Processing agreement template

Processing agreement template: execution required

This is Trialinx's processing terms template, not evidence of an executed agreement or blanket provider authorisation. Before processing a study's personal data, the parties must identify the controller, representatives, study and annexes, agree specific conditions and execute the agreement. Request it at contact@trialinx.com, including for free-plan studies.

Parties, subject matter and duration

Studio Flix, S.L. acts as processor when providing research capture, management, collaboration and analysis under the instructions of the controller identified in the specific agreement. The agreement must state commencement, service duration and return, archive or erasure periods.

The study annex identifies participants/users, data categories including health where applicable, enabled operations, centres, purposes and limits. It does not authorise unagreed care, secondary-use or training purposes.

Instructions and confidentiality

The processor acts only on documented instructions, including transfers, unless legally required otherwise, informing the controller where permitted. It will flag instructions infringing data protection law. Authorised personnel must be bound by confidentiality, least-necessary access and appropriate training.

Security and evidence

Annex measures must match the contracted environment: access/authentication, encryption, study/site separation, traceability/signatures, export controls, recovery and incident management. The processor applies risk-appropriate Article 32 GDPR measures and maintains agreed evidence.

The annex distinguishes available controls, enabled configuration and pending validation. Certifications, regions, recovery targets or physical safeguards from another platform are not incorporated by reference.

Subprocessors and transfers

The controller grants specific or general written authorisation as agreed. With general authorisation, additions/replacements are notified in advance with time to object before activation, identifying processing and safeguards. Unresolved justified objections require an alternative or termination of affected processing with safe exit.

The processor imposes equivalent obligations on subprocessors and remains responsible to the controller for their compliance. Annexes identify services, data, regions, support, retention and Chapter V GDPR safeguards. Publishing an informational list does not replace authorisation.

Rights, DPIAs and cooperation

Considering the processing and available information, the processor assists with rights, security, DPIAs and prior consultation where needed. Participant requests are referred to the controller and not independently answered except on instructions or legal requirement. The processor supplies compliance information and allows controller or authorised-auditor audits/inspections, with reasonable protection for third parties.

Incidents

The processor notifies the controller of personal data breaches without undue delay after awareness, providing nature, affected people/records where known, contact, likely consequences and measures. Information may be supplemented in stages without undue delay, cooperating in containment and assessment. Contacts/escalation are set in the annex; not every incident necessarily requires an authority notification.

Exit and retention

At termination the controller chooses return or erasure as agreed, except mandatory legal retention. This covers copies, subprocessors, technical cycles, restricted access to retained data and completion evidence. Data is not reused for other purposes. Deactivating a user account does not itself end the processing agreement or destroy study records.

Annexes required before execution

• I. Entities and authorised representatives; privacy/operational contacts and deputies; study, centres, purpose, instructions and term.
• II. People/data categories, controller-determined legal bases, operations, access and data flows; AI excluded unless its scope is expressly approved and documented.
• III. Verified security measures, configuration, responsibilities, restoration/validation evidence and service boundaries.
• IV. Authorised subprocessors, countries/support/logs, safeguards, retention, change management and return/erasure mechanisms.
• V. Category-specific retention/custody, exit, export formats, agreed deadlines and request/incident handling.