Data Processing Agreement

Version 1.0 | 8 September 2026

This Data Processing Agreement (hereinafter: the “DPA”) forms an integral part of the Agreement. For the purpose of this DPA, Melapress shall be referred to as ‘Processor’, and Customer shall be referred to as ‘Controller’, hereinafter jointly referred to as the “Parties” or as a “Party”,

whereas

  • the DPA has been concluded in the context of the provision of services by the Processor to the Controller, in performance of the Agreement;
  • the Controller qualifies as a controller within the meaning of Article 4(7) of the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, hereinafter: the “GDPR”);
  • the Processor qualifies as a processor within the meaning of Article 4(8) GDPR in the performance of the Agreement;
  • insofar as terms used in this DPA are also defined in the GDPR, those terms shall have the meaning ascribed to them in Article 4 GDPR;
  • the Controller determines the purposes and means of the processing and the conditions set out in this DPA apply thereto;
  • the Parties, also in view of the requirement laid down in Article 28(3) GDPR, wish to record their respective rights and obligations in writing by means of this DPA and apply the provisions of this DPA on the Agreement;

have agreed as follows:

Article 1. Purposes of processing

1.1. The Processor undertakes, under the conditions set out in this DPA, to process personal data on behalf of the Controller. Processing shall take place exclusively on written instructions from the Controller (within the framework of the (Processor) Agreement and any additionally agreed purposes), unless processing is required by Union or Member State law to which the Processor is subject. In the latter case, due account shall be taken of the obligations under the GDPR and, more specifically, the rules on transfers under Chapter V GDPR.

1.2. The processing relates to the processing purposes determined by the Controller, with regard to the categories of data subjects and types of personal data as set out in Appendix A to this DPA. The Processor shall not process the personal data for any purpose other than those determined by the Controller. The Controller shall inform the Processor of the processing purposes insofar as these are not already included in this DPA.

1.3. The Processor has no control over the purposes and means of the processing of personal data. The Processor shall not make independent decisions regarding the receipt and use of personal data, the disclosure thereof to third parties, or the retention period of the personal data.

Article 2. Obligations of the Processor

2.1. With regard to the processing referred to in Article 1, the Processor shall ensure compliance with the conditions imposed by the GDPR on the processing of personal data by a processor acting in that capacity.

2.2. The obligations of the Processor arising from this DPA shall also apply to anyone processing personal data under the authority of the Processor.

2.3. The Processor shall immediately inform the Controller if, in its opinion, an instruction from the Controller infringes the legislation referred to in paragraph 1.

2.4. The Processor shall, insofar as reasonably possible, provide assistance to the Controller in fulfilling its obligations pursuant to Articles 32 to 36 GDPR. The Processor may charge reasonable costs for such assistance.

Article 3. Allocation of responsibility

3.1. The Processor is solely responsible for the processing of personal data under this DPA in accordance with the instructions of the Controller and under the explicit (ultimate) responsibility of the Controller. For all other processing of personal data, including but not limited to the collection of personal data by the Controller, processing for purposes not communicated by the Controller to the Processor, processing by third parties and/or for other purposes, the Processor bears no responsibility. Responsibility for such processing rests exclusively with the Controller.

3.2. The Controller warrants that the content, use and instructions relating to the processing of personal data as referred to in this DPA are lawful and do not infringe any rights of third parties.

Article 4. Transfer of personal data

4.1. The Processor may process personal data in countries within the European Economic Area (EEA). In addition, the Processor may transfer personal data to a country outside the EEA, provided that the requirements set out in Chapter V GDPR are complied with.

4.2. At the explicit request of the Controller, the Processor shall inform the Controller of the country or countries in which the personal data are processed.

Article 5. Engagement of subprocessors

5.1. The Controller hereby grants the Processor general authorization to engage subprocessors in the processing of personal data pursuant to this DPA, and specifically to engage the subprocessors in Appendix B, subject to compliance with applicable data protection legislation.

5.2. The Processor shall inform the Controller by email of any new subprocessor to be engaged. The Controller has the right to object in writing, stating reasons, within two weeks of notification. Where the Controller objects, the Parties shall consult with each other to reach a solution.

5.3. The Processor shall ensure that such third parties assume in writing at least the same obligations as agreed between the Controller and the Processor under this DPA.

Article 6. Confidentiality

6.1. All personal data received by the Processor from the Controller and/or collected by the Processor itself in the context of this DPA shall be subject to a duty of confidentiality towards third parties. The Processor shall not use such information for any purpose other than that for which it was obtained, unless the information has been rendered anonymous in such a way that it can no longer be attributed to data subjects.

6.2. The Processor warrants that all persons acting under its authority and involved in the processing of personal data on behalf of the Controller are contractually bound to confidentiality.

