Legal · DPA

Data processing agreement.

Sebrona ships a GDPR Article 28 data-processing agreement (DPA) with every engagement that touches personal data. This page names what the standing template carries; signed copies are issued per engagement to your DPO.

Effective · 2026-05-27

01 · Scope

The Sebrona DPA covers engagements in which Sebrona acts as a processor (Art. 4(8)) under your controllership. For joint-controller arrangements (e.g. ElektrikPro, where Sebrona and M.Z.CONNECT s.r.o. share controllership under Art. 26), a joint-controller agreement supersedes this DPA and is signed in parallel.

02 · Standing clauses

Every Sebrona DPA includes the following clauses at minimum. Engagement-specific addenda are negotiated where your sector demands more.

ART. 28(3)(A)

Documented processing instructions — model + routing policy locked to the signed spec.

ART. 28(3)(B)

Confidentiality undertakings from everyone with access (Sebrona team and named sub-processors).

ART. 28(3)(C)

Security measures per Art. 32 — encryption at rest, EU residency, default-deny policies (see /security).

ART. 28(3)(D)

Sub-processor flow-down — every sub-processor named at /security carries the same Art. 28 obligations.

ART. 28(3)(E)

Assistance with data-subject rights (Art. 15–22) within 10 working days of your request.

ART. 28(3)(F)

Assistance with Art. 33 (incident notification within 72h) and Art. 35 DPIAs.

ART. 28(3)(G)

End-of-engagement deletion or return of personal data; certified within 30 days of contract end.

ART. 28(3)(H)

Audit rights — you may audit Sebrona's processing once per year, or on notice in case of incident.

03 · Sub-processors

Sub-processors are named at /security with region and purpose. Sebrona will not add a new sub-processor without 30 days' written notice; you may object on documented protection grounds. The DPA carries the flow-down clause obliging every sub-processor to GDPR Art. 28 commitments.

Full sub-processor list → /security

04 · Requesting a copy

The DPA template is issued under engagement NDA — it is not a public download. To request the current draft for review by your DPO or legal team, write to info@sebrona.com from a corporate address with the engagement context. We respond within two working days.

Request the DPA→← Back to the practice