Simple

Data processing agreements

Every vendor handling customer personal data must sign the Nextbase DPA with GDPR Article 28 language mirrored in clauses 3-7.

Controllers remain accountable for the personal data we process. Before onboarding a new vendor, confirm the lawful basis and document processing instructions in the DPA schedule.

Verify Standard Contractual Clauses (SCCs) are included for any international transfers.
Confirm vendor subprocessors are disclosed and align with our Third-Party Risk Register.
Ensure audit cooperation clauses allow on-site assessments within 30 days' notice.

Vendor access controls

Reinforce access controls by mapping vendor roles to least-privilege policies and documenting revocation workflows.

Access must be provisioned through the centralized identity provider. Temporary break-glass accounts require CISO approval and expire after 24 hours.

Vendor accounts shall be reviewed every 90 days with evidence logged in the compliance workspace.
— Nextbase Vendor Security Policy

Vendor compliance reference for data processing partners

Data processing agreements

Vendor access controls

Appendices

Vendor compliance reference for data processing partners

Data processing agreements

Vendor access controls

Appendices

Appendix A — Transfer Impact Assessment ChecklistUse this checklist when evaluating data flows outside adequacy regions.