If Selva Digital processes personal data on behalf of the Client in the performance of the agreement, the terms below apply in addition to the General Terms and Conditions. The applicability of the Client’s own processing agreements is expressly rejected.

In this agreement, the Client is the Controller and Selva Digital is the Processor. Where the Client itself acts as a processor for its own customers, Selva Digital acts as Sub-Processor and the provisions of this agreement apply accordingly.

Recitals

The Controller has instructed the Processor to process personal data in the performance of the Main Agreement. The Processor accepts this instruction and will not process the data for its own purposes. The Controller is responsible for the processing within the meaning of the General Data Protection Regulation (GDPR). The Parties wish to record their mutual rights and obligations regarding the processing of personal data.

Definitions

GDPR: Regulation (EU) 2016/679, as implemented in applicable national law. Controller: the party that determines the purposes and means of the processing (art. 4(7) GDPR) – in this agreement: the Client. Processor: the party that processes personal data on behalf of the Controller (art. 4(8) GDPR) – in this agreement: Selva Digital. Sub-Processor: another processor engaged by the Processor. Data Subject: the person to whom the personal data relates. Personal Data Breach: a breach of security as referred to in art. 4(12) GDPR. Main Agreement: the agreement(s) between the Parties to which this Processor Agreement relates. Processing: any operation performed on personal data as referred to in art. 4(2) GDPR.

Article 1 – Purpose and scope of processing

1.1 The Processor processes personal data solely on the documented instructions of the Controller and solely in the context of the performance of the Main Agreement.

1.2 The Processor shall not process the personal data for any other purpose. The Controller determines the purposes and means of the processing and shall inform the Processor of processing purposes insofar as these are not already described in this agreement.

1.3 Categories of data subjects: the Client’s (potential) customers, business partners, employees, website visitors, newsletter recipients, users of e-mail environments provided by the Processor, and other persons whose personal data is processed through the services.

1.4 Categories of personal data: name and contact details, e-mail addresses, location and login data, IP addresses, customer and communication data, and other categories arising from the services under the Main Agreement.

1.5 Personal data processed on behalf of the Controller remains the property of the Controller or the relevant data subjects.

Article 2 – Term

2.1 This agreement enters into force upon conclusion of the Main Agreement and applies for its duration. It ends by operation of law when the Main Agreement ends.

2.2 Amendments are valid only if agreed in writing between the Parties.

2.3 Upon termination, the Processor shall, at the Controller’s choice, delete or return all personal data, unless retention is required by law. Obligations regarding confidentiality, liability and dispute resolution survive termination.

Article 3 – Obligations of the Processor

3.1 The Processor complies with the requirements applicable to processors under the GDPR.

3.2 The Processor shall not enrich its own databases with personal data obtained from the Controller. Temporary files created for proper processing are deleted as soon as they are no longer necessary.

3.3 The Processor shall follow reasonable written instructions of the Controller regarding the processing, unless these conflict with the GDPR or other applicable law, in which case the Processor shall inform the Controller without delay.

3.4 The Processor shall, on request, inform the Controller of the measures it has taken under this agreement.

3.5 All obligations of the Processor also apply to persons processing personal data under its authority, including employees and engaged third parties.

3.6 The Controller has access at all times to the personal data stored on its behalf.

Article 4 – Sub-Processors

4.1 The Controller grants the Processor general written authorisation to engage Sub-Processors. The Sub-Processors engaged at the time of signing are listed in Annex 1.

4.2 The Processor shall inform the Controller in writing (e-mail suffices) of any intended addition or replacement of Sub-Processors at least 30 days before deployment. The Controller may object within this period on reasonable, substantiated grounds. In the event of an objection, the Parties shall consult on a solution; if none is found, the Controller may terminate the affected part of the service.

4.3 The Processor imposes on each Sub-Processor, by written agreement, data protection obligations at least equivalent to those in this agreement, and remains fully liable to the Controller for the performance of the Sub-Processor’s obligations.

4.4 Where the Processor uses providers of artificial intelligence services as Sub-Processors, the Processor ensures that (i) a data processing agreement is in place with the provider, (ii) personal data submitted is not used by the provider to train its models, and (iii) transfers outside the EEA take place only under Article 5.

