This Data Processing Agreement (“DPA”) forms part of the service agreement between East Star Commerce (“East Star”) and the client (“Client”) where East Star processes personal data on the Client’s behalf.
1. Scope and Responsibilities
The Client acts as Controller and East Star as Processor where these roles apply under applicable data protection law.
The Client is responsible for ensuring that personal data may lawfully be processed and that its instructions comply with applicable law.
East Star will process personal data only on the Client’s documented instructions, to provide the agreed services or where legally required.
East Star will notify the Client if it believes an instruction breaches applicable data protection law.
2. Confidentiality and Security
East Star will ensure that authorised personnel are subject to confidentiality obligations and will implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.
Access will be limited to what is reasonably necessary to provide the agreed services. Security measures will reflect the nature of the processing, applicable risks and relevant legal requirements.
3. Subprocessors
East Star may engage subprocessors where reasonably necessary to provide the agreed services, subject to applicable law.
It will ensure that appropriate written data protection obligations apply to them and provide relevant subprocessor information upon reasonable request.
East Star will remain responsible for its subprocessors to the extent required by applicable law. Material changes to subprocessors will be communicated and handled in accordance with applicable legal requirements and any agreed notification procedure.
4. Data Subject Requests and Compliance Assistance
East Star will provide reasonable assistance with data subject requests, data protection impact assessments and regulatory obligations, taking into account the nature of the processing and information available.
If East Star receives a request relating to personal data processed on the Client’s behalf, it will refer the request to the Client unless legally required to respond directly.
5. Personal Data Breaches
East Star will notify the Client without undue delay after becoming aware of a personal data breach affecting data processed under this DPA.
It will provide reasonably available information and cooperate with the Client’s investigation and required notifications.
The Client remains responsible for its own regulatory notifications unless applicable law provides otherwise.
6. International Data Transfers
East Star will ensure that international transfers of personal data comply with applicable data protection law. Where required, the parties will implement appropriate transfer mechanisms and safeguards before the transfer takes place.
7. Data Return and Deletion
When the relevant services end, East Star will, at the Client’s choice and subject to applicable law, return or delete personal data processed on the Client’s behalf.
East Star may retain data where legally required or otherwise permitted by law. Any retained data will remain subject to applicable data protection obligations.
8. Audits and Liability
East Star will provide reasonable information to demonstrate compliance with this DPA.
Where required by applicable law, it will cooperate with proportionate audits, subject to reasonable notice, confidentiality, security and the protection of other clients’ information.
Liability under this DPA will be governed by the applicable service agreement, subject to mandatory legal requirements.
If this DPA conflicts with the service agreement regarding personal data processing, this DPA will prevail unless the parties lawfully agree otherwise in writing.
9. Term, Governing Law and Contact
This DPA takes effect with the relevant service agreement and remains in force for as long as East Star processes personal data on the Client’s behalf. Obligations that must survive termination will continue as required by law or this DPA.
Contact details
Legal entity: East Star Commerce
Address: (add)
Email: (add)
10. Processing Details
The following details should be confirmed for the relevant engagement:
- Subject matter and purpose: Processing personal data as necessary to provide the agreed services.
- Duration: The service agreement term and any necessary period for return, deletion or lawful retention.
- Data subjects: Client personnel, authorised account users, business contacts or other individuals whose data is provided.
- Personal data: Names, business contact details, account identifiers and other personal data contained in authorised systems, as applicable.
- Special category data: Not intended to be required. Any proposed processing must be assessed and agreed where lawful and necessary.
- Security measures: The technical and organisational measures actually implemented or contractually agreed.
- Subprocessors: Relevant legal names, processing functions, data categories and processing locations, together with applicable transfer safeguards.
These details may be maintained in a separate record agreed by the parties and updated as necessary.