# Data processing agreement > This DPA sets out the terms and conditions for the processing of Personal Data by Aiven on behalf of the Customer under the Agreement. > For the complete documentation index, see [llms.txt](https://nevia.cloud/llms.txt). This page's HTML version: https://nevia.cloud/dpa ## Background This DPA is attached to the Terms and forms an inseparable part of the Agreement entered into by Aiven and the Customer. This DPA shall set out the terms and conditions for the processing of Personal Data by Aiven on behalf of the Customer under the Agreement. ## Scope and conflict of rules To the extent the Customer inputs Personal Data into the Service and Aiven processes such Personal Data, the Parties acknowledge that the Customer acts as a Data Controller and Aiven is a Data Processor processing Personal Data on behalf of the Customer for the purpose of providing the Service. In the event of any discrepancy between this DPA and the Agreement, this DPA prevails. ## Definitions Unless otherwise defined in this DPA or in the Agreement, terms used in this DPA, such as "Data Controller", "Data Processor", "Data Subject" and "Personal Data" have the meanings as defined in the Data Protection Regulation. | Term | Definition | | --- | --- | | Data Protection Regulation | means all applicable laws relating to data protection, including without limitation the GDPR and the laws implementing EU Directive 2002/58/EC and any amendments to or replacements for such laws and regulations. | | GDPR | means the General Data Protection Regulation (EU) 2016/679. | | Personal Data Breach | means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed. | | Standard Contractual Clauses | means the contractual clauses issued by the European Commission by the decision 2021/914/EU for international transfers of Personal Data. | | Subprocessor | means Aiven Affiliates and third parties engaged by Aiven to process Personal Data on Aiven's behalf in connection with providing the Service. Subprocessors are listed at: [https://nevia.cloud/subprocessors](https://nevia.cloud/subprocessors.md). | ## Processing of personal data Processing of Personal Data under this DPA is for the purpose of providing the Service to the Customer. Processing of Personal Data in this context refers to storage, maintenance and/or other processing activities initiated by the Customer. The categories of Data Subjects and the types of Personal Data processed are defined in the Appendix 1 (Details of processing). Personal Data may be processed as long as the Service is provided under the Agreement and after that if required by applicable law or contractual obligations or rights of either Party. ## Customer's instructions Aiven shall process Personal Data in accordance with the Customer's written instructions as established in this DPA. The Parties agree that this DPA is the Customer's complete written instruction to the Aiven in the Customer's role as the Data Controller. Additional instructions require prior written agreement between the Parties. ## Aiven's general obligations Aiven shall, at the Customer's written request and the Customer's sole cost and expense, assist the Customer by providing such readily available information, or creating such information, as the Customer may reasonably require and which the Customer does not have, in complying with the requests of the Data Subjects or supervisory authority or any other law enforcement or regulatory authority. Aiven shall inform the Customer, as soon as reasonably practicable, if it receives a request from a Data Subject seeking to exercise his or her rights under the Data Protection Regulation. Aiven shall maintain records of processing activities under its responsibility to ensure Aiven's own compliance as a Data Processor with the Data Protection Regulation, and upon the Customer's written request Aiven shall make available to the Customer such records to the extent necessary to demonstrate compliance with Aiven's obligations set out in this DPA and in the Data Protection Regulation. ## Data security Aiven shall implement and maintain appropriate technical and organizational measures to ensure an appropriate level of security of the Personal Data and to protect the Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure for the purposes of the Service. In the event of a Personal Data Breach, Aiven shall notify the Customer without undue delay after becoming aware of the Personal Data Breach and take reasonable steps to mitigate any damage resulting from such breach. The notification shall contain information Aiven is reasonably able to disclose to the Customer, including following information: - a description of the nature of the Personal Data breach, including where possible the categories of Data Subjects and the Personal Data concerned; - the name and contact details of contact point where more information can be obtained; - a description of likely consequences of the Personal Data Breach; and - a description of the measures taken or proposed to be taken to address the Personal Data Breach. The information may be provided in phases if it is not possible to provide the information at the same time. Aiven shall cooperate with and assist the Customer, at the Customer's written request and the Customer's sole cost and expense, in relation to the Personal Data Breach notifications made to supervisory authority as required under the Data Protection Regulation. Aiven shall document the Personal Data Breaches and have the documentation available to the Customer upon the Customer's written