Article 5 – International transfers

5.1 Processing takes place within the European Economic Area where reasonably possible. Transfers to countries outside the EEA occur only where a valid transfer mechanism under Chapter V GDPR applies: an adequacy decision (including the EU-US Data Privacy Framework where applicable) or Standard Contractual Clauses with supplementary measures where required.

5.2 The countries of processing per Sub-Processor are listed in Annex 1. The Processor keeps this annex up to date and informs the Controller of changes in accordance with Article 4.2.

Article 6 – Security

6.1 The Processor implements appropriate technical and organisational measures as referred to in art. 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks for data subjects.

6.2 The Controller is responsible for ensuring that persons acting under its authority access the services only in accordance with this agreement.

Article 7 – Personal data breaches

7.1 The Processor shall inform the Controller of a Personal Data Breach without undue delay and where possible within 24 hours of becoming aware of it, providing at least: the nature of the breach, the categories and approximate numbers of data subjects and records concerned, a contact point, the likely consequences, and the measures taken or proposed.

7.2 The Controller is responsible for any notification to the supervisory authority (within 72 hours) and to data subjects. The Processor shall provide reasonable assistance.

7.3 Both Parties keep a register of data breaches in accordance with art. 33(5) GDPR. The Processor shall take appropriate measures at its own expense to prevent recurrence of breaches occurring within its domain.

Article 8 – Confidentiality

The Processor, its employees and engaged third parties shall keep all personal data and confidential information obtained under this agreement confidential, except with the Controller’s prior written consent or where disclosure is required by law. This obligation survives termination.

Article 9 – Rights of data subjects

9.1 The Processor forwards requests from data subjects to the Controller without delay and in any event within 7 working days, and provides reasonable cooperation in handling them. Reasonable costs are borne by the Controller.

9.2 This applies to all data subject rights under Chapter III GDPR, including access, rectification, erasure, restriction, portability and objection.

Article 10 – Audit

10.1 The Controller may have compliance with this agreement verified by an independent expert, no more than once a year and announced at least six weeks in advance, where existing reports of the Processor provide insufficient clarity.

10.2 The Processor shall cooperate and provide relevant information within 14 calendar days of the request. The findings shall be discussed by the Parties. Costs of the audit are borne by the Controller; costs of remedial measures are allocated according to responsibility.

Article 11 – Liability and indemnification

11.1 The Controller remains ultimately responsible for the lawfulness of the processing and warrants that its instructions do not infringe the GDPR or rights of third parties.

11.2 The Processor is liable only for damage caused by processing in which it failed to comply with obligations of the GDPR specifically directed at processors, or acted outside or contrary to the lawful instructions of the Controller. Liability is limited to the invoice value (excluding VAT) of the past 12 months under the Main Agreement. The Processor is not liable for indirect damage, including consequential damage, loss of profit, missed savings, reduced goodwill and business interruption.

11.3 Each Party indemnifies the other against fines and claims to the extent the underlying breach is attributable to that Party.

Article 12 – Governing law and disputes

12.1 This agreement is governed by Spanish law. Disputes shall be submitted to the competent court of the district in which the Processor has its registered office.

Annex 1 – Sub-Processors

Current Sub-Processors of Selva Digital. [Complete and verify before publication.]

Note: locally installed or self-hosted software (e.g. Apple Mail as mail client, self-hosted WordPress and the Elementor page builder plugin) does not process personal data on Selva Digital’s behalf and is therefore not a Sub-Processor; the relevant hosting provider is. Consumer versions of AI tools without a data processing agreement are not used for personal data and are not Sub-Processors.

Key corrections vs. version 2022.01, for the reviewing lawyer: consistent Controller/Processor terminology throughout (the 2022 English text swapped roles in several places, incl. the preamble and art. 3.4); new sub-processor regime with annex, 30-day notification and right to object (art. 28(2) GDPR); transfer clause aligned with Chapter V GDPR incl. DPF; AI providers explicitly covered as sub-processors with a no-training guarantee; termination and instruction clauses normalised.