This Data Processing Addendum ("DPA") forms part of the agreement between Redeyed Corporation ("Redeyed") and the business or organization using a Redeyed Service ("Customer") where Redeyed processes Customer Personal Data on Customer's behalf. Capitalized terms not defined here have the meanings given in the Terms of Service, an applicable order form, or Data Protection Law.
Important: This DPA allocates data-processing responsibilities between Redeyed and business customers. It does not itself make either party compliant with every law, and it does not replace fact-specific advice from qualified privacy counsel. If a signed enterprise agreement or negotiated DPA conflicts with this DPA, the signed document controls.
"Customer Personal Data" means personal data, personal information, or equivalent regulated information that Redeyed processes on Customer's behalf to provide the Services. "Data Protection Law" means privacy or data-protection law applicable to that processing. "process," "controller," "processor," "business," "service provider," "contractor," "sell," and "share" have the meanings given by applicable Data Protection Law.
This DPA prevails over conflicting provisions of the general agreement solely for its subject matter. Mandatory transfer terms prevail over this DPA where required.
Customer is the controller or business and Redeyed is the processor, service provider, or contractor for Customer Personal Data, except where law assigns a different role. Customer instructs Redeyed to process Customer Personal Data to provide, secure, support, monitor, and improve the contracted Services; prevent fraud and abuse; comply with documented lawful instructions; and perform obligations imposed by law. The agreement, Customer's authorized use and configuration, and written support requests constitute documented instructions.
Redeyed will notify Customer if, in Redeyed's reasonable opinion, an instruction violates applicable Data Protection Law, unless law prohibits notice. Redeyed may suspend the affected processing while the parties address the instruction.
Customer is responsible for the lawfulness, fairness, accuracy, and transparency of its processing; its notices and legal bases; obtaining required permissions; responding as controller to individuals; configuring the Services appropriately; limiting submitted data to what is necessary; and ensuring its instructions comply with law. Customer will not submit specially regulated or highly sensitive data unless the applicable Service and written agreement expressly support it.
Redeyed will ensure persons authorized to process Customer Personal Data are bound by confidentiality obligations and receive appropriate security responsibilities. Redeyed will maintain administrative, technical, and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the nature of processing, available technology, implementation costs, and risk. Current safeguards are summarized in the Security & Compliance Statement.
Customer gives Redeyed general authorization to use subprocessors to provide the Services. Redeyed remains responsible for imposing data-protection obligations appropriate to the processing. Upon request, Redeyed will provide information about material subprocessors applicable to Customer's Service. Where required by law or contract, Redeyed will provide reasonable advance notice of a new material subprocessor and a reasonable opportunity to object on documented data-protection grounds. If the parties cannot resolve a valid objection, Customer may discontinue the affected Service as its sole remedy for that objection, subject to applicable refund rights and law.
Taking into account the nature of processing, Redeyed will provide reasonable assistance through available functionality or support so Customer can respond to valid requests concerning access, correction, deletion, restriction, objection, portability, or similar rights. If Redeyed receives a request relating solely to Customer Personal Data, Redeyed may direct the requester to Customer unless law requires Redeyed to respond. Redeyed will provide reasonable information needed for Customer's data-protection assessments, regulator consultations, and demonstrated compliance, considering the information available to Redeyed.
Redeyed will notify Customer without undue delay after confirming a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by Redeyed (a "Customer Data Incident"). Notice will include information reasonably available to Redeyed concerning the nature of the incident, affected data and people, likely consequences, mitigation, and a contact, and may be provided in phases as facts develop. Notification is not an admission of fault or liability. Customer is responsible for notifications it must make as controller unless law assigns the duty to Redeyed.
During the subscription, Customer may use available functionality to access or export Customer Personal Data. After termination or Customer's valid instruction, Redeyed will delete or return Customer Personal Data within a reasonable period, unless law requires retention. Data may persist temporarily in protected backups until overwritten under the ordinary backup cycle and remains subject to this DPA. Redeyed may retain limited records necessary for security, fraud prevention, billing, dispute resolution, or legal compliance, acting as an independent controller for that limited purpose where applicable.
Redeyed will make available information reasonably necessary to demonstrate the obligations in this DPA, including applicable independent assurance reports if and when available. If that information is insufficient and Data Protection Law gives Customer an audit right, Customer may request one reasonable audit per year, and additional audits following a confirmed material incident or regulator requirement. Audits require reasonable advance notice, mutually agreed scope and timing, confidentiality, qualified independent personnel, no access to other customers' information or security-sensitive material beyond necessity, and reimbursement of Redeyed's reasonable costs unless a material breach by Redeyed is found. Audits must not unreasonably disrupt operations.
Where Redeyed acts as a service provider or contractor, Redeyed will not sell or share Customer Personal Data, retain, use, or disclose it outside the direct business relationship or for a commercial purpose other than the business purposes specified in the agreement, or combine it with personal information received from another source, except as permitted by applicable law. Redeyed will notify Customer if it determines it can no longer meet these obligations. Customer may take reasonable and appropriate steps to help ensure compliant use and to stop and remediate unauthorized use.
The parties will use a legally valid transfer mechanism where required. If Customer transfers EEA personal data to Redeyed in a country without an applicable adequacy decision, Commission Implementing Decision (EU) 2021/914 controller-to-processor clauses (Module Two) are incorporated to the extent legally required. Customer is the data exporter and Redeyed is the data importer; Clause 7 applies; the general authorization in Section 5 supplies the Clause 9 option; the optional Clause 11 language does not apply; the governing law is Ireland; and disputes under the clauses are resolved by the courts of Ireland. The parties' contact information and signatures or electronic acceptance identify the parties; Schedule 1 supplies the processing description; and Section 4 plus the Security & Compliance Statement supply the general technical and organizational measures, subject to any additional completed annex.
For a restricted transfer from the United Kingdom, the parties will execute or complete the then-current UK International Data Transfer Addendum when required. For Switzerland, references in the clauses are adapted as required by the Swiss Federal Act on Data Protection. The parties will cooperate on a transfer-risk assessment and supplementary measures where legally required. Nothing in this section reduces a mandatory protection in the applicable transfer instrument.
This DPA remains effective while Redeyed processes Customer Personal Data. Liability arising from this DPA is subject to the exclusions and limitations in the governing agreement to the maximum extent permitted by law. Nothing in this DPA limits an individual's rights or a regulator's authority where they cannot lawfully be limited.
Questions, rights requests, and notices concerning this DPA may be sent to [email protected].
