1. Scope and roles
This Data Processing Addendum (“DPA”) forms part of the Terms and applies when we process personal data contained in Customer Data on your behalf. You are the controller and we are the processor of that personal data.
2. Processing instructions
We process Customer Personal Data only on your documented instructions, including as set out in the Terms and through your configuration of the Services, unless required otherwise by law. We will inform you if we believe an instruction violates applicable data protection law.
3. Confidentiality and personnel
Personnel authorized to process Customer Personal Data are bound by confidentiality obligations and receive appropriate data protection training.
4. Security measures
- Encryption of data at rest (AES-256) and in transit (TLS 1.2 or higher).
- Role-based, least-privilege access with multi-factor authentication.
- Logical isolation between customers and immutable audit logging.
- Continuous monitoring, vulnerability management and incident response.
- Business continuity and disaster recovery planning and testing.
5. Subprocessors
You authorize us to engage subprocessors under written agreements with data protection obligations no less protective than this DPA. Our current subprocessor list is available to customers under NDA on request, and we will notify you of new subprocessors with an opportunity to object on reasonable grounds.
6. Data subject requests
Taking into account the nature of processing, we will assist you with appropriate technical and organizational measures to respond to requests from individuals exercising their data protection rights.
7. Personal data breaches
We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provide information reasonably required for you to meet your obligations.
8. International transfers
Where Customer Personal Data is transferred internationally, the parties agree to the applicable standard contractual clauses or another lawful transfer mechanism. You may restrict processing to specific regions using region pinning.
9. Audits
We will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of independent assessments under NDA, and allow for audits as required by applicable law.
10. Return and deletion
On termination, we will delete or return Customer Personal Data in accordance with the Terms, unless retention is required by law.