Legal information
Data processing agreement
Understand the customer-data processing covered by a Configurix DPA. Request the agreement and processing schedules for your deployment.
Updated:
This page explains the processing topics to address with Configurix. The binding data processing agreement identifies the actual customer and service provider, the agreed instructions and the deployment schedules. Arrange the applicable written agreement before personal data is processed on behalf of your business.
Your agreement and responsibilities
Where a customer determines why and how its personal data is used, it acts as controller. Where Configurix processes that data on the customer’s behalf, its processor responsibilities are defined by the applicable agreement and law. Roles depend on the actual processing.
The agreed DPA records the controller’s rights and obligations and the processor’s duties. It should be read with the service agreement and its processing schedules.
Service scope and duration
Configurix specializes in complex products and builds custom configurators and business software. A deployment may connect product selection and prices with quotes, CRM and lead qualification, calendars and appointments, materials/BOM, jobs, orders, invoicing or agreed integrations.
Document the functions and processing actually included, their purpose, the period of processing and the customer’s instructions. Use the following details to prepare the deployment schedule.
| Detail to agree | What to document |
|---|---|
| Service and purpose | The software features, processing operations and business purposes covered by the agreement. |
| Duration | The service period, processing period and arrangements when the service ends. |
| People and data | The people concerned and the personal-data fields actually used. |
| Systems and locations | Hosting, storage, access countries, subprocessors and connected systems. |
| Security and retention | Applicable technical and organisational measures, retention and deletion arrangements. |
| Instructions and contacts | Authorised instructions, responsible contacts and incident/request handling. |
People and personal data
The scope can include customer employees using the software, end customers, business contacts and project participants. Identify the applicable groups and fields in the agreement.
Product and commercial records come within the personal-data scope where they identify or relate to an identifiable person. Limit the data to what the agreed service needs.
- Contact and account details, such as name, work email, phone and project address
- Configuration, quote, appointment, order or invoice details linked to a person
- Messages, documents and support information containing personal data
- Technical records such as IP addresses, account activity and relevant logs
Instructions and confidentiality
Processing on behalf of the customer follows its documented instructions, including instructions concerning transfers, unless applicable law requires otherwise. Record who may give instructions and the process for handling an instruction that conflicts with data-protection law.
The agreement must address confidentiality for people authorised to process the data, access needed for their work and the controller’s ability to exercise its contractual rights.
Technical and organisational measures
Agree measures appropriate to the data, risks and architecture under Article 32 GDPR where applicable. Specify the controls and responsibilities for the actual deployment rather than assuming that every implementation has identical settings.
The security schedule should cover access control, encryption, backup and restoration, availability, monitoring, incident handling and review/testing as relevant. Request the applicable measures and evidence for your proposed service.
Subprocessors
Record the providers that process customer data, their tasks and the applicable authorisation procedure. Under Article 28 GDPR, engaging subprocessors requires the controller’s prior specific or general written authorisation; general authorisation includes advance notice and an opportunity to object to proposed changes.
The agreement must address equivalent data-protection duties for subprocessors and the processor’s responsibility for their performance. Ask for the provider list and change procedure relevant to your deployment.
Hosting and international transfers
Identify the storage locations and countries from which the data can be accessed. Locations depend on the agreed hosting, support and connected services; request the destinations for the actual deployment.
Where GDPR international-transfer rules apply, document the relevant transfer mechanism and safeguards, such as an applicable adequacy decision or contractual safeguards. These must fit the actual transfer; a provider name alone does not establish the arrangements.
Requests, incidents and assistance
The DPA must cover assistance with individual rights requests, security obligations, breach notifications and data-protection impact assessments where applicable, taking account of the processing and information available.
For a personal data breach affecting processing on the customer’s behalf, the processor must inform the controller without undue delay. Record incident contacts, escalation, information sharing and responsibilities in the agreement.
Return, deletion and retention
At the end of the service, the agreed arrangements must address return or deletion at the controller’s choice, including existing copies, unless applicable law requires storage. Define the format, timing and responsibilities.
Document any retention requirements and how backup copies are handled. Ask for the arrangements that apply to your customer data rather than assuming the website’s enquiry-record retention applies to your software deployment.
Information and audit rights
The DPA must provide for information needed to demonstrate the relevant processing obligations and for audits, including inspections, by the controller or an authorised auditor. Agree a practical process for requests and access.
Request the processing and security documentation relevant to your service and record the agreed review process.
Request the agreement
Use the regional or data-protection contact to request a signed DPA, discuss clauses or obtain the processing schedules for your service.
- Identify your company and the Configurix service or proposed project
- Describe the data, users, hosting requirements and systems to connect
- Ask for the relevant processing scope, security measures, providers and transfer details
Website visitors and enquiries
Processing for Configurix’s own website, business enquiries and administration is described in the website privacy policy. Optional website analytics choices are separate from the processing instructions in a customer DPA.