DPA & Subprocessors
How RecoSearch acts as a processor under Art. 28 GDPR: DPA scope, subprocessors, international transfers and security.
1. Processors, transfers and security
Where we process personal data on your behalf as part of a campaign, we act as processor and sign a Data Processing Agreement (Art. 28) covering scope, duration, confidentiality, sub-processor approval, assistance with data-subject requests, breach notification within 72 hours, and deletion or return on termination. Our current sub-processor list is available on request and updated with prior notice.
Primary hosting and storage is in the EU. Any transfer outside the EEA/UK relies on Standard Contractual Clauses (or the UK Addendum / IDTA) plus a transfer impact assessment. We apply encryption in transit and at rest, least-privilege access, audit logging and regular access reviews (Art. 32).
Placeholders marked in gold must be completed by your legal counsel before launch: entity name, registered address, Art. 27 representative, sub-processor list, and the retention periods your accounting jurisdiction actually requires.
For how we process personal data as a controller, see the Privacy Notice.