When a DPA applies
Most of the time, IK Studios is the controller of the personal data it handles. A Data Processing Agreement (DPA) is relevant where you are a controller and we process personal data on your behalf as a processor — for example under certain business arrangements. This page summarises our DPA framework; a signed DPA governs once in place.
Roles
Under a DPA, you are the controller and decide the purposes and means of processing; IK Studios is the processor and acts on your documented instructions. We remain the controller for data we process for our own purposes, such as billing and security.
Our commitments as processor
Our standard DPA commits us to:
- Process personal data only on your documented instructions.
- Ensure people authorised to process it are bound by confidentiality.
- Implement appropriate technical and organisational security measures.
- Engage subprocessors only under equivalent obligations, with notice of changes — see the Subprocessor List.
- Assist you with data-subject requests and with your own security and DPIA duties.
- Notify you without undue delay of a personal-data breach affecting your data.
- Delete or return personal data at the end of the engagement, subject to legal retention.
- Make available information needed to demonstrate compliance and allow for audits as the GDPR requires.
International transfers
Where processing involves transfers outside the EEA, our DPA incorporates Standard Contractual Clauses and appropriate safeguards.
Requesting a signed DPA
Email support@ikstudios.nl with your company details and we will provide our standard DPA for signature. For Vault One enterprise arrangements, see also the Vault One DPA.