Ready-to-sign GDPR Article 28 data processing agreement for universities, hospitals and research groups that commission statistical analysis or manuscript review, with the full list of sub-processors.
If your institution hires me to analyze data from your participants, or to review manuscripts that contain them, I act as the processor and your institution as the controller. Article 28 of the GDPR requires a contract between the two. This is the one I sign, published here so your legal office can review it without waiting for anyone.
It is a ready-to-sign template, not a legal opinion: your institution’s legal office will usually want to review it or replace it with its own, and I sign yours without any problem. If you have your own template, send it and I return it signed. Institutions outside the European Economic Area (the United Kingdom, the United States, Canada, Australia) can attach whatever transfer framework their legal office requires.
CIUDAD SERVICES C.B. · Tax ID (CIF) E98777006 · C/ Rodríguez de Cepeda, 25, 12, Valencia (Spain) · victor.ciudad@beetrics.com
The CONTROLLER commissions CIUDAD SERVICES C.B. (hereinafter, the PROCESSOR) to carry out the processing of personal data needed to provide the services contracted: statistical analysis, methodological review of manuscripts and academic work, defense preparation, and the automated reports generated by the website’s tools.
The PROCESSOR processes the data solely to provide that service. It does not use the data for any purpose of its own, for profiling or for training artificial intelligence models, and it does not disclose the data to third parties other than the sub-processors listed in the annex.
This agreement takes effect on signature and remains in force for as long as the service is provided. When the commission ends, clause 9 applies.
Nature: processing on behalf of the controller, with no decisions taken on the purposes or on the essential means.
Categories of data subjects: participants in the CONTROLLER’s studies, and the CONTROLLER’s own research staff.
Types of data: the data contained in the datasets and manuscripts the CONTROLLER provides, and identification and contact data of the research staff.
Special categories of data: the service is designed to work with anonymized or pseudonymized data. If a dataset contains health data or other categories under Article 9 GDPR, the CONTROLLER will state so in writing before delivery, and both parties will agree on any additional measures required.
The PROCESSOR processes the data only on the documented instructions of the CONTROLLER, including with regard to international transfers. If Union or Member State law requires it to process the data otherwise, it will inform the CONTROLLER before processing, unless that law prohibits such information on important grounds of public interest.
The PROCESSOR will immediately inform the CONTROLLER if, in its opinion, an instruction infringes the GDPR or other data protection law.
The PROCESSOR keeps confidential all the data it has access to, and that obligation continues indefinitely after the agreement ends.
The PROCESSOR provides the service in person. No additional staff have access to the data; should that change, they will be required to sign the same confidentiality commitment before being given access.
The PROCESSOR will also sign the CONTROLLER’s own confidentiality agreement if requested.
The PROCESSOR applies the following measures: encryption in transit (TLS) for all communications; encryption at rest in the database and in the provider’s storage; restricted access through authentication, with service keys never exposed to the browser; role-based access control in the database; logging of operations; and backups managed by the database provider.
Effective data minimization: manuscripts (text and file) are NOT kept on the PROCESSOR’s servers, including in user accounts. The text is processed to produce the review and discarded when it is finished. For paid reports it is stored temporarily, encrypted and linked to the payment, only while the payment is completed and the report is generated, and it is deleted as soon as the report has been generated and in any case after 24 hours. The resulting report, with the verbatim quotations it contains, is kept for 30 days linked to the payment so the user can retrieve it, and in their account until the user deletes it. The copy of the manuscript that allows it to be reopened is kept only in the user’s browser.
The PROCESSOR does not send the data to any artificial intelligence model that uses it for training. The paid contracts with the AI providers expressly exclude that use.
The text first goes through an intermediary that requires zero-retention servers on every request; only if it is unavailable does it go directly to the AI provider, which keeps its abuse logs for the period stated in the annex and then deletes them. Neither the manuscript nor the review is sent by email to the person who provides the manuscript: they are viewed on the website and, if the user has an account, in it. If they pay for the Professional report, they receive a single email with the link to return to it, without the manuscript or the report inside.
The CONTROLLER gives general authorization for the sub-processors listed in the annex. The PROCESSOR will give notice of any addition or replacement at least thirty days in advance, and the CONTROLLER may object on reasoned grounds within that period.
A contract with each sub-processor imposes the same data protection obligations set out here. The PROCESSOR remains fully liable to the CONTROLLER for the sub-processors’ compliance.
International transfers: sub-processors located outside the European Economic Area process the data under standard contractual clauses approved by the European Commission, with the supplementary measures that apply.
The PROCESSOR assists the CONTROLLER in responding to requests to exercise the rights of access, rectification, erasure, restriction, portability and objection. If a data subject exercises a right with the PROCESSOR, it will forward the request to the CONTROLLER within three working days at most.
The PROCESSOR will notify the CONTROLLER of any personal data breach without undue delay and in any case within twenty-four hours of becoming aware of it, with the information the CONTROLLER needs to comply with Articles 33 and 34 GDPR.
The PROCESSOR cooperates in the data protection impact assessments and prior consultations with the supervisory authority that the CONTROLLER has to carry out.
When the service ends, the PROCESSOR will return the data and the results of the processing to the CONTROLLER and delete any existing copy from its systems, unless the law requires them to be kept, in which case it will block them for the corresponding legal period.
At the CONTROLLER’s request, the PROCESSOR will issue a written certificate of deletion.
The PROCESSOR makes available to the CONTROLLER all the information needed to demonstrate compliance with these obligations, and allows for and contributes to audits and inspections, by the CONTROLLER or by an auditor it appoints, with reasonable notice and without disproportionate interference with the activity.
Each party is liable for the damage caused by the breach of its own obligations, in accordance with Article 82 GDPR.
This agreement is governed by Regulation (EU) 2016/679, by Spanish Organic Law 3/2018 and by Spanish law. The parties submit to the courts that have jurisdiction under the law.
These are all the providers that may process data while the service is provided, what for, and with which safeguard if they are outside the European Economic Area. The text of the manuscript is received by OpenRouter, OpenAI, Google and, only as the last resort, Anthropic; it passes through Vercel’s server functions, and Supabase stores it encrypted only while a Professional Review is being paid for. Resend and Stripe do not receive it.
Write to me with the name of your institution and who signs, and I will return it signed within 24 working hours. If your legal office prefers its own template, send it and I will sign that one.
Spanish version · Statistical consulting