Compliance
Data processing
in the Lab under GDPR Article 28.
Reading simosphereai.com does not mean handing data to SIMO GmbH for processing. It is different when a company brings its own personal data into a Lab test: before the first handover, we conclude a data processing agreement tailored to the project.
What the agreement covers
The agreement follows the structure that Article 28(3) GDPR prescribes and adds the annexes without which a processing agreement cannot realistically be audited. This English version is provided for convenience. The German version is legally binding; if the two differ, the German version prevails.
- Subject matter, duration, nature, and purpose of the processing under Article 28(3)(a).
- Types of personal data and categories of data subjects.
- Obligations and rights of the controller.
- Technical and organizational measures as Annex 2.
- List of approved sub-processors as Annex 3.
- EU standard contractual clauses 2021/914 as Annex 4 wherever a third-country transfer applies.
- Provisions on inspection, audit, and information rights.
How to obtain it: what we need from you
You receive the tailored agreement as a PDF. So that we can draft it without a round trip, please include the following straight away:
We take no personal data into a test without a signed agreement.
- Counterparty: company, legal form, address, and authorized signatory.
- Project: which Lab test, which categories of data, and which data subjects.
- Sub-processors: only those the project needs, with processing in the EU as the default.