Data Processing Addendum

Capitalised terms have the meanings given to them in GDPR. The following terms have the meanings below.

This DPA applies to processing of Customer Personal Data carried out by upDevTeam LTD on behalf of Customer in the course of providing the Service.

The parties acknowledge that, with respect to such processing, Customer is the Controller and upDevTeam LTD is the Processor.

upDevTeam LTD also processes data as Controller in respect of its own business operations (account billing, anti-abuse, marketing). The Privacy Policy describes that processing.

upDevTeam LTD will:

Customer authorises upDevTeam LTD to engage the following Sub-processors:

We will give Customer at least 30 days' notice before adding or replacing a Sub-processor by posting the change at godeskflow.com/dpa or emailing the account contact. If Customer reasonably objects on data-protection grounds, we will work in good faith to find a solution; if none can be agreed, Customer may terminate the affected Service for convenience.

We remain liable to Customer for the acts and omissions of our Sub-processors as if they were our own.

We implement and maintain technical and organisational measures appropriate to the risk, including:

Customer Personal Data is hosted in the EEA. Where transfer of Customer Personal Data outside the EEA is necessary (e.g. when a US-headquartered Sub-processor is involved), the parties incorporate the Standard Contractual Clauses by reference, with upDevTeam LTD acting as 'data exporter' for that onward transfer and the Sub-processor as 'data importer'.

Where Customer is established outside the EEA and personal data flows from upDevTeam LTD to Customer, the parties incorporate the SCCs (Module 4) for the corresponding transfer.

We complete a transfer-impact assessment for each non-EEA Sub-processor and apply supplementary measures (encryption, pseudonymisation) where the assessment recommends them.

If we receive a request from a data subject in respect of Customer Personal Data, we will not respond directly except to confirm receipt and direct the data subject to Customer. We will pass the request to Customer without undue delay.

We will provide reasonable assistance to Customer in responding to access, rectification, erasure, restriction, portability, and objection requests, taking into account the nature of the processing and the information available to us. Where the request is excessive or manifestly unfounded, we may charge a reasonable fee.

We will notify Customer without undue delay, and in any event within 72 hours of becoming aware, of a personal-data breach affecting Customer Personal Data. The notification will include the information required by Article 33(3) GDPR to the extent known, with updates as the investigation progresses.

We will cooperate with Customer to contain, investigate, and document the breach, and will not make any public statement about it without Customer's prior consent except where required by law.

We provide Customer with the information necessary to demonstrate compliance with Article 28 GDPR through (a) this DPA, (b) the security white paper available on request, and (c) the most recent third-party audit reports of relevant Sub-processors (e.g. SOC 2 reports).

If Customer reasonably believes the materials referred to in section 10.1 are insufficient, Customer may, at its cost and on at least 30 days' written notice, audit our compliance with this DPA no more than once per year (except in the event of a material breach), provided the audit (i) is conducted during normal business hours, (ii) does not disrupt our operations, (iii) is performed by an independent auditor bound by appropriate confidentiality obligations, and (iv) does not include access to facilities or data of other customers.

Audit reports are confidential information of upDevTeam LTD and may be shared only with regulators and legal advisers under confidentiality.

On termination of the Service, we will, at Customer's choice and within 30 days of the termination date, either return all Customer Personal Data in a structured electronic format or securely delete it, except to the extent retention is required by EU or member-state law.

Backup copies will be deleted in line with our standard rolling-backup retention (currently 35 days). Backups remain protected by the security measures in section 6 until they are overwritten.

Liability arising under this DPA is governed by the limitation-of-liability section of the Terms of Service.

Where Article 82 GDPR allocates liability between joint controllers, processors, and sub-processors, the parties agree to follow that statutory allocation.

This DPA takes effect on the date Customer accepts the Terms of Service and continues for as long as upDevTeam LTD processes Customer Personal Data on Customer's behalf, plus any survival period necessary to discharge obligations under sections 9, 10, and 11.

This DPA is governed by the laws of the Republic of Cyprus, except that, where the SCCs apply, the governing law identified in the SCCs prevails for matters within the SCCs' scope.

Notices under this DPA should be sent to info@godeskflow.com (data-processing matters) and to info@godeskflow.com (data-subject and supervisory-authority matters).