Need a signed copy? Our DPA is incorporated into every customer agreement. To receive a countersigned PDF, email [email protected] with your company name and agreement reference.
1. Scope and roles
The DPA applies when Techriver processes personal data on behalf of a customer in providing our products and services. The customer acts as controller (or as processor on behalf of its own controllers) and Techriver acts as processor (or sub-processor). It supplements the customer agreement and prevails over it on data protection matters.
2. Processing on instructions
We process customer personal data only on the customer’s documented instructions, including those set out in the customer agreement and product configuration, and only for the purpose of providing the services. We will inform the customer if we believe an instruction infringes applicable data protection law.
3. Confidentiality
Everyone authorized to process customer personal data is bound by confidentiality obligations and receives appropriate data protection training.
4. Security measures
We implement appropriate technical and organizational measures to protect customer personal data, including encryption in transit and at rest, access controls, logging and monitoring, and business continuity planning. They are described in our Security Whitepaper and in the DPA’s security annex.
5. Sub-processors
The customer gives general authorization for us to engage sub-processors. Each one is bound by data protection terms at least as protective as the DPA, and we remain responsible for their performance. We give at least 30 days’ notice before adding or replacing a sub-processor, and the customer may object on reasonable data protection grounds.
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, content delivery, network security | Global network, USA |
| Brevo (Sendinblue SAS) | Transactional and service email delivery | European Union (France) |
Product-specific sub-processors are listed in the relevant order form.
6. Data subject requests
Taking into account the nature of the processing, we assist customers in responding to requests from individuals exercising their data protection rights. If we receive such a request directly, we redirect it to the customer.
7. Personal data breach notification
We notify the customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting customer personal data. We provide the information the customer reasonably needs to meet its own notification obligations and take steps to contain and remedy the breach.
8. International transfers
Where customer personal data is transferred outside the EEA, UK, or Switzerland to a country without an adequacy decision, the transfer is covered by the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or another valid transfer mechanism, together with supplementary measures where appropriate.
9. Audits
We make available the information needed to demonstrate compliance with the DPA, primarily through documentation of our security measures and responses to reasonable security questionnaires. Where those are insufficient, customers may conduct an audit on reasonable notice, no more than once per year unless required by a regulator or following a breach.
10. Return and deletion
When the services end, we delete or return customer personal data at the customer’s choice, unless storage is required by law. Data in backups is deleted in the normal backup rotation cycle.
11. Impact assessments
We provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities relating to our services.
12. Contact
DPA, data protection, and privacy requests: [email protected]