Data Processing Agreement
When we process personal data on your behalf, this DPA (aligned to GDPR Article 28) governs how.
Roles
The client is the data controller; The Creativity Lab is the data processor. We process personal data only on documented instructions from the client.
Subject matter & duration
Processing is limited to what is necessary to deliver the contracted services, for the duration of the engagement plus any legally required retention.
Our obligations
- Process only on documented instructions.
- Ensure personnel are bound by confidentiality.
- Implement appropriate technical and organisational security measures.
- Assist with data-subject requests and breach notifications.
- Delete or return personal data at the end of the engagement.
Sub-processors
The client authorises the use of vetted sub-processors bound by equivalent data-protection terms. We remain responsible for their performance and will inform the client of intended changes.
International transfers
Any transfer outside the EEA is protected by an adequacy decision or Standard Contractual Clauses.
Audit
We make available the information needed to demonstrate compliance and support reasonable audits, subject to confidentiality.