Data Processing Agreement (DPA)
Last updated: 6 July 2026
When a business customer uploads personal data (such as staff or supplier data) to Plate & Punch, the customer acts as the data controller and Plate & Punch acts as a data processor. This relationship is governed by a Data Processing Agreement (DPA) under Article 28 of the GDPR.
The DPA sets out the subject matter and duration of the processing, the customer's instructions, confidentiality, security measures, the use of sub-processors, international transfer safeguards, assistance with data-subject rights and breaches, and the deletion or return of data.
Read the current DPA
You can view an informational copy (specimen) of the current DPA here:
The binding, executed version is presented for acceptance when you log in and is available at any time from your account.