Trifectask Data Processing Addendum

This Data Processing Addendum (DPA) forms part of the agreement between the customer identified in an Order (Customer) and TRIFECTA OÜ, registry code 17027345 (Trifectask), for the Trifectask services (Agreement).

1. Scope and roles

1.1 This DPA applies where Trifectask processes personal data on Customer's behalf in connection with website or online-store maintenance, SEO, support, portal tasks, attachments or other Services (Customer Personal Data).

1.2 For Customer Personal Data, Customer is the controller and Trifectask is the processor, unless Customer acts as a processor for another controller, in which case Trifectask is Customer's subprocessor. Each party remains an independent controller for account, billing, supplier-management and business-relationship data it determines to process for its own purposes.

1.3 Terms such as controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given in Regulation (EU) 2016/679 (GDPR).

2. Processing details

2.1 The subject matter, duration, nature and purpose of processing, categories of personal data and categories of data subjects are described in Schedule 1.

2.2 Customer instructs Trifectask to process Customer Personal Data only:

• to provide, secure and support the Services documented in the Agreement and authorised task requests;
• as further documented in writing by Customer; and
• as required by Union or Member State law, in which case Trifectask will inform Customer before processing unless the law prohibits that notice.

2.3 Trifectask will promptly inform Customer if, in its opinion, an instruction infringes the GDPR or other applicable Union or Member State data-protection law. Trifectask may suspend the affected processing while the parties resolve the issue.

2.4 Trifectask will not sell Customer Personal Data or disclose it to an unrelated third party for that party's own purposes. Access is limited to authorised personnel, approved subprocessors that need the data to provide or secure the Services, and disclosures required by law.

3. Customer obligations

3.1 Customer is responsible for:

• giving lawful, documented and sufficiently clear instructions;
• ensuring a valid legal basis and required transparency for the processing;
• ensuring that Customer Personal Data is adequate, relevant and limited to what is necessary;
• responding to data subjects and supervisory authorities as controller; and
• not providing special-category data or criminal-conviction data unless the parties first document the need and appropriate additional safeguards.

3.2 Customer will not instruct Trifectask to process personal data in violation of applicable law.

4. Confidentiality and personnel

Trifectask will ensure that persons authorised to process Customer Personal Data are bound by confidentiality, receive appropriate data-protection and security instructions, and access the data only as necessary for their duties.

5. Security

5.1 Taking into account the state of the art, implementation costs and the nature, scope, context and purposes of processing, as well as the risk to individuals, Trifectask will implement and maintain appropriate technical and organisational measures under Article 32 GDPR. The current minimum measures are described in Schedule 2.

5.2 Customer acknowledges that security measures may evolve. Trifectask may replace a measure with an equal or stronger measure, but will not materially reduce overall security during an active Order.

6. Personal data breaches

6.1 Trifectask will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

6.2 To the extent information is available, the notice will describe:

• the nature of the breach, including relevant categories and approximate numbers of data subjects and records;
• likely consequences;
• measures taken or proposed to contain and remedy the breach; and
• a contact point for follow-up.

6.3 Trifectask may provide information in phases as it becomes available. Notification is not an admission of fault or liability.

6.4 Trifectask will take reasonable steps to contain, investigate and remediate the breach and will reasonably assist Customer with its notification and documentation duties. Customer is responsible for deciding whether to notify a supervisory authority or data subjects unless law assigns that duty to Trifectask.

7. Data-subject requests and compliance assistance

7.1 Taking into account the nature of the processing, Trifectask will provide reasonable technical and organisational assistance for Customer to respond to requests concerning data-subject rights.

7.2 If Trifectask receives a request directly concerning Customer Personal Data, it will forward the request to Customer without undue delay and will not respond substantively unless Customer instructs it or law requires it.

7.3 Taking into account the nature of processing and information available, Trifectask will reasonably assist Customer with security obligations, breach notifications, data-protection impact assessments and prior consultations under Articles 32–36 GDPR.

7.4 Assistance included in ordinary support is provided without additional charge. Trifectask may charge reasonable, pre-agreed fees for unusually extensive assistance caused by Customer's systems, instructions or non-compliance, unless the assistance is required because of Trifectask's breach.

