Data Processing Agreement (DPA)

This DPA governs the processing of Personal Data by Amplivanta (the Processor) on behalf of the Customer (the Controller) in connection with the Services and forms part of the Agreement between the parties.

Capitalized terms such as “Personal Data”, “Processing”, “Controller”, “Processor”, and “Data Subject” have the meanings given under applicable data protection laws, including the GDPR where relevant.

This DPA applies for the duration of the Agreement and for as long as Amplivanta processes Personal Data on behalf of the Customer, and survives to the extent required by applicable law.

Amplivanta processes Personal Data only on documented instructions from the Customer and solely for the purpose of providing, maintaining, and improving the Services.

Processing may involve contact details, account and usage data of the Customer's users, contacts, and end customers, as configured by the Customer within the Services.

Amplivanta will process Personal Data lawfully, maintain confidentiality, implement appropriate security measures, and assist the Customer in meeting its data-protection obligations.

The Customer is responsible for the lawfulness of its instructions, obtaining necessary consents, and ensuring it has the right to transfer Personal Data to Amplivanta for processing.

The Customer authorizes Amplivanta to engage subprocessors. We maintain a current subprocessor list and impose data-protection obligations consistent with this DPA on each subprocessor.

Where Personal Data is transferred internationally, appropriate safeguards such as Standard Contractual Clauses and the UK IDTA are applied.

Taking into account the nature of processing, Amplivanta assists the Customer in responding to Data Subject requests to exercise their rights under applicable law.

Amplivanta implements measures including encryption in transit and at rest, access controls, monitoring, and regular testing to protect Personal Data.

Amplivanta will notify the Customer without undue delay after becoming aware of a Personal Data breach and will cooperate to investigate and remediate.

Upon termination, Amplivanta will delete or return Personal Data in accordance with the Customer's instructions and applicable retention obligations.

Amplivanta will make available information necessary to demonstrate compliance and allow for audits, subject to reasonable confidentiality and security safeguards.

This DPA, together with the Agreement, constitutes the entire agreement regarding processing. If any provision is invalid, the remainder continues in effect.

This DPA is governed by the law specified in the Agreement, and disputes are resolved in accordance with the Agreement's dispute-resolution provisions.