Data processing agreement

Last updated 29 October 2026

When your workspace holds personal data of other people (your customers, followers, clients), you are the controller and we are your processor. This agreement covers that, as GDPR Article 28 requires.

In short

• We process personal data only to run RelayPo for you and only on your documented instructions (using the product counts as instructions).
• Everyone at [Company legal name] with access is bound to confidentiality.
• Security measures: encryption in transit and at rest, two-step login for our team, least-privilege access, logged admin actions, backups, tested restores.
• Sub-processors are listed in the privacy policy. We tell account owners 30 days before adding one, and you can object.
• We help you answer data subject requests and tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data.
• When the agreement ends, we delete your data within 30 days unless law requires us to keep it, and you can export it first.
• You may audit our compliance once a year with reasonable notice, or rely on our written answers and certifications.

Signed copy

Need a countersigned DPA for your records? Email privacy@relaypo.com with your company name and address. [Full DPA text with annexes (SCCs, technical measures, sub-processor list) — to be finalised with a lawyer]