8. Subprocessors

8.1 Customer gives Trifectask general written authorisation to use the subprocessors listed in Schedule 3. Schedule 3 identifies each subprocessor's function and principal processing location.

8.2 Trifectask will give Customer at least 15 days' prior notice of a new subprocessor that will process Customer Personal Data. Customer may object during that period on reasonable data-protection grounds. The parties will work in good faith on a commercially reasonable alternative. If none is available, Customer may terminate the affected Service before the new subprocessor begins processing and receive a refund of prepaid fees for the unused affected period.

8.3 Trifectask will impose data-protection obligations on each subprocessor that are no less protective than the relevant obligations in this DPA, to the extent applicable to that subprocessor's work. Trifectask remains responsible for the subprocessor's performance as required by Article 28 GDPR.

9. International transfers

9.1 Customer Personal Data will not be transferred outside the European Economic Area (EEA) or to an international organisation unless the transfer complies with Chapter V GDPR.

9.2 Where an adequacy decision does not apply, the parties or relevant subprocessor will use an appropriate transfer mechanism, such as the European Commission's then-current Standard Contractual Clauses, and implement supplementary measures where required.

9.3 On reasonable request, Trifectask will provide information needed for Customer to assess relevant transfer safeguards, subject to confidentiality and security restrictions.

9.4 The Trifectask portal and related self-hosted applications run on an OVHcloud virtual private server physically located in Germany. Where Trifectask hosts Customer's website, the primary website data and backups are hosted on that infrastructure. Where Customer or a third party hosts the website, website backups created through the Services remain in that hosting environment. Other Service data may be processed by the approved subprocessors listed under section 8.

9.5 The Trifectask server is physically hosted by OVHcloud in Germany (EEA). To the extent an OVHcloud entity accesses Customer Personal Data from outside the EEA in connection with support or group operations, Trifectask relies on the transfer safeguards in the applicable OVHcloud data-processing agreement, including Standard Contractual Clauses where required.

10. Deletion and return

10.1 During the Agreement, Customer may retrieve Customer Personal Data using available portal or service functionality or request a reasonable export where technically feasible.

10.2 On termination of the Agreement, Trifectask will, at Customer's choice, return or delete all Customer Personal Data processed on Customer's behalf and delete existing copies, unless Union or Member State law requires retention. Customer should submit any return request within 30 days after termination. After that period, Trifectask may proceed with deletion of remaining Customer Personal Data that is no longer required for a legal retention duty.

10.3 Data remaining in routine backups may be deleted in accordance with the normal backup cycle, provided it is not processed for purposes other than disaster recovery, security or compliance with a legal obligation. If restored, applicable deletion instructions will be reapplied.

11. Information and audits

11.1 Trifectask will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR, which may include current policies, summaries of controls, certifications or independent audit reports where available.

11.2 Customer may audit compliance once in any 12-month period and additionally after a substantiated material incident or supervisory-authority request. Audits must:

• begin with a written information request or remote review where sufficient;
• be requested at least 30 days in advance unless urgent;
• occur during normal business hours without disrupting operations;
• be performed by Customer or an independent auditor bound by confidentiality; and
• avoid access to another customer's data or security-sensitive information not relevant to the audit.

11.3 Each party bears its own audit costs. Customer will reimburse Trifectask's reasonable costs of an unusually burdensome audit unless the audit identifies Trifectask's material non-compliance.

12. Liability and priority

12.1 Liability arising under this DPA is subject to the liability provisions of the Agreement, except to the extent applicable law requires otherwise.

12.2 If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA prevails.

13. Term

This DPA starts when Trifectask first processes Customer Personal Data and remains in effect until that processing ends and the data is returned or deleted in accordance with section 10.

Schedule 1 — Processing description

Subject matter

Processing necessary to provide website and online-store maintenance, SEO, support, reporting, client-portal and related services requested by Customer.

Duration

For the duration of the relevant Services and the limited return, deletion, legal-retention and backup periods described in the Agreement and this DPA.

