Data processing agreement (DPA)
How RO Vision Media processes data on Next M's behalf under Article 28 GDPR.
01Roles
Next M is the controller of the data in the NextX platform and RO Vision Media is the processor. The data processing agreement is part of the contract between the two companies; this document summarises its main obligations.
02Subject matter and data
Hosting, storing, organising, transmitting, securing, backing up and deleting platform data. Data subjects: Next M employees, contractors and users; contacts at clients, stores and suppliers; representatives who sign documents. No special categories of data are processed.
03Instructions and confidentiality
RO Vision Media processes data only on Next M's documented instructions, including on transfers outside the European Economic Area, and tells Next M if an instruction appears to breach the law. Staff with access to the data are bound by confidentiality.
04Subprocessors
Next M has authorised the subprocessors in POL-08. Any addition or replacement is notified to Next M at least 15 days before it gets access to data, and Next M may raise a reasoned objection.
05Breaches
RO Vision Media notifies Next M of any personal data breach without undue delay and, where feasible, within 24 hours of becoming aware of it, then provides the required information as it becomes available. Next M, as controller, notifies the supervisory authority within 72 hours where required.
06Assistance and audit
RO Vision Media helps Next M answer data subject requests and carry out impact assessments, and makes available the information needed to demonstrate compliance, including through audits.
07Termination
When the contract ends, Next M may request a data export, delivered within 10 working days. The data is then deleted from live systems within 30 days, except where the law requires it to be kept.