Data Processing Agreement

This Data Processing Agreement (DPA) under Article 28 GDPR forms part of every contract for our audit services, including free trials, between SIA Amber Cloud, Ieroču iela 14-4, Rīga, LV-1013, Latvia (the processor, "we") and the customer. It applies to all personal data contained in websites the customer submits for auditing. Where the customer itself acts as a processor for a client, we act as subprocessor and this DPA applies accordingly.

1. Subject matter, duration, nature and purpose

We process the content of the web pages the customer submits — page text, markup, screenshots and technical structure — and the reports and evidence derived from them, solely to perform the ordered accessibility audit and produce its reports. Typical categories of personal data are those websites commonly display: names, contact details, photographs, user-generated content such as reviews; typical data subjects are the website's visitors, customers, staff and content authors. We do not seek special categories of data; if audited pages incidentally contain them, they are processed only as displayed, are not analysed for their own sake, and are deleted under the retention rules below. For free trials, the customer's submission of a website address constitutes the documented instruction. Processing lasts for the duration of the service relationship and the retention periods in our privacy policy, and this DPA remains effective for as long as we or our subprocessors hold customer personal data.

2. Documented instructions

We process this data only on the customer's documented instructions. The order — the accepted quote identifying the website and pages — constitutes the instruction. We inform the customer if, in our opinion, an instruction infringes the GDPR or other data protection law.

3. Confidentiality

Persons authorised to process the data are bound by confidentiality obligations.

4. Security of processing

We implement appropriate technical and organisational measures under Article 32 GDPR. As implemented today: encrypted transport (TLS) for all connections to our service and between our systems (audited websites are retrieved over the protocol they serve, HTTPS where available); operator access by SSH key only, with password authentication disabled; audit processing in isolated containers whose network egress to private address space is blocked; per-account separation of customer data; off-site backups transferred over TLS to an EEA provider and stored with provider-side encryption at rest, expiring after 30 days; error reports scrubbed of credentials and tokens before transmission; deletion requests are re-applied after any restore from backup. A current description is available on request.

5. Subprocessors

The customer grants general authorisation for the subprocessors listed in the annex below. We give the customer active notice of any intended addition or replacement by email to the account address at least 14 days before the new subprocessor processes customer data; the period runs from that notice. The customer may object on reasonable data protection grounds; while an objection is unresolved, we do not process that customer's data with the new subprocessor. If the objection cannot be resolved, the customer may terminate the affected service against a proportionate refund. We impose data protection obligations equivalent to this DPA on every subprocessor and remain fully responsible to the customer for the subprocessor's performance.

6. Data subject rights

Taking into account the nature of the processing, we assist the customer with appropriate technical and organisational measures in fulfilling its obligations under Articles 32 to 36 GDPR: responding to data subject requests, securing processing, notifying breaches to authorities and data subjects, and carrying out impact assessments and prior consultations, in each case as reasonably necessary and taking into account the information available to us.

7. Personal data breaches

We notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data, with the information required by Article 33(3) GDPR as it becomes available.

8. Impact assessments

We assist the customer with data protection impact assessments and prior consultations concerning this processing, as reasonably necessary and taking into account the information available to us.

9. Deletion and return

On termination of the services, or earlier on the customer's request, we — at the customer's choice — return the customer's personal data in a commonly used format or delete it, including reports that contain personal data, and delete existing copies, unless EU or member state law requires further storage. We confirm completion in writing on request. Deleted data persists in encrypted backups for up to 30 days before those backups expire; deletion is re-applied to any data restored from backup within that window.

10. Demonstrating compliance and audits

We make available the information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits, including inspections, conducted by the customer or an auditor mandated by the customer. Routine audits occur at most once per year on reasonable notice during business hours; additional audits are permitted where justified by a personal data breach, a credible compliance concern or a requirement of a supervisory authority. Audits must not access other customers' data. Each party bears its own costs; our charges, if any, are limited to reasonable actually incurred effort and must not effectively prevent the customer from exercising its audit rights.

11. International transfers

Transfers outside the European Economic Area occur only to the subprocessors identified in the privacy policy and only under Chapter V GDPR safeguards — in particular data processing agreements incorporating the European Commission's Standard Contractual Clauses.

12. Relationship to the contract

This DPA forms part of the service contract. In matters of processing personal data on the customer's behalf, this DPA prevails over conflicting provisions of the terms of service. Its term follows the contract.

Annex: subprocessors of customer audit content

The following providers process customer audit content on our behalf and are the subprocessors authorised under Section 5. Providers that process only our own controller data — payment processing and transactional email — are recipients described in the privacy policy and are not subprocessors of audit content.