תבנית DPA דו-לשונית: הסכם עיבוד מידע למיקור חוץ

English

This Agreement is entered into between [Organization Name] ("Controller") and [Vendor Name] ("Processor"), and governs Processor's processing of personal information on Controller's behalf, in connection with the services described in [reference to the main services agreement / exhibit].

English

Processor may process only the following categories of personal information: [list]. Processing is permitted solely for the following purposes: [list]. Processing for any other purpose, or of data types not listed, is prohibited without Controller's prior written consent.

English

Processor's access is limited to the following systems/environments: [list]. Access will be granted only to pre-approved authorized users and revoked immediately upon termination of their role or of this Agreement.

English

The permitted processing operations are: [list, e.g. storage, backup, analytics, customer support]. Any operation not listed, including use for development, model training, or marketing, is prohibited unless expressly stated otherwise.

English

Term: [start date and termination conditions]. Within [number] days of termination, Processor shall return the information to Controller or destroy it, at Controller's election, and provide written confirmation of destruction or return.

English

Processor undertakes to implement all information security measures required of a holder under the Israeli Privacy Protection (Data Security) Regulations, 5777-2017, commensurate with the database's applicable security tier, and to follow Controller's additional instructions: [specific instructions, if any].

English

Processor shall obtain from each of its authorized personnel a signed written undertaking to maintain confidentiality of the information, use it solely in accordance with this Agreement, and implement the security measures set out herein.

English

Processor shall not engage a sub-processor for services involving access to the database without Controller's prior written approval, and shall in any event impose all obligations set out in this Agreement on such sub-processor under a binding written agreement.

English

Processor shall report to Controller, at least annually, on its compliance with this Agreement and the applicable regulations, and shall notify Controller without delay of any information security incident relating to the information covered by this Agreement.

English

If Processor, or any sub-processor, processes the information outside of Israel, it undertakes to comply, subject only to such changes as the circumstances require, with the terms governing retention and use of information applicable to a database located in Israel, including: a prohibition on use beyond the stated purpose of transfer; data subjects' rights of access, correction, and deletion; a duty of confidentiality; and compliance with the Data Security Regulations or an equivalent certification (such as ISO/IEC 27001) covering the relevant controls.

English

Controller may, upon reasonable prior notice, audit and monitor Processor's compliance with this Agreement and the applicable regulations, including by requesting documentation, certifications, or an inspection, commensurate with the risk level of the engagement.

English

Processor shall indemnify Controller for any damage arising from Processor's breach of this Agreement, including unauthorized processing, a security incident resulting from breach of this Agreement, or non-compliance with confidentiality obligations.

English

This Agreement shall be governed by the laws of the State of Israel, and the competent courts of [city] shall have exclusive jurisdiction over any matter arising herefrom.