Legal
Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Customer") and ADPERA L.L.C-FZ ("altoda"). It applies when altoda processes personal data on the Customer's behalf while providing the Service, and is intended to meet the requirements of the GDPR, the UK GDPR, the UAE Personal Data Protection Law and the Turkish Personal Data Protection Law (KVKK), as they apply.
1. Roles
The Customer is the controller of personal data collected through its website, and altoda is the processor. altoda processes this data only to provide the Service and only on the Customer's documented instructions, which are these Terms, this DPA and the Customer's use of the Service.
The Customer is responsible for having a lawful basis for the processing, for giving visitors the privacy and cookie information the law requires, and for the content of its website.
2. Details of the processing
- Subject matter: hosting and operating the Customer's website.
- Duration: for the term of the subscription and up to 30 days after, plus backup retention of up to 12 months, used only to restore the service.
- Nature and purpose: storing, transmitting and displaying website content; receiving and forwarding form submissions; website analytics if the Customer enables them.
- Types of personal data: names, email addresses, phone numbers, messages and other information visitors submit through the Customer's website; IP addresses and technical data from website visits.
- Data subjects: visitors to the Customer's website, and people whose data the Customer includes in its website content.
- Special categories: the Service is not designed for special category data (such as health data). The Customer should not collect it through its website unless it has confirmed with us that suitable measures are in place.
3. altoda's obligations
altoda will:
- process personal data only on the Customer's instructions, and tell the Customer if it believes an instruction breaks data protection law;
- ensure that people authorised to process the data are bound by confidentiality;
- implement appropriate technical and organisational security measures, including those listed in Annex 2;
- help the Customer respond to requests from data subjects and meet its obligations on security, breach notification and impact assessments, taking into account the nature of the processing;
- notify the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the Customer's data, with the information the Customer needs to meet its own obligations;
- at the end of the Service, return the Customer's personal data through the 30-day export and then delete it, unless the law requires it to be kept;
- make available the information needed to show compliance with this DPA, answer reasonable written audit questions, and, where that information is not enough, allow audits by the Customer or an independent auditor it appoints, on reasonable notice, during business hours and subject to confidentiality.
4. Sub-processors
The Customer gives general authorisation for altoda to use sub-processors. The current sub-processors are listed in Annex 1 and at altoda.co/legal/subprocessors. altoda will inform the Customer at least 14 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds; if we cannot resolve the objection, the Customer may cancel the affected Service and receive a refund of prepaid fees for the remaining period.
altoda does not send personal data to the software tools it uses to design and build websites; those tools receive business information and content without personal data. If the Customer connects its own third-party tools to its website, such as its own analytics or booking account, those providers act for the Customer and are not altoda’s sub-processors.
altoda imposes data protection obligations on each sub-processor that are no less protective than this DPA and remains responsible for their performance.
5. International transfers
Where personal data is transferred from the European Economic Area, the United Kingdom, Switzerland or Turkey to a country without an adequacy decision, the parties rely on the applicable standard contractual clauses (for the EEA, Module 2 or 3 of the EU Standard Contractual Clauses; for the UK, the UK Addendum; for Turkey, the standard contract published by the Turkish Personal Data Protection Authority, notified to the Authority as required), which are incorporated by reference. Transfers from the United Arab Emirates follow the UAE Personal Data Protection Law.
6. Liability and precedence
Liability under this DPA is subject to the limitations in the Terms of Service, to the extent the law allows. If this DPA and the Terms conflict on data protection matters, this DPA applies.
Annex 1: Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, content delivery, DNS, security and backups | Global network; United States |
| Resend (Plus Five Five, Inc.) | Delivering form submissions and service emails | United States |
| Google LLC / Google Ireland Limited (Google Workspace) | Customer support email | European Union and United States |
Annex 2: Security measures
- Encryption of data in transit (TLS) on every website and our account panel.
- Encryption at rest where our providers offer it.
- Access to customer data limited to staff who need it, with individual accounts and two-factor authentication.
- Logging of administrative access.
- Daily backups, kept for up to 12 months, and tested restores.
- Security updates applied to the platform and websites.
- Protection against common attacks, including rate limiting and a web application firewall.
- Confidentiality commitments from everyone who handles customer data.