Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Controller", "you") and Omniroq ("Processor", "we") and reflects the parties' agreement on the processing of personal data under the GDPR and UK GDPR. Where you use the Services to process personal data about your contacts and customers, you are the controller and we are your processor.

1. Definitions

"Personal Data", "Processing", "Data Subject", "Controller", "Processor", and "Supervisory Authority" have the meanings given in the GDPR. "Customer Personal Data" means personal data within the Customer Data that we process on your behalf.

2. Roles & scope

You are the Controller (or a processor acting for a third-party controller) and we are the Processor. We process Customer Personal Data only on your documented instructions, including as set out in the Terms, this DPA, and your use of the Services' features and settings.

3. Subject-matter & details of processing

4. Our obligations

• Process Customer Personal Data only on your documented instructions, unless required by law (in which case we will inform you unless legally prohibited);
• Ensure persons authorized to process the data are bound by confidentiality;
• Implement appropriate technical and organizational measures (Art. 32) — see our Trust & Security page;
• Assist you, taking into account the nature of processing, with data-subject requests and with your obligations under Arts. 32–36 (security, breach notification, impact assessments);
• Notify you without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data;
• At your choice, delete or return Customer Personal Data at the end of the services, and delete existing copies unless retention is required by law;
• Make available information reasonably necessary to demonstrate compliance and allow for audits as described below.

5. Sub-processors

You provide general authorization for us to engage sub-processors to support the Services. Current sub-processors are listed at Sub-processors. We impose data-protection obligations on sub-processors that are no less protective than this DPA and remain responsible for their performance. We will give notice of intended changes and you may object on reasonable data-protection grounds.

6. International transfers

Where processing involves transfer of Customer Personal Data outside the EEA/UK, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, which are incorporated by reference where applicable.

7. Data-subject requests

Taking into account the nature of the processing, we will assist you by appropriate technical and organizational measures, insofar as possible, to respond to requests from data subjects exercising their rights. If we receive such a request directly, we will advise the data subject to contact you.

8. Audits

We will make available information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable notice, confidentiality, and frequency limits, and in a manner that does not compromise the security of other customers.

9. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms.

10. Order of precedence

In the event of a conflict between this DPA and the Terms regarding the processing of Customer Personal Data, this DPA prevails.

11. Requesting a signed copy

To request a countersigned copy of this DPA or to discuss specific data-protection requirements, contact [email protected].