GDPR ARTICLE 28 & EU DATA ACT CHAPTER VI
Data Processing Agreement (DPA) & Cloud Switching Addendum
Standard contractual clauses between Customer (Controller) and LOCUS SRL (Processor) pursuant to GDPR Article 28 and EU Data Act Articles 23–29.
Subject Matter, Duration, and Processing Instructions
This Data Processing Agreement ("DPA") forms an integral part of the Terms of Service between Customer ("Controller") and LOCUS SRL ("Processor"). Processor shall process personal data solely on documented instructions from Controller for the purpose of compiling statutory compliance dossiers and hosting Customer’s public Buyer Trust Center.
Technical and Organizational Security Measures (TOMs)
Pursuant to GDPR Article 32 and DORA Article 30, LOCUS SRL implements and maintains the following baseline controls:
- →Cryptographic Protection: TLS 1.3 encryption in transit across all edge endpoints and AES-256 encryption at rest in AWS Frankfurt (eu-central-1).
- →Client-Side Isolation: Editable .DOCX compilation executes inside the customer browser sandbox.
- →Incident Notification SLA: Mandatory notification to Controller within 24 hours of becoming aware of any personal data breach or critical ICT incident.
- →Sub-Processor Change Notice: Minimum 30 calendar days advance notice prior to authorizing any new sub-processor.
Cloud Switching & Zero-Egress Portability Clause
Pursuant to Chapter VI of Regulation (EU) 2023/2854 (EU Data Act), Customer may terminate hosting of its Buyer Trust Center with a maximum notice period of 30 calendar days and export all hosted governance artifacts in JSON, Markdown, and Microsoft Word (.DOCX) formats at €0 switching cost and €0 egress fee.