1. Parties
This Data Processing Agreement (DPA) forms part of the Terms & Conditions between the customer (the “Controller”) and EngraveFill.com (the “Processor”) regarding the processing of personal data under applicable data protection laws, including GDPR.
2. Subject Matter
EngraveFill.com processes personal data on behalf of the Controller for the purpose of providing AI engraving fill services, user account management, billing, and related technical operations.
3. Duration
This DPA remains in force for as long as the Controller uses EngraveFill.com services or until all personal data processed on behalf of the Controller is deleted or returned.
4. Type of Personal Data and Data Subjects
- Users and customers of the Controller.
- Data: identification data (e.g. email), usage logs, billing references.
5. Processor Obligations
- Process personal data only on documented instructions from the Controller.
- Ensure that persons authorized to process personal data are bound by confidentiality.
- Implement appropriate technical and organizational security measures.
- Assist the Controller in fulfilling requests from data subjects.
- Assist with data protection impact assessments where relevant.
6. Sub-Processors
EngraveFill.com may engage sub-processors (e.g. hosting providers, AI model infrastructure, payment processors) under written agreements requiring appropriate data protection. Information about key sub-processors may be provided upon request.
7. International Transfers
If personal data is transferred outside the EU/EEA, EngraveFill.com will ensure that appropriate safeguards are in place, such as standard contractual clauses or equivalent mechanisms recognized by GDPR.
8. Security
EngraveFill.com implements reasonable technical and organizational measures to protect data against unauthorized access, alteration, loss or destruction, considering the nature of the processing and current technological state.
9. Data Breaches
In the event of a personal data breach affecting the Controller’s data, EngraveFill.com will notify the Controller without undue delay and provide relevant information to support the Controller’s compliance obligations.
10. Data Return and Deletion
Upon termination of services, the Controller may request deletion or return of personal data processed on their behalf, unless storage is required by law.