Data Processing Agreement (draft)
This draft describes proposed terms for processing personal data on a customer's behalf. Confirm the contractual terms and legal entity details before uploading sensitive documents.
Contracting entity requires verification
This public text is a draft, not an executed agreement. The contracting entity, address, tax details, subprocessors and transfer mechanisms must be confirmed before signature. To discuss preparing an agreement, email contact@fencia.co.
1. Parties and subject matter
This draft Data Processing Agreement ("DPA") proposes terms between the customer ("Controller") and the operator of Fencia identified in a signed agreement ("Processor"). It concerns personal data the Controller provides when using the service, pursuant to Art. 28 GDPR (Regulation (EU) 2016/679).
2. Subject, duration and nature of processing
The Processor will process personal data solely to provide the compliance-analysis service (document scanning, findings generation, storage of results and optional monitoring). Processing lasts for the duration of the contractual relationship and the configured retention period.
3. Categories of data and data subjects
The personal data processed depends on the content the Controller uploads. It may include data of employees, customers or third parties referenced in policies, contracts and technical documentation. The Controller determines which documents are uploaded and therefore which categories of data are processed.
4. Processor obligations
The proposed terms require the Processor to: (a) process data only on the Controller's documented instructions; (b) ensure confidentiality of authorized personnel; (c) apply the measures in the Security Center (TLS 1.2/1.3, AES-256 database encryption, RLS and access control); (d) not use data to train Fencia's own models and document the terms applicable to the external AI analysis provider; (e) assist the Controller with data-subject rights; (f) notify personal data breaches without undue delay.
5. Subprocessors
A signed agreement should identify and authorize applicable subprocessors. The current provider register is available in the Privacy Policy; each provider's processing terms must be checked before signature. This draft envisages notice of intended changes and a reasonable opportunity to object.
View the current provider register ↗6. International transfers
Some providers may process data outside the European Economic Area. The lawful mechanism for each transfer, including Standard Contractual Clauses where applicable, must be specified and verified in the current contractual documents.
7. Security
Implemented measures include encryption in transit and at rest for the database, RLS and workspace access controls, rate-limited sign-in and activity logging. Results may retain document quotations. Documents created or saved in Files are stored and may contain personal data; they must not be confused with a temporary scanner upload. The activity log is not immutable. See the Security Center and Privacy Policy for details and limitations.
8. Deletion and return of data
A signed agreement should specify how data is deleted or returned when the service ends, any legal-retention exceptions and timeframes. Individual analyses can be deleted in the dashboard; complete production deletion must be confirmed for each account.
9. Audit
The Processor will make available the information necessary to demonstrate compliance with this DPA and allow for reasonable audits, including security questionnaires, with reasonable notice.
10. Governing law
This DPA is governed by Spanish and European Union law, consistent with Fencia's Terms of Service.