6.3. This confidentiality obligation shall not apply insofar as the Controller has given explicit consent to disclose the information to third parties, where disclosure is logically necessary in view of the nature of the assignment and the performance of this DPA, or where there is a statutory or judicial obligation to disclose the information to a third party.

Article 7. Personal data breach notification

7.1. The Processor shall notify the Controller without undue delay of a personal data breach as referred to in Article 4(12) GDPR.

7.2. The Controller is responsible for complying with any statutory notification obligations. Where required by law or regulations, the Processor shall cooperate and may charge reasonable costs.

7.3. The notification shall at least contain the information required under Article 33(3) GDPR.

Article 8. Rights of data subjects

8.1. Where a data subject submits a request to exercise statutory rights to the Processor, the Processor shall forward the request to the Controller and inform the data subject accordingly. Controller will subsequently handle the request. If the Controller needs assistance of the Processor, the Processor may charge reasonable costs.

8.2. Taking into account the nature of the processing, the Processor shall assist the Controller in complying with Chapter III GDPR.

Article 9. Security measures

9.1. The Processor shall use best efforts to implement appropriate technical and organizational measures with regard to the processing operations to be carried out, to protect against loss or any form of unlawful processing (such as unauthorized access, alteration, modification or disclosure of the personal data).

9.2. Processor shall make best efforts to ensure a level of security that is appropriate taking into account the state of the art, the costs of implementation and the nature of processing.

Article 10. Audit

10.1. The Controller has the right to conduct audits (or have audits conducted by an independent third party bound by confidentiality) in order to verify compliance with this DPA.

10.2. The Controller may conduct such an audit once per year.

10.3. The Processor is entitled to rely on an audit already conducted to demonstrate its compliance with the agreed obligations. The Controller may only request an additional or different audit where there are concrete and demonstrable objections or deficiencies in relation to the processing activities carried out under this Agreement.

10.4. An audit initiated by the Controller shall take place at least two weeks after prior notification by the Controller, on a date and time to be determined in mutual consultation between the Parties.

10.5. The Processor shall cooperate with the audit and make all information reasonably relevant to the audit available in a timely manner, including supporting data and personnel. The Controller shall ensure that the audit causes as little disruption as possible to the Processor’s other business activities.

10.6. The findings resulting from the audit shall be assessed by the Parties in mutual consultation and, based thereon, implemented by one of the Parties or by both Parties jointly.

10.7. The costs of the audit shall be borne by the Controller.

Article 11. Liability

11.1. The Parties expressly agree that, with regard to liability, the liability provision contained in the Agreement shall apply.

Article 12. Term, amendment and termination of the DPA

12.1. This DPA is entered into for the term as determined in the Agreement between the Parties and, failing that, in any event for the duration of the cooperation.

12.2. This DPA may not be terminated prematurely.

12.3. This DPA may be amended in the same manner as the Agreement.

12.4. As soon as the DPA has ended, for whatever reason and in whatever manner, the Processor shall – at the choice of the Controller – return to the Controller all personal data in its possession, whether in original or copy form, and/or delete and/or destroy such original personal data and any copies thereof.

Article 13. Governing law and dispute resolution

13.1. This DPA shall be governed by Dutch law.

13.2. Any disputes that may arise between the Parties in connection with the DPA shall be submitted to the competent court in the district of the court that also has jurisdiction under the Agreement.

13.3. If one or more provisions of the DPA prove to be invalid, the DPA shall otherwise remain in effect. The Parties shall in such case consult with each other regarding the invalid provisions in order to agree on replacement provisions that are valid and correspond as closely as possible to the intent of the provisions to be replaced.

13.4. If data protection legislation is amended, the Parties shall cooperate in amending this DPA in order to be able to (continue to) comply with such legislation.

13.5. In the event of any conflict between documents or their annexes, the following order of precedence shall apply:

  • a. this DPA;
  • b. the Agreement and the Terms and Conditions.

Appendix A | Specification of personal data and data subjects

Personal data and data subjects

Processor shall process the following types of personal data, under the supervision of Controller, for the purposes as specified in article 1 of the DPA:

  • Name & Surname
  • Email address
  • Payment history
  • Website(s) on which the plugin is installed
  • Billing details (no payment or cardholder details)

Of the following categories of data subjects:

  • Users
  • Employees

Appendix B | Subprocessors and locations

The following Subprocessors are engaged by Processor at the time of entering into the Agreement:

  • Google – Ireland (part of Google in the USA)
  • DigitalOcean – USA
  • Help Scout – USA
  • SiteGround – Bulgaria
  • MailerLite – Ireland / USA
  • Stripe – Ireland / USA
  • PayPal – USA

Download these Data Processing Agreement in PDF & printable format.