Octeth Care Data Processing Agreement

Scope & Roles

For personal data stored on the Managed Server and in its backups, you are the controller and Octeth is your processor. Where you are yourself a processor acting for your own clients, Octeth is your subprocessor and you confirm that your clients have authorized this.

For the purposes of the CCPA, Octeth acts as your service provider and will not sell or share the personal data, or retain, use, or disclose it for any purpose other than delivering Octeth Care.

This DPA does not cover personal data that Octeth processes as a controller, such as your account and billing contacts, which is covered by our Privacy Policy.

Details of the Processing

• Subject matter and purpose. Maintaining the Managed Server: hardening, updates, upgrades, backups, restore tests, restores, monitoring, and handling your service requests, as described in the Agreement.
• Nature of processing. Storage of encrypted backups, transfer of backups off the Managed Server, restoration of backups, and incidental access to data on the Managed Server while performing administrative tasks. Octeth does not use the data for any purpose of its own.
• Categories of data subjects. Your subscribers and contacts, and those of your clients; users of your Octeth installation.
• Categories of personal data. Whatever you and your users store in the Octeth installation, typically email addresses, phone numbers, names, custom fields, subscription and consent records, and engagement data such as opens, clicks, and IP addresses. You agree not to store special categories of personal data in Octeth unless you have a lawful basis to do so and have told us in writing.
• Duration. For the term of the Agreement and until deletion as described under Deletion & Return.

Octeth’s Obligations

Octeth will:

• Process personal data only on your documented instructions, which are the Agreement, this DPA, and your requests through the Client Portal, unless the law requires otherwise, in which case we will tell you before processing unless the law prohibits it.
• Tell you if we believe an instruction breaks Data Protection Laws.
• Ensure that people authorized to process the personal data are bound by confidentiality obligations.
• Apply the security measures described below.
• Not copy personal data off the Managed Server except as encrypted backups and as needed to perform a restore or a restore test.

Security Measures

• Backups are encrypted with AES-256 on the Managed Server before transfer, and transferred over encrypted connections.
• Backup storage uses object locking for a minimum retention period, to protect against accidental or malicious deletion.
• Restore tests run in isolated environments that are destroyed after the test.
• Administrative access to the Managed Server is by SSH key only, limited to Octeth administration IP addresses, and logged.
• Access is limited to Octeth staff and contractors who need it to deliver the service.
• Secrets such as keys and credentials are stored in an encrypted password manager.
• The Managed Server is hardened and receives security updates as described in the Agreement.

Subprocessors

You authorize Octeth to use the following subprocessors:

Your hosting provider is your own contractor, not Octeth’s subprocessor. We will give at least 30 days’ notice by email before adding or replacing a subprocessor. You may object on reasonable data-protection grounds within that period, and if we cannot address the objection, you may cancel Octeth Care with a pro-rata refund of prepaid fees. We impose data-protection obligations on each subprocessor that are no less protective than this DPA and remain responsible for its performance.

International Transfers

Octeth is based in the United States, and our staff may access the Managed Server from other countries. Where Data Protection Laws require a transfer mechanism for personal data leaving the European Economic Area, the United Kingdom, or Switzerland, the Standard Contractual Clauses adopted by the European Commission (Module Two, controller to processor, or Module Three, processor to processor, as applicable), together with the UK International Data Transfer Addendum where relevant, are incorporated into this DPA by reference. The details required by their annexes are those set out in this DPA.

Personal Data Breaches

Octeth will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting personal data we process under this DPA. The notice will describe what we know of the breach, the data and data subjects affected, the likely consequences, and the steps taken or proposed. We will update you as we learn more and take reasonable steps to contain the breach.

Assistance & Audits

Taking into account the nature of the processing, Octeth will reasonably help you respond to data subject requests, carry out data protection impact assessments, and consult supervisory authorities. Because personal data is stored in your Octeth installation, you can usually answer data subject requests directly in the application.

On request, Octeth will provide information reasonably needed to show compliance with this DPA, including a written description of our security measures. If that is not enough to meet your legal obligations, you may audit our compliance once a year, at your expense, with at least 30 days’ notice, during Business Hours, through an independent auditor bound by confidentiality.

Deletion & Return

When the Agreement ends, Octeth will make your most recent backups available for download as described in the Agreement, and will delete all backups and any other copies of personal data it holds within 35 days, unless the law requires us to keep them. Personal data on the Managed Server itself remains under your control.

Liability & Term

Each party’s liability under this DPA is subject to the limitations in the Agreement, to the extent permitted by Data Protection Laws. This DPA stays in force for as long as Octeth processes personal data under the Agreement. If this DPA conflicts with the Agreement on the processing of personal data, this DPA controls. If this DPA conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses control.

Contact

Data protection questions: [email protected]

By mail: 50SAAS LLC (d/b/a Octeth), 1021 E Lincolnway, Suite #5645, Cheyenne, Wyoming 82001, United States