Data processing agreement MarkBase

1. Processor processes personal data on behalf of Controller in order to provide the Service: the digital brand manual, asset library, templates, share links and AI brand checks.
2. This agreement runs for as long as Processor processes personal data for Controller, including the trial period and the export period after termination.

Controller does not put special categories of personal data (such as health data or national ID numbers) in the Service.

1. Processor only processes the data on Controller's written instructions. The Agreement and the use of the Service count as such an instruction.
2. Processor does not use the data for its own purposes, including to train AI models.
3. If Processor considers an instruction to be in breach of the GDPR, it reports this immediately.
4. If Processor is legally required to disclose data, it reports this in advance, unless the law prohibits doing so.

Everyone who has access to the data on behalf of Processor is bound by confidentiality.

Processor takes appropriate technical and organisational measures (art. 32 GDPR). These include at least: encryption in transit (TLS) and at rest, role-based access, regular backups, access logging and timely installation of security updates.

1. Controller gives general authorisation for the sub-processors in annex 1.
2. Processor announces a new or replacement sub-processor at least thirty (30) days in advance. Controller may object with reasons within that period. If the parties cannot agree, Controller may terminate the Agreement free of charge.
3. Processor imposes the same obligations on sub-processors as in this agreement and remains liable for them.
4. Transfers outside the EEA only take place with an appropriate safeguard, such as an adequacy decision (including the EU-US Data Privacy Framework) or standard contractual clauses.

1. Processor assists Controller with requests from data subjects (access, correction, deletion). Requests received directly by Processor are forwarded.
2. Processor assists with a DPIA or prior consultation of the supervisory authority, insofar as this can reasonably be asked of it.

1. Processor reports a personal data breach without undue delay, and no later than forty-eight (48) hours after discovery.
2. The notification includes at least: what happened, which data and data subjects are affected, the likely consequences and the measures taken or proposed.
3. Controller decides whether the breach is reported to the supervisory authority and to data subjects.

On request, Processor provides all information needed to demonstrate compliance. Controller may have an audit carried out by an independent expert at most once a year, with at least fourteen (14) days' notice and at its own expense.

After termination of the Agreement, Controller can export the data for thirty (30) days. Processor then deletes all personal data, including copies, unless the law requires retention. Backups are overwritten within ninety (90) days.

Article 13 of the General Terms and Conditions applies to liability. In the event of conflict, this data processing agreement prevails on matters of data protection.