Data Processing Addendum

This Addendum records the terms required by Article 28 of the EU GDPR (and, where applicable, the UK GDPR) for processing carried out by Certivo on the customer's behalf, and is read together with the Cyprus Data Protection Law 125(I)/2018. For personal data relating to a customer's end users, the customer is the controller and Certivo is the processor. Each party complies with applicable data-protection law in respect of its role. Where this Addendum and the Terms conflict on the processing of personal data, this Addendum prevails.

Certivo processes personal data only on the customer's documented instructions, including as set out in this DPA and the Order Form, unless required otherwise by law (in which case Certivo notifies the customer where legally permitted). The subject matter, duration, nature and purpose of processing, and the categories of data and data subjects, are described in Annex A.

Certivo ensures that personnel authorised to process personal data are bound by appropriate confidentiality obligations and are trained on their data-protection responsibilities.

Certivo implements the technical and organisational measures described in Annex B and on our Security page, appropriate to the risk of the processing.

The customer grants a general authorisation for Certivo to engage sub-processors to deliver the Services. Certivo maintains a current list of sub-processors on our Sub-processors page, imposes data-protection terms on them consistent with this DPA, remains responsible for their performance, and provides advance notice of changes with an opportunity to object.

Taking into account the nature of the processing, Certivo assists the customer with appropriate technical and organisational measures to respond to data-subject requests to exercise their rights.

Certivo notifies the customer without undue delay after becoming aware of a personal-data breach affecting the customer's data, and provides reasonable information to assist the customer in meeting its own notification obligations.

On termination or expiry of the Services, Certivo deletes or returns the customer's personal data at the customer's choice, and deletes existing copies unless retention is required by law.

Certivo makes available information reasonably necessary to demonstrate compliance with this DPA and, subject to confidentiality and reasonable notice, allows for and contributes to audits conducted by the customer or an appointed auditor.

Where processing involves a transfer of personal data outside the European Economic Area (EEA), the parties rely on an appropriate transfer mechanism — an EU adequacy decision or the EU Standard Contractual Clauses — together with a transfer risk assessment and any supplementary measures required to protect the data.

Any breach by Certivo of its obligations under this Addendum is treated as a breach of the Terms. Certivo's liability under this Addendum is subject to the limitations of liability in the Terms of Service.

Measures include encryption in transit and at rest, role-based access control with least-privilege, tenant isolation, append-only audit logging, secure development practices, vulnerability management, and business-continuity backups. These are described further on our Security page.