request. ## Subprocessors Aiven is entitled to use Subprocessors for the purposes of providing the Service under the Agreement. Aiven provides information on its Subprocessors at its Web Site. Aiven informs the Customer of changes concerning its Subprocessors by updating the Subprocessor list. Customer may sign-up to receive notices of Subprocessor changes. If the Customer has a reasonable objection to any new or replacement sub-processor, it shall notify Aiven of such objection in writing within ten (10) days of the date of the change. In case the Customer objects to the use of a specific Subprocessor, Aiven may evaluate whether provision of the Service to the Customer is feasible without the updated Subprocessor. Where no such Service provision is feasible to Aiven, in its sole and absolute discretion, the Customer's sole and exclusive remedy shall be the right to terminate the Agreement. The Customer hereby consents to Aiven's use of Subprocessors as described in this section. Aiven shall use its commercially reasonable efforts to ensure that its Subprocessors are subject to similar data protection obligations, in particular in terms of providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the Data Protection Regulation, as set out in this DPA. Aiven remains responsible for its Subprocessors and their compliance with the obligations of this DPA. ## Transfers of personal data Aiven and its Subprocessors may process and/or transfer Personal Data outside of the EU/EEA. For transfers of Personal Data by Aiven to its Subprocessor outside of the EU/EEA, Aiven shall ensure and the Customer accepts that Aiven: (i) performs the international data transfer of Personal Data in accordance with the Standard Contractual Clauses (processor-to-processor module) entered into by Aiven (as a data exporter) and the Subprocessor (as a data importer) or; (ii) transfers Personal Data to a country that is deemed by the Commission to have an adequate level of protection; or (iii) ensures other appropriate safeguards as described in Article 46 of the GDPR exists. ## Auditing At the Customer's written request and the Customer's sole cost and expense, the Customer is entitled, once every twelve (12) months, to audit Aiven's compliance with its obligations under the Data Protection Regulation and this DPA. The audit report and related information shall at all times be deemed as Aiven's confidential information. ## Data confidentiality Aiven will not access or use, have visibility or disclose to any third party, any data that the Customer has input into the Service, except, if specifically requested in writing by the Customer in order to provide customer-specific support services as requested and instructed by the Customer, or as specifically permitted under Section 3 of the AUP. If a governmental body sends Aiven a demand for the data input into the Service, Aiven will do its best efforts to redirect the governmental body to request that data directly from the Customer. If compelled to disclose Customer Data to a governmental body, then Aiven will only disclose the Personal Data strictly to the extent it is legally required to do so and shall give the Customer reasonable notice of the demand to allow the Customer to seek a protective order or other appropriate remedy unless Aiven is legally prohibited from doing so. ## Term and termination This DPA shall become effective in parallel with the Agreement and shall continue in force until the termination of the Agreement or as long as Aiven processes Personal Data on behalf of the Customer. If not instructed otherwise in writing by the Customer and unless legally required to keep the Personal Data, Aiven shall delete and destroy the Personal Data processed hereunder the latest within ninety (90) days' of the termination of the Agreement or after the maximum data retention period permitted by the technology of the relevant Service. In case the Customer demands that the Personal Data are returned to the Customer or to a third party, the Customer will pay Aiven for any additional costs and expenses arising out of such return of the Personal Data. ## Appendix 1: Details of processing This Appendix 1 forms part of this DPA describing the details of personal data to be processed by Aiven. The Customer has full control of what personal data will be processed by uploading such personal data into the Service. Aiven has no visibility to such personal data provided and uploaded by the Customer. Data subjects - Prospects, customers, business partners, and vendors of the Customer (who are natural persons) - Employees or contact persons of the Customer's prospects, customers, business partners and vendors - Employees, agents, advisors, and freelancers of the Customer (who are natural persons) - Individuals authorized by the Customer under the Agreement Categories of personal data - Full name - Title, position - Email address, address - Phone number Special categories of personal data - No special categories of Personal Data are processed. Subject matter of the processing - Hosting, processing, storing and maintenance for the data Customer has input to the Service. ## Appendix 2: Aiven's technical and organizational safety measures This Appendix 2 forms a part of this DPA describing Aiven's technical and organizational safety measures. Description of the technical and organizational security measures implemented by Aiven. Aiven will maintain administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Personal Data processed on the Service as applicable to the Service purchased by the Customer.