Data Processing Agreement

This Data Processing Agreement (the "DPA") forms part of the Seequency Terms of Service between the Customer and seequency, Inc. ("Seequency"). It is drafted in English; any translation is for convenience only, and the English version prevails. Terms not defined here have the meaning given in the Terms, in Regulation (EU) 2016/679 (the "GDPR") or in applicable US state privacy laws.

1. Roles

1.1 For personal data that the Customer uploads or that the Customer's Clients provide through the Service ("Customer Personal Data"), the Customer is the controller and Seequency is the processor (or "service provider" under US state privacy laws).

1.2 For the Customer's own account and billing data, and for the operation and security of the Service, Seequency acts as an independent controller, as described in its Privacy Policy.

2. Details of the processing

3. Instructions

Seequency processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use of the Service's features, including connecting an integration, are the Customer's instructions. Seequency informs the Customer if it considers an instruction unlawful.

4. Confidentiality and security

4.1 Seequency ensures that persons authorized to process Customer Personal Data are bound by confidentiality.

4.2 Seequency implements the technical and organizational measures described in Annex 1.

5. Sub-processors

5.1 The Customer authorizes Seequency to engage the sub-processors listed in Annex 2.

5.2 Seequency imposes on each sub-processor data protection obligations equivalent to those of this DPA, and remains responsible for them.

5.3 Seequency informs the Customer at least 30 days before adding or replacing a sub-processor, by updating the published list and by email. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Service without penalty.

5.4 Third-party services that the Customer chooses to connect are not sub-processors of Seequency. The Customer instructs Seequency to send data to them, and their processing is governed by the Customer's own agreement with their provider.

6. International transfers

Customer Personal Data is hosted in the European Union. Some sub-processors process it in the United States. Where the GDPR applies, such transfers rely on the EU-U.S. Data Privacy Framework for sub-processors certified under it, and on the EU Standard Contractual Clauses for the others, as shown in Annex 2.

7. Assistance

Seequency assists the Customer, taking into account the nature of the processing, in responding to requests from data subjects, and in meeting its obligations on security, breach notification, impact assessments and prior consultation. A request that Seequency receives directly from a Client is forwarded to the Customer.

8. Personal data breach

Seequency notifies the Customer of a personal data breach affecting Customer Personal Data without undue delay after becoming aware of it, with the information available at that time, completed as it becomes available.

9. Deletion

9.1 On deletion of the account, Seequency deletes Customer Personal Data as set out in section 13 of the Terms.

9.2 By way of exception, the Customer instructs Seequency to keep the log of each Seequence for 6 years after the end of that Seequence, as evidence for the Customer and its Client, and then to delete it.

9.3 Backups are overwritten within 30 days.

10. Audits

Seequency makes available to the Customer, on written request, the documentation necessary to demonstrate compliance with this DPA, including this DPA, its security measures and its list of sub-processors. This documentation constitutes the audit under Article 28(3)(h) of the GDPR. Any other audit, including an on-site inspection, takes place only where required by a supervisory authority, at the Customer's cost, on 30 days' notice.

11. US state privacy laws

Where Seequency acts as a service provider, it does not sell or share Customer Personal Data, does not retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Service, and does not combine it with personal data received from others, except as permitted by those laws.

12. Liability

The limitations of liability of the Terms apply to this DPA.

13. Law and jurisdiction

Section 19 of the Terms applies to this DPA, except where the GDPR requires otherwise for the Standard Contractual Clauses.

Annex 1. Security measures

• Encryption in transit (TLS) for all traffic.

• Encryption at rest of the database, file storage and secrets by the hosting provider.

• Access tokens of integrations stored in a dedicated secret manager, never in the database.

• IP addresses never stored in clear; only a keyed hash, kept 30 days, for abuse prevention.

• Each service runs under its own account, limited to its own data and secrets.

• The log of each Seequence is chained by cryptographic hashes, so that any alteration is detectable.

• Human access to production data is limited to the founder and, for Piloted accounts, to the seequencer assigned to the account.

• Daily backups, kept 30 days.

Annex 2. Sub-processors