Data Processing Agreement

Data Processing Agreement.

When we process personal data on your behalf, this DPA (aligned to GDPR Article 28) governs how.

1. Roles

The client is the data controller; The Creativity Lab is the data processor. We process personal data only on documented instructions from the client.

2. Subject matter & duration

Processing is limited to what is necessary to deliver the contracted services, for the duration of the engagement plus any legally required retention.

3. Our obligations

  • Process only on documented instructions.
  • Ensure personnel are bound by confidentiality.
  • Implement appropriate technical and organisational security measures.
  • Assist with data-subject requests and breach notifications.
  • Delete or return personal data at the end of the engagement.

4. Sub-processors

The client authorises the use of vetted sub-processors bound by equivalent data-protection terms. We remain responsible for their performance and will inform the client of intended changes.

5. International transfers

Any transfer outside the EEA is protected by an adequacy decision or Standard Contractual Clauses.

6. Audit

We make available the information needed to demonstrate compliance and support reasonable audits, subject to confidentiality.