Overview
This data processing addendum ("DPA") governs the processing of personal data by Evolved Sense Technologies ("Processor") on behalf of you ("Controller") when you use our paid cloud services. It supplements — and is incorporated into — our Terms of Service.
Roles
You are the Controller of personal data your end-users submit to your account. We are the Processor — we host, secure, and process that data only on your documented instructions.
Subject matter and duration
- Subject matter: processing of personal data by us as part of providing the services described in our Terms of Service.
- Duration: for as long as you maintain an active subscription, plus a 30-day grace period for export/deletion.
- Nature and purpose: hosting, storing, transmitting and operating on personal data so that you can deliver your service to your end-users.
- Categories of data subjects: your customers, employees, suppliers, or any other individual whose data you submit.
- Types of personal data: identifiers (name, email), contact info, account credentials, content you upload.
Sub-processors
We engage a small number of sub-processors. The current list:
| Sub-processor | Purpose | Region |
|---|---|---|
| Oracle Cloud | Compute, storage, network | Asia / EU |
| Cloudflare | R2 object storage, Turnstile bot protection | Global |
| SendGrid | Transactional email | US |
| Upstash | Redis cache | Global |
We notify you 30 days before adding a new sub-processor. Object via email; if we can't accommodate, you may terminate without penalty.
Security
We implement the technical and organisational measures described at /security. We update them as the threat landscape evolves and notify you of material changes.
Data subject rights
If a data subject contacts us directly with a rights request (access, deletion, correction, portability), we'll forward the request to you within 5 business days unless we're legally required to respond directly.
International transfers
Where we transfer EU/UK/CH personal data outside those regions, we rely on Standard Contractual Clauses (2021) or equivalent transfer mechanisms. SCCs are incorporated by reference and available on request.
Breach notification
We notify you of a personal data breach without undue delay and in any case within 72 hours of becoming aware of it.
Audits
You may audit our compliance once per year, at your cost, on 30 days' notice. We may instead provide independent audit reports if available.
Termination
On termination of the services, we delete or return personal data within 30 days, except where applicable law requires retention.
Signing
This DPA is effective when you accept our Terms of Service. If your organisation requires a counter-signed version, email [email protected] and we'll send a PDF.