Data Processing Agreement (DPA)

The data processing agreement between the controller (client) and SSM.ro as processor

When SSM.ro processes personal data on behalf of a client (typically, that client's employee data), the relationship is governed by a Data Processing Agreement (DPA) under Art. 28 GDPR.

Parties and roles

Role	Party
Controller	The client (employer) who determines the purposes and means
Processor	Consultia Digital S.R.L. (SSM.ro), which processes data on behalf of the controller

Subject matter and duration

Subject matter: processing of data required to provide the SSM.ro services (document management, training, electronic signature)
Duration: for the duration of the service contract, plus the legal retention periods

Categories of data and data subjects

Data subjects: employees, administrators, the client's contact persons
Categories of data: identification and contact data, professional data, national identifiers (exceptionally, for issuing qualified signature certificates)

Obligations of the processor

Processes data only on the basis of documented instructions from the controller
Ensures the confidentiality of persons authorized to process the data
Implements appropriate technical and organizational measures (see Security)
Complies with the conditions for engaging sub-processors (see Sub-processors)
Assists the controller in responding to data subject requests and in ensuring compliance
Notifies breaches without undue delay (see Breach Notification)
Upon termination, deletes or returns the data, in accordance with retention rules

Sub-processors

The controller authorizes the use of the sub-processors listed in Sub-processors. Changes are communicated, allowing the controller to raise objections.

International transfers

Any transfers outside the EEA are carried out with the safeguards required by the GDPR — see International Transfers.

The contractual form of the DPA is made available by SSM.ro when the service contract is concluded. For details, contact the DPO or the sales team.