Data Processing Agreement

1. Definitions

2. Subject matter and nature of processing

3. Processor obligations

OpenSassy agrees to:

• Process personal data only on your documented instructions, including instructions about international transfers. These include this DPA, the services and settings you select, and other instructions recorded in writing. If UK law requires different processing, inform you of that requirement before processing unless the law prohibits that notice on important grounds of public interest
• Immediately inform you if, in our opinion, an instruction infringes UK GDPR or other applicable data protection law, and pause the affected instruction while it is clarified or corrected
• Ensure anyone authorised to process the data is bound by confidentiality
• Implement appropriate technical and organisational security measures (Article 32) — see §5
• Taking account of the processing, assist you through appropriate technical and organisational measures, where possible, with requests to exercise data subject rights under Chapter III
• Taking account of the processing and information available to us, assist you with security, breach notifications, data protection impact assessments and any required prior consultation with the regulator under Articles 32–36. This includes providing available incident details, relevant security information and information about our processing needed for your assessment
• Engage sub-processors only under the authorisation and equivalent data protection obligations in §4
• At your choice, return or securely delete the personal data we process on your behalf within 30 days of contract termination, and delete existing copies, unless UK law requires retention. Any required retention is limited to that legal purpose; our own billing records are treated separately under the Privacy Policy
• Provide the information and audit cooperation described in §7
• Notify you without undue delay after becoming aware of a personal data breach affecting your data. We will share available information promptly and provide further details as they become available; we will not wait for a completed investigation before notifying you

4. Sub-processors

By agreeing to this DPA, you give general written authorisation for the sub-processors below to process data for the services you select. We will give you at least 30 days' notice of an intended addition or replacement, so you can object on reasonable data protection grounds before the change. We will discuss the objection and an alternative; if it cannot be resolved, you may discontinue the affected service before that provider receives your data.

We must bind each sub-processor by a written contract imposing equivalent Article 28 data protection obligations, including appropriate security guarantees. We remain responsible to you for its performance of those obligations. A provider may act as a separate controller for some purposes, such as Stripe's fraud prevention; its own notice applies to that processing.

The table distinguishes known transfer arrangements from evidence still requiring verification. A provider's standard data processing agreement alone does not establish the safeguard for an international transfer. Primary EEA hosting also does not rule out access or onward processing elsewhere. See Privacy Policy §6 for the transfer rules and how to request the applicable safeguards.

5. Security measures

• Encryption in transit (TLS) between your browser/app and our servers, and between our services and our database
• Application-layer organisation scoping and access checks to separate business records
• Role-based access controls for staff accounts
• Secrets (API keys, credentials) held in Google Cloud Secret Manager, never in source code
• Primary database hosting in the EEA and application compute in Belgium; external providers' processing locations are described in §4
• Regular backups

6. Controller obligations

As Controller, you are responsible for:

• Having a lawful basis to collect and input your clients' and staff's personal data into OpenSassy
• Giving your clients and staff your own privacy notice covering how you use OpenSassy to process their data
• Obtaining any consent the platform requires on your behalf (e.g. AI-processing or marketing consent captured at your clients' sign-up)
• Responding to your clients'/staff's data subject rights requests (we will assist you, and provide self-service tools where available)
• Ensuring the personal data you input is accurate and that you don't input special category data (health, etc.) without first agreeing this with us — see §2
• Telling us promptly if you believe a sub-processor or our processing has caused a breach affecting your data

7. Audits

We will make available all information necessary to demonstrate compliance with our Article 28 obligations, and allow and contribute to audits, including inspections, conducted by you or an auditor you appoint.

Contact us to arrange the scope, timing and confidentiality measures needed to protect other customers' data and platform security. These arrangements must not prevent an effective audit, delay an urgent investigation or restrict a regulator's powers. We will cooperate with findings relevant to our obligations and provide information about corrective action.

8. Contact

Data protection enquiries: hello@the-sassy.com

ANDUMA Intelligence Group Ltd, trading as OpenSassy.