CRA Workspace Data Processing Agreement
Version: CRA-WORKSPACE-DPA-2026-10-16-DRAFT-1
SHA-256: dfe21daeb51f6c6e5546914fd9f4bd1534b814ad59792eb187162cefe2ad5191
Processor
Bartosz Kowalczyk
ul. Gieysztora 4/161, 02-999 Warszawa
kontakt@cracompliance.pl
Customer organisation identified in the order or authenticated Workspace
1. Parties and scope
The parties are the customer organisation identified in the order or acceptance record and the CRACompliance operator identified below. The customer is the controller of data entrusted to CRA Workspace and the operator is its processor. Where the customer is itself a processor, it confirms the relevant controller's authorisation for sub-processing; the operator follows only instructions within that authorisation. This agreement covers processing on the customer's behalf, not the operator's own purposes such as billing, business contacts and service security described in the privacy notice.
2. Documented instructions
The subject is operating a hosted register of products, releases, SBOMs, vulnerabilities, reporting cases and evidence using the purchased service's functions. This agreement, organisation settings, authorised user actions and written directions from the organisation administrator are documented instructions. Processing is limited to those purposes and instructions, including transfers. If Union or Member State law requires other processing, the operator informs the customer beforehand unless prohibited by law. The operator promptly informs the customer if it considers an instruction to infringe data protection law and suspends the disputed activity pending clarification.
Annex A. Processing description
Duration: service provision followed by the agreed export window and limited backup deletion period. Operations: receipt, organisation, storage, retrieval, disclosure to authorised persons, export and deletion. Data subjects: organisation users, customer staff and contractors, supplier and customer contacts, researchers and persons identified in authorised incident materials. Data: names, business email, roles, identifiers, timestamps, activity history and personal data in supplied materials. The customer determines the legal basis and minimises content. The standard service is not intended for GDPR Articles 9 or 10 data, passwords, private keys or card data; such scope requires a separate written agreement before upload.
3. Confidentiality and access
The operator grants access only to authorised persons bound by confidentiality or an appropriate statutory duty, limited to tasks requiring access. The customer manages its members and roles, verifies export recipients and does not disclose private access links to unauthorised persons. Operator service access is limited to service operation, security, requested assistance or legal obligations.
Annex B. Security measures
The operator implements and reviews risk-appropriate GDPR Article 32 measures: HTTPS for the interface, TLS for transactional email, session authentication and role checks, organisation-scoped reads and writes, restricted system file access, webhook signature verification, logging of relevant actions, controlled releases with backup and rollback, and tests of restoration and deletion. Exports include SHA-256 checksums; these are not encryption. This list does not assert encryption of all data at rest, ISO certification or a guarantee against breaches. Changes must not reduce the agreed protection level. Additional customer requirements need agreement before data is supplied.
4. Data subject rights and assistance
Taking account of processing and available information, the operator assists the customer with data subject rights and GDPR Articles 32–36 obligations, including impact assessments, consultation and breach handling. It forwards data subject requests without undue delay and does not decide them independently unless instructed or legally required. Organisation administrators can use export; restricted materials and large exports require operator assistance without bypassing access controls. Agreement and data protection contact: the operator email below.
5. Personal data breaches
On becoming aware of a breach of entrusted personal data, the operator notifies the customer without undue delay. It provides available details of the breach, affected data and persons, likely consequences, remedial action and contact point, supplementing incomplete information in stages. It cooperates in mitigation and preservation of information needed by the customer. The customer decides supervisory authority and data subject notifications. A privacy breach notification is not automatically a CRA report to ENISA; those processes and clocks remain separate.
6. Sub-processing
The customer gives general written authorisation for the sub-processors and purposes in Annex C. The operator emails the organisation administrator at least 30 days before a planned addition or replacement, with information needed for assessment. The customer may raise a reasoned data protection objection before the change. Pending resolution, the operator does not send that customer's data to the disputed new sub-processor; the parties agree an alternative or termination of the affected service with export/deletion. The operator imposes equivalent data protection obligations and remains responsible to the customer for their performance. Relevant information and agreements are provided on request, with justified redaction of others' data and secrets.
Annex C. Sub-processor list
Hetzner Online GmbH, Germany — application hosting, Workspace data and backup storage. Brevo / Sendinblue SAS, France — transactional email: recipient address, message content and delivery metadata; entire SBOMs and evidence attachments are not routinely sent through this service. Brevo logs: one month; new message previews disabled. Stripe/Link handles payments in its separate role described in Checkout and the privacy notice; this does not make it a processor of Workspace evidence. This annex does not authorise sending entrusted data to generative AI services. Enabling such an integration with personal data requires a separate prior instruction and an updated list/terms.
7. Location and transfers
Primary Workspace hosting is in the EU. This does not assert that no sub-processor may access data from outside the EEA. Transfers require a documented instruction and compliance with GDPR Chapter V, including an applicable transfer basis and safeguards assessment. Brevo's terms provide for transfers with appropriate mechanisms such as standard contractual clauses, and other mechanisms only where actually applicable. The operator provides information on current sub-processors, locations and safeguards. This agreement is not itself the Commission's standard contractual clauses for international transfers.
8. Termination, return and deletion
After definitive service termination, the organisation administrator has 30 days to export. Turning off renewal or a temporary payment problem does not itself trigger deletion. The customer chooses return by export followed by deletion, or deletion only, and may give a separate written direction. After that window the operator deletes data and existing copies unless law requires further retention. Rotating backups are deleted within a further 30 days, isolated from ordinary use; restoration reapplies the current deletion ledger before access resumes. A dispute, open regulatory case or undetermined retention blocks automated deletion and requires a documented assessment with the customer; it is not itself an indefinite retention ground. Legally required operator records remain separate and minimised. On request the operator confirms deletion scope and completion.
9. Information and audits
The operator makes information needed to demonstrate GDPR Article 28 obligations available and allows and contributes to audits, including inspections, by the customer or an authorised independent auditor. The parties arrange proportionate scope, confidentiality and logistics while protecting other customers; arrangements must not defeat statutory rights or urgent action following a breach or authority request. On request the operator provides security descriptions, the current sub-processor list and available backup, restoration and deletion test evidence. It does not claim certifications it does not hold.
10. Acceptance and versioning
This agreement and annexes form part of the CRA Workspace service contract and prevail for entrusted-data processing. It is concluded electronically by explicit acceptance by a person authorised to represent the organisation, effective when the relevant service starts or an existing organisation records acceptance. The record includes version, language, UTC time, order or member identifier, parties, and a hash and copy of the accepted text. Buying other products does not accept this agreement. Updates do not overwrite earlier acceptance; material changes require separate notice and agreement. Data subject rights, supervisory authority competence and GDPR obligations remain unaffected.