Data Processing Addendum

For personal data relating to a customer's end users, the customer is the controller and Certivo is the processor. Each party complies with applicable data-protection law in respect of its role.

Certivo processes personal data only on the customer's documented instructions, including as set out in this DPA and the Order Form, unless required otherwise by law (in which case Certivo notifies the customer where legally permitted). The subject matter, duration, nature and purpose of processing, and the categories of data and data subjects, are described in Annex A.

Certivo ensures that personnel authorised to process personal data are bound by appropriate confidentiality obligations and are trained on their data-protection responsibilities.

Certivo implements the technical and organisational measures described in Annex B and on our Security page, appropriate to the risk of the processing.

The customer grants a general authorisation for Certivo to engage sub-processors to deliver the Services. Certivo maintains a current list of sub-processors on our Sub-processors page, imposes data-protection terms on them consistent with this DPA, remains responsible for their performance, and provides advance notice of changes with an opportunity to object.

Taking into account the nature of the processing, Certivo assists the customer with appropriate technical and organisational measures to respond to data-subject requests to exercise their rights.

Certivo notifies the customer without undue delay after becoming aware of a personal-data breach affecting the customer's data, and provides reasonable information to assist the customer in meeting its own notification obligations.

On termination or expiry of the Services, Certivo deletes or returns the customer's personal data at the customer's choice, and deletes existing copies unless retention is required by law.

Certivo makes available information reasonably necessary to demonstrate compliance with this DPA and, subject to confidentiality and reasonable notice, allows for and contributes to audits conducted by the customer or an appointed auditor.

Where processing involves a transfer of personal data across borders, the parties rely on an appropriate transfer mechanism such as the Standard Contractual Clauses or an applicable adequacy decision.

Measures include encryption in transit and at rest, role-based access control with least-privilege, tenant isolation, append-only audit logging, secure development practices, vulnerability management, and business-continuity backups. These are described further on our Security page.