Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between Individual Entrepreneur Bogdan Shapovalov (Georgia), trading as Sellsquatch ("Processor") and the customer that uses Sellsquatch ("Controller"). It applies whenever the Processor processes personal data on behalf of the Controller in providing the service, and it is accepted together with the Terms. No signature is needed; if you need a signed copy for your records, write to support@sellsquatch.com.

1. Subject matter and details of processing

2. Instructions

The Processor processes personal data only on documented instructions from the Controller. The Terms, this DPA and the Controller's configuration and use of the service are those instructions. The Processor will tell the Controller if it believes an instruction breaks data protection law, unless the law prohibits it.

3. Confidentiality

Everyone authorised by the Processor to process the data is bound by confidentiality, and access is limited to what their role requires.

4. Security

The Processor implements the technical and organisational measures in Annex 1 and keeps them appropriate to the risk. Measures may be improved over time, but the overall level of protection will not be reduced.

5. Sub-processors

• The Controller gives general authorisation to engage sub-processors. The current list is on the sub-processors page.
• The Processor will announce new sub-processors on that page and by email to workspace owners who ask for notifications at least 14 days before they start processing. The Controller may object on reasonable data protection grounds; if the parties cannot agree, the Controller may terminate the affected service and receive a pro-rata refund of prepaid fees.
• The Processor imposes data protection obligations on each sub-processor that are no less protective than this DPA and remains responsible for their performance.

6. Assistance

Taking into account the nature of the processing, the Processor helps the Controller to answer data subject requests (the service lets the Controller find, export, correct and delete records), and with security, breach notification, data protection impact assessments and prior consultations, as far as these concern the service.

7. Personal data breaches

The Processor notifies the Controller without undue delay, and where possible within 48 hours, after becoming aware of a breach affecting the Controller's personal data, with the information the Controller needs to meet its own obligations.

8. International transfers

Customer Data is hosted in the European Union. The Processor is established in Georgia, and some sub-processors are outside the EEA. To the extent the processing involves a transfer subject to Chapter V GDPR, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, which are incorporated by reference: Module 2 (controller to processor) where the Controller is a controller, Module 3 (processor to processor) where it is a processor. For the Clauses: clause 7 (docking) applies; in clause 9 option 2 (general authorisation, 14 days' notice) applies; the optional wording in clause 11 does not apply; for clauses 17 and 18 the law and courts of Ireland apply; Annex I is section 1 of this DPA, Annex II is Annex 1 below, and Annex III is the sub-processors page. For transfers from the United Kingdom, the UK International Data Transfer Addendum applies, and for Switzerland the Clauses apply with the references adapted to the Swiss FADP.

9. Return and deletion

The Controller can export its data at any time. After the Terms end, the Processor keeps the workspace for 90 days and then deletes it, unless the law requires storage. Data in backups is deleted when the backup rotation expires (at most 6 months).

10. Audits

The Processor makes available the information necessary to demonstrate compliance with this DPA. The Controller may request written answers to reasonable security questionnaires once a year. An on-site audit is possible where the law requires it or after a breach, with 30 days' notice, during business hours and at the Controller's cost, by an auditor bound by confidentiality.

11. Liability and order of precedence

Liability under this DPA is subject to the limits in the Terms, except where the Standard Contractual Clauses or mandatory law provide otherwise. If this DPA conflicts with the Terms, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the Clauses prevail.

Annex 1. Technical and organisational measures

• Isolation: a separate database and database user for every workspace; host-only session cookies per workspace.
• Encryption: TLS 1.2+ for all connections; off-site backups encrypted before they leave the server; secrets kept outside the code repository.
• Access control: role-based permissions in the workspace, optional two-factor sign-in and sign-in IP restrictions, SSH key-only server access, administrative access limited to named staff.
• Logging: audit log of user actions in the workspace; server access and error logs.
• Availability: daily database backups with a 14-day / 8-week / 6-month rotation, stored with a different provider; monitoring of services and scheduled jobs.
• Application security: CSRF protection, rate limiting of sign-in and sign-up, hashed passwords, prompt installation of security updates.
• Data minimisation: no customer data in development or test systems.