Primary processing location

Customer-hosted website data remains in Customer's or its hosting provider's environment. The Trifectask portal, related self-hosted applications, and Trifectask-hosted website data and backups run on OVHcloud infrastructure physically located in Germany. Payment, authentication, communication and support data may also be processed in the locations disclosed in Schedule 3.

Nature and purpose

Accessing, viewing, collecting, recording, organising, hosting, storing, retrieving, consulting, analysing, updating, correcting, transmitting, restricting, exporting and deleting personal data as necessary to:

• operate the client portal and process authorised tasks and attachments;
• maintain, troubleshoot, secure and update Customer websites or online stores;
• implement content, product, technical or SEO changes;
• analyse search performance and prepare reports; and
• provide support and incident response.

Categories of data subjects

• Customer's personnel, contractors and authorised users;
• visitors and registered users of Customer's websites or stores;
• Customer's prospects, customers and end customers;
• Customer's suppliers, partners and other contacts; and
• other individuals whose data Customer lawfully places in the affected systems or Customer Content.

Categories of personal data

• identity and contact details;
• account, role and authentication-related data, excluding plaintext passwords where avoidable;
• website, form, support and communication content;
• online-store order, transaction and customer-service information, excluding full payment-card data unless separately and expressly agreed;
• device, cookie, log, IP-address and analytics data;
• task, chat, attachment and reporting data; and
• other personal data contained in systems or materials to which Customer grants authorised access.

Sensitive data

The Services are not designed for special categories of personal data under Article 9 GDPR or criminal-conviction data under Article 10 GDPR. Customer must not intentionally provide such data without prior written agreement and documented safeguards.

Frequency

Continuous or occasional, depending on the active plan and Customer's authorised requests.

Schedule 2 — Technical and organisational measures

Access and identity

• unique user accounts and role-based access appropriate to job duties;
• server access restricted to authorised administrators;
• remote server administration permitted only through SSH using an authorised administrator's SSH key;
• prompt removal of access that is no longer required;
• strong password hashing for password-based portal accounts.

Transmission and storage

• encrypted transport using current HTTPS/TLS configurations and other protected connections where appropriate;
• data stored on access-controlled OVHcloud VPS infrastructure in Germany;
• a server firewall restricting network access;
• controlled methods for receiving credentials, with more secure transfer methods required where appropriate to the sensitivity of the access;
• payment-card numbers and other payment-instrument details processed by Stripe and not stored by Trifectask; and
• separation of customer environments or logical access controls appropriate to the architecture.

Operational security

• server and application security updates performed on a weekly basis where updates are available and reasonably suitable for deployment;
• system and access logs may be stored for security, troubleshooting and incident investigation and are retained for no longer than 30 days unless a longer period is reasonably necessary to investigate an active incident or comply with law;
• change control and review proportionate to the risk of production changes; and
• security concerns may be reported through the portal or to info@trifectask.com and are escalated to authorised administrators.

Availability and recovery

• Trifectask maintains automated daily backups of systems and customer environments hosted or managed by Trifectask, where technically applicable;
• backup access is restricted to authorised administrators; and
• hosted website and portal data are made available and deleted as described in section 10 and the Agreement.

Personnel and suppliers

• confidentiality commitments for authorised personnel;
• data-protection and security instructions appropriate to each role;
• due diligence and written terms for subprocessors; and
• periodic review of access and relevant safeguards.

Deletion and lifecycle

• retention rules for portal content, logs and backups;
• secure deletion or anonymisation when data is no longer required; and
• processes for return or deletion at the end of the Services.

Schedule 3 — Approved subprocessors

Customer-selected hosting providers are not Trifectask subprocessors merely because Trifectask accesses Customer's website there under Customer's instructions. Software installed and operated by Trifectask on the OVHcloud VPS is not a separate subprocessor unless its provider receives or can access Customer Personal Data.

Stripe is used for payment processing, Google Sign-In is offered as an optional identity service and Google Analytics 4 is used for analytics. These services process data for Trifectask's own account, billing, authentication or website-analytics purposes rather than to maintain Customer's website on Customer's behalf, and are therefore described in the Privacy Policy rather than listed in this Schedule. If any of them is later used to process Customer Personal Data on Customer's behalf, it must be assessed and added to this Schedule before that use.