Data Processing Addendum
Article 28 GDPR structure for customer-controlled monitoring data. Execution is blocked until the legal operator identity is provided.
Scope, duration and purpose
Processing lasts for the customer contract plus documented deletion time and is limited to executing browser scenarios, retaining selected evidence, diagnosing failures, notifying operators and securing the service.
Data and people
Data may include test credentials, identifiers, form content, displayed page content, URLs, screenshots, timing and errors. Data subjects may include customer staff and test users. Customers must minimize and avoid production personal data where possible.
Instructions and confidentiality
SHEMANE processes data only on documented customer instructions, including configured scenarios and support requests, unless law requires otherwise. Authorized personnel and suppliers are bound by confidentiality.
Security measures
Measures include tenant RLS, private evidence storage, server-only privileged keys, constrained browser actions, private-network blocking, controlled egress, queue integrity and redaction. Application-level secret encryption remains a production prerequisite.
Subprocessors and transfers
The current list is published on the Subprocessors page. Customers receive reasonable advance notice of material additions and can object on legitimate data-protection grounds. Transfer mechanisms and vendor DPAs must be recorded before commercial processing.
Assistance and breaches
SHEMANE assists with rights requests, security, DPIAs, consultations and breach response. A processor-side personal-data breach is reported to the affected customer without undue delay.
Deletion, return and audit
At the customer’s choice and subject to law, monitoring data is returned through export and deleted on termination. SHEMANE provides information reasonably needed to demonstrate Article 28 compliance and supports proportionate confidential audits.
Last substantive version: 2026-09-16. Seek qualified Belgian legal advice before relying on this draft for commercial contracting.