Analyze DPA GDPR Flags — Find Risks Automatically

DATA PROCESSING AGREEMENT

This Data Processing Agreement ("DPA") is entered into as of January 15, 2025 ("Effective Date"), by and between:

EUROPEAN RETAIL HOLDINGS, S.A.
A company incorporated under the laws of Spain
Gran Via 45, 28013 Madrid, Spain
("Controller" or "Company")

AND

CLOUDANALYTICS SOLUTIONS, INC.
A Delaware corporation
500 Data Center Drive, Building C
Austin, TX 78701, USA
("Processor" or "Service Provider")

BACKGROUND

A. Controller has engaged Processor to provide data an

{
  "document_type": "dpa_gdpr",
  "parties": [
    "European Retail Holdings, S.A. (Controller)",
    "CloudAnalytics Solutions, Inc. (Processor)"
  ],
  "personal_data": [
    "Contact information (name, email, phone, address)",
    "Transaction and purchase history",
    "Website browsing and interaction data",
    "Customer service communications",
    "Payment information (tokenized only)",
    "Demographic information",
    "Marketing preferences"
  ],
  "processing_purposes": [
    "Customer behavior analytics and segmentation",
    "Marketing campaign optimization",
    "Personalization of customer experience",
    "Business intelligence and reporting",
    "Fraud detection and prevention"
  ],
  "sub_processors": [
    "Amazon Web Services, Inc. (USA) - Cloud infrastructure",
    "Snowflake Inc. (USA) - Data warehousing",
    "Tableau Software, LLC (USA) - Data visualization",
    "Twilio Inc. (USA) - Communication services"
  ],
  "sub_processor_consent": "General authorization with 30 days prior written notice for new sub-processors. Controller may object within 14 days. If no resolution within 30 days, Controller may terminate affected services.",
  "breach_notification": "Within 24 hours of becoming aware of confirmed or suspected Data Breach. Notification must include: nature of breach, categories and approximate number of Data Subjects and records affected, DPO contact, likely consequences, and remedial measures.",
  "sccs_included": true,
  "data_retention": "Duration of Principal Agreement plus 90 days for operational transition. Deletion within 30 days of termination with written certification.",
  "article_28_compliance": true,
  "dpo_appointed": true,
  "pia_completed": null,
  "right_to_be_forgotten": true,
  "data_portability": true,
  "cross_border_transfers": "EU Standard Contractual Clauses (Module Two: Controller to Processor) with supplementary measures including encryption, pseudonymization, and contractual commitments regarding government access requests",
  "consent_mechanism": "Not specified - data subject rights handled through Controller"
}