Processor obligations under GDPR Art. 28
core
Categories of data processed
PII · financial
Categories of data subjects
office staff · residents
Sub-processors list
Supabase · Stripe · Twilio · Resend · Viva
Sub-processor change notification
30 days
Security measures
TOM · Annex II
International transfers
EU-region only
Data breach notification
without undue delay
Audit rights
annual
Data return / deletion on termination
30 days
Legal · DPA
Data Processing Addendum.
If your office needs a written GDPR processor agreement, this is it. Reach out and we'll send the signed PDF the same day.
What it covers
Standard processor commitments.
How to request
Two-day turnaround.
Send us a request
Email dpa@nestio.gr from your office address with your legal entity name and contact. We send back a counter-signed PDF within two business days.