Data processing agreement (DPA)
The terms that apply when Oblivion handles personal data on behalf of a business client.
Roles and scope
When we provide a service that involves personal data under a client's instructions, the client is the controller and Oblivion is the processor, in accordance with Article 28 of the GDPR. The subject, duration, type of data and data subjects are set out in the contract or service order.
Our commitments
We process data only on documented instructions, ensure that authorized people are bound by confidentiality, apply appropriate security measures, assist the client with data subject requests and security obligations, and make available the information needed to demonstrate compliance, including reasonable audits.
Sub-processors
The client authorizes the use of Google, Cloudflare and Stripe where relevant to the service. We will inform the client of intended changes so it can object, and we bind each sub-processor to equivalent obligations.
International transfers
Transfers outside the European Economic Area take place only with an adequacy decision or another valid safeguard, such as the European Commission's standard contractual clauses.
Security incidents
We will notify the client without undue delay after becoming aware of a personal data breach, with the information available to support its own obligations.
End of the service
At the end of the service we will return or delete the personal data, as the client chooses, unless the law requires us to keep it.
Signed version
Business clients can request a version for signature at contact@obliviondh.com.