For privacy questions, write to [email protected].
Related documents
- Privacy notice: what we process, why, and what rights you have.
- Cookie and device-storage notice: what is stored in the browser.
- Terms: the conditions under which we provide Hunzi.