This agreement (DPA) is part of our terms of service. It applies when we process personal data on behalf of a customer under the GDPR or the UK GDPR. To receive a copy signed by us, write to [email protected] with your organization's legal name and address.
1. Parties and roles
The customer is the controller. The processor is:
Private Entrepreneur Serhii Symonov (FOP Symonov Serhii), a sole proprietor (FOP) registered in Ukraine, tax ID 3102901953, 17 Hranychna St., Kropyvnytskyi, Kirovohrad Oblast, 25000, Ukraine, trading as Sevenfixes ("we", "us").
2. What we process
| Subject matter | Providing Sevenfixes as described in the terms. |
|---|---|
| Duration | For as long as the customer's account exists, then until deletion as in section 8. |
| Data subjects | The customer's users: the people the customer invites to its Sevenfixes organization. |
| Personal data | Email addresses, names if given, and the encrypted tokens for the sources the customer connects. Search Console, Analytics, Cloudflare and Bing data reach us aggregated and are not meant to contain personal data. |
| Special categories | None. |
3. Instructions
We process personal data only on the customer's documented instructions: these terms, this DPA and the settings the customer chooses in the app. If we believe an instruction breaks data protection law, we will say so.
4. Confidentiality and staff access
Everyone who can access personal data is bound by confidentiality. Staff open customer data only for support with the customer's consent, for security, or when the law requires it, and every such access is logged.
5. Security
- TLS for all traffic.
- Source tokens encrypted at rest with authenticated encryption (Fernet: AES-128 + HMAC-SHA256), used only on our servers.
- Hashed passwords, two-factor authentication for staff, and separation of each customer's data in the application.
- Encrypted backups.
6. Subprocessors
The customer authorises the subprocessors on our subprocessors page. We will give at least 30 days' notice of a new subprocessor; the customer may object, and if we cannot address the objection, may end the agreement. We bind every subprocessor to data protection terms no weaker than these.
7. International transfers
We host the service in the EU. Where a subprocessor processes personal data outside the EEA or the UK, the transfer relies on an adequacy decision or the Standard Contractual Clauses.
8. Help, breaches and deletion
- We help the customer answer data subject requests and with data protection impact assessments, where they concern our processing.
- We tell the customer without undue delay, and within 72 hours of becoming aware, of a personal data breach that affects its data.
- When the account ends, we delete the customer's personal data from the live systems within 30 days, and it leaves our encrypted backups as they expire, unless the law requires us to keep it.
9. Audits
We make available the information needed to show that we meet this DPA, and answer reasonable written questions about our security. On-site audits can be agreed in writing, at the customer's cost.