Acuerdo de Procesamiento de Datos (DPA)

This DPA applies to all personal data processed by Optiviera on behalf of Customers in connection with the Services, including account management, platform access, file storage, backup and restore operations, HR and payroll data, financial records, and related platform operations.

• Process personal data only on documented instructions from the Controller
• Ensure persons authorized to process personal data are bound by confidentiality
• Implement appropriate technical and organizational security measures (Article 32 GDPR)
• Respect conditions for engaging subprocessors (Article 28(2) GDPR)
• Assist the Controller in responding to data subject rights requests
• Assist the Controller in ensuring compliance with security and breach notification obligations
• Delete or return all personal data upon termination of the DPA
• Provide information necessary to demonstrate compliance and cooperate with audits

Optiviera assists Customers in fulfilling data subject rights requests where technically feasible. Supported workflows may include access requests, deletion requests, export and portability, and correction requests. Customers remain responsible for responding to data subjects directly.

Optiviera may engage subprocessors to provide parts of the Services. Customers are provided general authorization for subprocessors. Optiviera will inform Customers of material changes to subprocessors where applicable. Current subprocessors are listed at /legal/subprocessors.

Where personal data is transferred outside the EEA, Optiviera seeks to implement appropriate safeguards including Standard Contractual Clauses (SCCs) pursuant to GDPR Chapter V, transfer impact assessments, encryption safeguards, and supplementary technical measures where appropriate.

Optiviera will notify Customers without undue delay, and where feasible within 72 hours, upon becoming aware of a personal data breach affecting Customer Data. Notifications will include the nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed to address the breach.

Upon termination or expiry of the agreement, Optiviera will, at the Customer's election, delete or return all Customer Data and delete existing copies unless applicable law requires storage. Customers should export their data before account termination.