The current Data Processing Agreement supports arrangements in which Flinker processes personal data on documented customer instructions under Article 28 GDPR.
Document precedence: The linked controlled version and any countersigned agreement are authoritative. The sections below are an evaluation index, not a substitute for the agreement.
Purpose and roles
The controlled agreement identifies the controller and processor roles, the subject and duration of processing, the nature and purpose of processing, categories of data, and categories of data subjects.
Documented instructions and confidentiality
Processing is limited to documented customer instructions and authorized persons are subject to appropriate confidentiality obligations.
Technical and organizational measures
The agreement connects contractual obligations to the applicable security measures for confidentiality, integrity, availability, access control, and resilient service delivery.
Subprocessors and transfers
The controlled version defines subprocessor authorization, change information, flow-down obligations, and the safeguards required for international transfers.
Assistance and incidents
The processor obligations cover reasonable assistance with rights requests, security incidents, data-protection assessments, supervisory-authority matters, and evidence of compliance.
Return, deletion, audit, and precedence
The agreement defines end-of-service handling, deletion or return, audit information, liability alignment, and the order of precedence with the main commercial agreement.