Data processing agreement

1. Parties and roles

The client (the controller) and ITovio (the processor), as identified in the scope this agreement is attached to. ITovio processes personal data only on the client's documented instructions and only for the purposes in the scope.

2. Subject matter, duration, nature and purpose

The processing concerns the data categories and data subjects listed in Annex 1 of the signed copy (typically contact and lead data, customer records, and website visitor data), for the duration of the engagement and any agreed support period.

3. Processor obligations

ITovio will: process data only on instruction; ensure persons authorised to process data are bound by confidentiality; implement the technical and organisational measures in section 5; engage sub-processors only as set out in section 6; assist the controller with data-subject requests and with Articles 32 to 36 GDPR; delete or return all personal data at the end of the engagement; and make available the information necessary to demonstrate compliance.

4. Controller obligations

The client warrants it has a legal basis for the processing, provides lawful instructions, and informs ITovio of any specific requirements arising from its own obligations.

5. Security measures

Access control with named accounts and multi-factor authentication where the platform supports it; least-privilege access to client systems; encryption in transit (TLS 1.2 or higher) and at rest where the platform supports it; secrets kept in environment configuration, never in code or documents; logging of administrative actions where available; backups per the hosting platform's capabilities; secure deletion of credentials at handover.

6. Sub-processors

General authorisation is given for the sub-processors listed in the privacy policy and in Annex 2 of the signed copy, which names the platforms used in the specific engagement (for example Vercel, Supabase, GoHighLevel). ITovio gives at least 14 days' notice of any addition; the client may object on reasonable grounds.

7. International transfers

Where a sub-processor is outside the EEA, transfers rely on an adequacy decision, the EU–US Data Privacy Framework, or standard contractual clauses, as documented per sub-processor.

8. Personal data breach

ITovio notifies the client without undue delay and at the latest within 48 hours of becoming aware of a breach affecting the client's data, with the information needed for the client's own notification duties, and cooperates in containment and remediation.

9. Audit

Once a year, or after a breach, the client may audit ITovio's compliance with this agreement with reasonable notice, by questionnaire first and by inspection where justified, at the client's cost unless the audit reveals material non-compliance.

10. Deletion and return

At the end of the engagement ITovio returns the data in a usable format and deletes its own copies within 30 days, unless retention is required by law, and confirms deletion in writing on request.

11. Liability and term

Liability follows the main agreement. This agreement lasts as long as ITovio processes personal data for the client and survives termination for the obligations that by nature survive.

This page is the current template. The signed version attached to a scope prevails.