Language notice: This English translation is provided for convenience. The Spanish version prevails in the event of any discrepancy.
Disclaimer: This document was prepared with AI assistance and is offered as a starting point only. It is not legal advice and does not create a lawyer-client relationship. Laws may change. A qualified legal professional in Spain should review it before publication or use. The tool's author accepts no liability for its use.
Template: complete the highlighted fields, the security measures/provider annex and the customer's instructions. Both parties must accept and retain a copy before processing personal data on the customer's behalf.
Data Processing Agreement
Template version: .
1. Parties and subject matter
On the one hand, [CUSTOMER FULL NAME / LEGAL NAME], tax ID [TAX ID], address [ADDRESS], represented by [AUTHORISED REPRESENTATIVE AND TITLE] (the “Controller”). On the other hand, Derek Sanz Chiorean, a self-employed professional, tax ID 47479047D, business address at Carrer De La Generalitat, 8, Alcanar, provider of Oteaya under the trade name Wakefold; website: https://wakefold.com (the “Processor”). The parties enter into this agreement under Article 28 of Regulation (EU) 2016/679 (GDPR) and applicable Spanish law.
This agreement applies only when the Controller configures Oteaya to process personal data on its behalf and following its instructions. It does not change either party's role for processing where it acts as an independent controller. The Controller represents that it has a lawful basis for the processing and has fulfilled its information obligations.
2. Description of processing
Subject matter and purpose: collect, filter, organise, retain and display to the Controller content from open sources according to its monitor queries; generate automated classifications, if enabled by the Controller, to assist with reading; and allow content to be queried through the interface and API if included in the plan.
Duration: for the term of the Service and the contracted retention period. At the end, return or deletion under clause 8 will apply, subject to backups and legal obligations.
Operations: collection, consultation, recording, organisation, retention, extraction, adaptation, disclosure to the Controller through its account, restriction and deletion.
Data subjects: people whose data appears in posts, news or messages matching the Controller's queries; and the Controller's users, employees and collaborators who use the account or integrations.
Types of data: identifiers and profile or contact details published in open sources; post and communication content, professional data, opinions and other data appearing in those sources; account and activity data of the Controller's users; and queries, criteria and analysis results configured by the Controller.
Special-category or criminal-offence data: the Controller must not configure monitors to search for or infer special-category data or data relating to criminal convictions and offences. If such content incidentally appears in open sources, the Controller will decide and document the lawful measures required and instruct the Processor to delete it or restrict its processing.
3. Documented instructions
The Processor will process data only to provide Oteaya under this agreement, the Controller's documented instructions, its monitor configuration and instructions issued through the account by authorised people. Additional instructions must be retained in writing. If, in the Processor's view, an instruction infringes the GDPR or another data-protection law, the Processor will promptly inform the Controller and may suspend the affected operation until lawful instructions are received, unless the law prohibits that notice.
The Controller determines the purposes, queries and monitoring criteria; it must minimise data and retention periods, review automated results, and not use the Service for unlawful or discriminatory decisions. The Processor will not use personal data for its own purposes. OpenAI may be used only to provide the automated classification feature. Before enabling that feature for personal data, the Processor must confirm and document the contracted service and account, applicable data-use and retention terms, processing region and any international-transfer mechanism. Such data will not be used to train models without the Controller's documented instruction and valid authorisation.
4. Confidentiality and security
The Processor will ensure that people authorised to process personal data are bound by confidentiality and have access limited to their duties. It will apply technical and organisational measures appropriate to the risk under Article 32 GDPR, as described in the security-measures annex. Measures may be updated if an adequate level of protection is maintained. The Controller may request reasonable information to verify them, while avoiding access to other customers' data or compromising Service security.
5. Subprocessors and transfers
The Controller gives general authorisation to use the subprocessors identified in the provider annex. The Processor will impose data-protection obligations on each subprocessor equivalent to those in this agreement and remains responsible to the Controller for its obligations. The Processor will give notice at least 30 calendar days before any addition or replacement of a subprocessor by email to the contact address for the account. The Controller may object on substantiated data-protection grounds within those 30 calendar days. If the objection cannot be resolved, either party may stop using the affected feature.
No international transfer on the Controller's behalf will take place without a valid mechanism under Chapter V GDPR. Specific destinations and safeguards will be listed in the provider annex before the relevant processing is enabled.
6. Assistance to the Controller
Taking into account the nature of the processing, the Processor will reasonably assist the Controller with data-subject requests, security obligations, breach notifications, impact assessments and prior consultations where applicable. The Processor will forward requests it receives directly to the Controller and will not respond on its behalf unless authorised or legally required.
The Processor will notify the Controller of a personal-data breach without undue delay after becoming aware of it and provide available information so the Controller can meet its obligations. The Controller will decide whether to notify an authority or affected people.
7. Audits and information
The Processor will make information reasonably necessary to demonstrate compliance with this agreement available and allow audits by the Controller or an independent auditor bound by confidentiality, with 10 business days' advance notice, during business hours and at a reasonable frequency. Audits must not access other customers' data or unduly affect the Service's security, confidentiality or continuity. If an independent report or certification provides sufficient evidence, the parties may agree that it replaces an on-site audit in whole or in part.
8. Return and deletion
When the Service ends, the Controller may request an export of data still retained for 30 calendar days. The request may be made through plan features while they remain available or in writing to [email protected]. This request period does not suspend or extend ordinary retention periods: data whose retention period expires sooner may be deleted and become unavailable. After the request period, the Processor will delete or return personal data processed on the Controller's behalf, at the Controller's choice, unless retention is legally required. Backups will be purged according to the security-annex cycle and protected until deletion. The Controller may request earlier deletion of content using Service features or in writing.
9. Liability and term
This agreement takes effect when accepted by both parties and remains in force while the Processor processes personal data on the Controller's behalf. Each party is responsible for its obligations under applicable law and for damage it causes as provided by law. No contractual limitation affects rights or liabilities that cannot legally be excluded.
10. Security measures and provider annex to be completed
Hosting and database: infrastructure managed by the Processor in Spain. Administrative access is restricted to the Processor.
Proxy and traffic delivery: Cloudflare, when the Controller's connection passes through its network; it may receive IP addresses, connection metadata and HTTP requests. Active services, processing regions and transfer mechanisms must be confirmed against the effective account configuration.
Automated analysis: OpenAI, only if enabled. Matching text, the query and monitor context are sent to classify relevance, topic and priority. Before enabling it for personal data, confirm the service and account used, country/region, retention and transfer mechanism under the provider's current terms.
Transactional email: Resend, when configured, for account verification, password resets and invitations. The recipient's email address and the content needed for the message are sent. Confirm the country/region and transfer mechanism for the active account and terms.
Backups: the documented procedure provides for daily backups, retained for 7 days on the server and up to 30 days in a remote storage service. Before signing, confirm that the task is active and identify the provider, storage region and safeguards actually configured.
Measures: administrative access is limited to the Processor and connections are protected by HTTPS. Specific storage and backup safeguards will be documented according to the effective configuration and provided to the Controller when reasonably necessary to demonstrate compliance with this agreement.
11. Acceptance and signature for each engagement
This public template is not by itself a completed agreement for a specific customer. Before enabling monitors that involve personal data, the parties must complete the annex, accept this agreement and retain a signed or electronically accepted copy.
Controller: [NAME / LEGAL NAME, TAX ID, REPRESENTATIVE, EMAIL AND DATE].
Processor: Derek Sanz Chiorean, trading as Wakefold, website https://wakefold.com, tax ID 47479047D, [email protected], 3 November 2026.