Data Processing Agreement (DPA)
1. Parties and roles
For the purposes of applicable data protection laws, including the GDPR where applicable, the customer acts as the Data controller and BMS acts as the Data processor.
BMS processes personal data only on the documented instructions of the customer, unless otherwise required by applicable law.
2. Purpose and scope of processing
BMS processes personal data solely for the purpose of providing, maintaining, securing, and supporting the Business Management System and its related services, including:
- Accounting and finance
- Human resources and payroll
- Inventory and warehouse management
- Customer relationship management
- Procurement and vendor management
- Operational and administrative workflows
- Technical support, maintenance, backup, and security
BMS does not process customer personal data for its own commercial purposes.
3. Categories of personal data
- User account information
- Employee and payroll information
- Customer and vendor contact information
- Financial and accounting records
- Operational and inventory data
- System logs, audit records, and usage information
- Any other personal data submitted by the customer through the service
4. Categories of data subjects
- Customer employees and authorized users
- Job applicants, where applicable
- Customers and prospects
- Suppliers and vendors
- Contractors and consultants
- Other individuals whose personal data is entered by the customer
5. Processor obligations
- Process personal data only on documented customer instructions.
- Ensure personnel with access to personal data are bound by confidentiality obligations.
- Implement appropriate technical and organizational security measures.
- Assist the customer in meeting applicable data protection obligations.
- Notify the customer of legally required disclosures where permitted by law.
6. Technical and organizational security measures
- Role-based access control
- Strong authentication for administrative access
- Encryption of data in transit using industry-standard protocols
- Secure password storage
- Audit logging of significant administrative and security events
- Regular backups and disaster recovery procedures
- Security monitoring and vulnerability management
- Restricted access to production systems
- Regular software updates and security patches
Subprocessors
BMS may engage trusted subprocessors to provide hosting, infrastructure, communication, monitoring, and other operational services.
BMS remains responsible for the performance of its subprocessors and ensures they are subject to data protection obligations equivalent to those in this agreement.
A current list of approved subprocessors is available on theSubprocessors
8. International data transfers
Where personal data is transferred outside the applicable jurisdiction, BMS implements appropriate safeguards, including Standard Contractual Clauses (SCCs), adequacy decisions, or other legally recognized transfer mechanisms.
9. Data subject rights
Taking into account the nature of the processing, BMS provides reasonable assistance to enable the customer to respond to requests relating to access, rectification, erasure, restriction, portability, objection, and other rights available under applicable data protection laws.
10. Personal data breaches
BMS maintains procedures for detecting, investigating, and responding to security incidents.
Where BMS becomes aware of a personal data breach affecting customer data, it will notify the customer without undue delay and provide available information required to support the customer’s legal obligations.
11. Data retention, return, and deletion
Upon termination of the service, customers may export their data during the applicable retention period.
Following the retention period, BMS securely deletes or anonymizes customer personal data, unless continued retention is required by applicable law. Backup copies are removed according to BMS’s backup retention procedures.
12. Audit and compliance
Upon reasonable written request, BMS will provide available information demonstrating compliance with this agreement, including relevant security and compliance documentation where appropriate.
Audit requests must be reasonable, subject to confidentiality obligations, and must not unreasonably interfere with BMS operations.
13. Duration
This Data Processing Agreement remains in effect for as long as BMS processes personal data on behalf of the customer in connection with the service.
14. Compliance with applicable law
Both parties shall comply with their respective obligations under applicable data protection and privacy laws, including the General Data Protection Regulation (GDPR) where applicable.