Data Processing Agreement

Roles

Where you use Deploft to process personal data of your own users, you act as the data controller and Deploft acts as a data processor. This DPA supplements our Terms of Service.

Scope of processing

We process personal data only to provide the Deploft services and on your documented instructions, for the duration of your subscription.

Security measures

• Encryption of data in transit and at rest where supported.
• Access controls and least-privilege for our personnel.
• Regular backups and monitoring of our infrastructure.

Sub-processors

We use a limited set of sub-processors (such as infrastructure and payment providers) to deliver the service. We remain responsible for their compliance and will give notice of material changes.

Data subject requests and breaches

We’ll assist you in responding to data-subject requests and will notify you without undue delay after becoming aware of a personal-data breach affecting your data.

Deletion

On termination, we delete or return personal data we process on your behalf, except where retention is required by law. Email [email protected] to exercise these rights.