Data Processing Agreement

1. Scope and roles

This DPA applies to personal data DPAS processes on behalf of the customer in the course of providing the service. The customer is the controller; DPAS is the processor and processes personal data only on the customer's documented instructions.

2. Confidentiality and security

DPAS keeps personal data confidential and applies the technical and organizational measures described on the Security page, including tenant isolation, hardened access rules, encrypted transport, and audit logging.

3. Subprocessors

DPAS uses the subprocessors listed below to deliver the service. We will inform customers of changes to this list so they can object where their agreement allows.

4. Data subject requests

DPAS assists the customer in responding to data-subject requests, including access and erasure, through the data-export and data-erasure capabilities of the service.

5. Personal data breach

If DPAS becomes aware of a personal data breach affecting customer data, it will notify the affected customer without undue delay and provide the information the customer needs to meet its own notification duties.

6. Return and deletion

On termination of the service the customer may export its data, after which DPAS will delete or return customer personal data in accordance with the agreement and applicable law.

Current subprocessors