Data Processing Agreement (DPA)

Introduction

This Data Processing Addendum (“DPA”) forms part of the Terms of Use between Respona and the customer identified in the applicable account or order form (“Customer”).

This DPA applies where Respona processes Personal Data on behalf of the Customer in connection with the Services.

Scope. Licensed Software is operated by the Customer on its own servers. Form responses and operational records that remain in your environment are not processed by Respona under this DPA. This DPA applies to support diagnostics, correspondence, or other Customer Content uploaded to the Account Services.

Definitions

“Customer Personal Data” means Personal Data that Respona processes on behalf of the Customer while providing the Services.

“Personal Data” has the meaning given in applicable privacy laws (GDPR, KVKK, and similar).

“Sub-processor” means a third party engaged to process Customer Personal Data.

Controller, Processor, and Data Subject have the meanings given in applicable privacy laws.

Processing of personal data

With respect to Customer Personal Data, the Customer is the Controller and Respona is the Processor. Respona will:

• (a) process the Data only to provide, secure, and support the Services;
• (b) not use the Data for other purposes except as required by law;
• (c) not “sell” the Data or combine it except as permitted;
• (d) inform the Customer if it believes an instruction violates applicable laws.

The Customer warrants that it has a lawful basis for processing and that its instructions are lawful.

International transfers

For international transfers, an appropriate transfer mechanism is provided under applicable privacy laws, including Standard Contractual Clauses.

Confidentiality of processing

Persons authorized to process Personal Data are subject to confidentiality obligations.

Security

Appropriate technical and organizational measures are applied to protect Customer Personal Data, including access control, TLS, logging, vulnerability management, and incident response processes.

For Licensed Software deployments, the Customer is responsible for complementary measures in its environment.

Sub-processing

The Customer authorizes the engagement of Sub-processors. Sub-processors may include hosting, email delivery, and support tools. A list is available on request at [email protected].

Cooperation and data subject rights

To the extent reasonably possible, assistance is provided so the Customer can respond to Data Subject requests. If a request is received directly, it is redirected or the Customer is notified.

Security incidents

After becoming aware of a security incident affecting Customer Personal Data, the Customer is notified without undue delay. Reasonable steps are taken to mitigate the incident.

Deletion or return of data

Upon termination of the Services or upon written request, Customer Personal Data is deleted or returned, except where law requires retention.

Audit rights

Upon reasonable written notice, information necessary to demonstrate compliance with this DPA is made available. Audits must be reasonable and protect other customers’ confidential information.

Prohibited data types

Unless expressly supported, the Customer will not instruct processing of special-category data or data relating to children.

Duration of processing

Processing continues for the term of the Agreement and for the period needed after termination for deletion or legal retention.

Annex I – Description of processing

Subject matter: Processing of Personal Data contained in materials submitted for support, license management, or account operations.

Data types: Names, email addresses, company names, IP addresses, device metadata, license identifiers, and — only if included in uploads — form metadata or error-log excerpts.

Purpose: To provide support and Account Services; not to operate form data on the Customer’s own servers.

Annex II – Security measures

• access control and least-privilege administration;
• encryption of data in transit (TLS);
• network isolation and firewalling;
• logging of administrative access;
• vulnerability management and dependency updates;
• backup and recovery procedures;
• staff confidentiality and security awareness.