← Back to home

Data Processing Addendum — Template

Last updated: 12 September 2026

During an engagement, HorGe may process personal data on a client’s behalf. Client legal teams usually request a Data Processing Addendum (DPA) early. This page is the template we work from; the executed version is completed and signed per engagement. It follows Article 28 GDPR.

1. Subject matter and duration

Processing covers the personal data the Client makes available to HorGe for the purposes of the consulting engagement described in the signed Statement of Work, for the duration of that engagement.

2. Nature and purpose of processing

Analysis, transformation, and processing of Client data as necessary to deliver the contracted services: process analysis, automation design, AI system integration, evaluation, and training. No processing for HorGe’s own purposes.

3. Types of data and categories of data subjects

Defined per engagement in Annex 1 of the executed DPA. Typically: business contact data of Client employees and, where in scope, data contained in the business documents and systems being analysed. Special categories of data are excluded unless expressly agreed in writing with additional safeguards.

4. Obligations of HorGe (processor)

• Process personal data only on the Client’s documented instructions.
• Ensure persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (Art. 32).
• Assist the Client in responding to data-subject requests and in meeting its Art. 32–36 obligations.
• Notify the Client without undue delay after becoming aware of a personal data breach.
• Maintain a record of processing activities carried out for the Client.

5. Sub-processors

No sub-processor is engaged without the Client’s prior written authorisation. Approved sub-processors are listed in Annex 2; HorGe remains fully liable for their performance.

6. International transfers

Personal data is processed within the EEA by default. Any transfer outside the EEA requires the Client’s approval and a valid transfer mechanism (adequacy decision or standard contractual clauses).

7. Audit rights

HorGe makes available the information necessary to demonstrate compliance with Article 28 and allows for audits, including inspections, conducted by the Client or an auditor mandated by the Client, on reasonable notice.

8. Deletion on termination

At the end of the engagement, at the Client’s choice, HorGe deletes or returns all personal data and deletes existing copies, unless EU or Member State law requires storage.

9. Governing law

The executed DPA is governed by the law chosen in the main engagement agreement; data protection obligations are interpreted in line with the GDPR.

To request this template as a document for legal review, email cousinspree@horgebv.com with the subject “DPA template”.