Data Processing Agreement

Roles

For personal data processed through the Service on your behalf, you are the Controller and Relvato is the Processor. Each party will comply with its obligations under applicable data protection laws.

Details of processing

Subject matter and duration — provision of the verification Service for the term of your subscription.

Nature and purpose — running the checks you configure against the sites you authorize, and storing the results, so we can verify your flows and alert you to failures.

Types of personal data — account contact details, and any personal data that may incidentally appear in a monitored site or in a captured screenshot or page snapshot.

Categories of data subjects — your team members and administrators, and your site's users or visitors to the extent their data appears during a check.

Processor obligations

We will: process personal data only on your documented instructions (including as set out in the Terms and this DPA); ensure persons authorized to process it are bound by confidentiality; implement appropriate technical and organizational security measures (see below); assist you, taking into account the nature of processing, in responding to data subject requests and in meeting your security, breach-notification and impact-assessment obligations; and, at your choice, delete or return personal data at the end of the service, except where retention is required by law.

Security measures

We maintain measures appropriate to the risk, including encryption of data in transit and at rest, managed encryption keys, access controls and least-privilege access, network protections, and monitoring. We regularly review these measures.

Sub-processors

You authorize Relvato to engage the sub-processors listed at /trust to process personal data in connection with the Service. That page identifies each sub-processor, its purpose and its data location, and is kept current. We impose data protection obligations on our sub-processors substantially similar to those in this DPA, and we remain responsible for their performance. We will make the up-to-date list available and provide a means to be notified of changes; you may object to a new sub-processor on reasonable data protection grounds.

International transfers

Relvato runs its compute in the European Union and stores some data in the United States. Where personal data is transferred outside the EEA or UK, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant). Data locations are shown on the sub-processors page.

Data subject requests

Taking into account the nature of the processing, we will assist you by appropriate technical and organizational measures, insofar as possible, to respond to requests from data subjects to exercise their rights. If we receive such a request directly, we will direct the individual to you unless legally required to act.

Personal data breach

We will notify you without undue delay after becoming aware of a personal data breach affecting your personal data, and provide information reasonably available to help you meet your notification obligations.

Deletion and return

On termination or expiry of the Service, and at your choice, we will delete or return the personal data we process on your behalf, except to the extent we are required by law to retain it. Routine check artifacts are pruned in the ordinary course.

Audit

We will make available information reasonably necessary to demonstrate compliance with this DPA and, on reasonable prior notice and subject to confidentiality, allow for and contribute to audits, which may be satisfied by up-to-date documentation and certifications where available.

Liability and contact

Each party's liability under this DPA is subject to the limitations in the Terms. For any data protection question or to exercise the notification options above, contact Relvato Inc at contact@relvato.com.