GDPR Documents: Controller, Processor, ROPA and DPIA
Who is the controller and who the processor, and how to download Avensa's DPA, the sub-processor list, and the starter templates for your record of processing activities and your DPIA.
Your agency decides why and how its clients' data is used, so under GDPR it is the controller. Avensa stores and processes that data on your instructions, so it is the processor. Avensa signs a data processing agreement with you and lists the companies it uses. You keep your own records: a record of processing activities and, where needed, a data protection impact assessment. Avensa gives you a starting point for both.
Download the documents
Open GDPR requests
Go to SettingsGDPR requests. You need permission to answer GDPR requests.
Open GDPR requestsScroll to Compliance documents
The panel is at the bottom of the page.
Open or download a document
Click Open to read a document in the browser, or Download to save it.
| Document | What it is | File |
|---|---|---|
| Data Processing Agreement | The Article 28 GDPR agreement between your agency and Avensa, with the sub-processors and security measures | Page and Markdown |
| Sub-processors | Every company that processes personal data for Avensa, with its location and transfer safeguard | Page and Markdown |
| Record of processing activities (template) | An Article 30 record with eight typical activities of an agency (clients, owners, deals and e-signature, AML, marketing, calls, automations, staff), pre-filled with your agency name, your Data retention periods and your consent expiry | CSV for Excel |
| Data protection impact assessment (template) | A starter DPIA for ЕГН and ID-card processing, AML files, and scoring and matching clients | Markdown |
Templates, not legal advice
The record of processing activities and the DPIA are templates. Review them with your lawyer or data protection officer, fill in everything in square brackets, and approve them yourself. The Data Processing Agreement is still a draft pending legal review.