1. Roles and instructions
The DPA identifies the customer and Tymivo’s roles, the subject matter and duration of processing, categories of data and data subjects, documented instructions, confidentiality and the limits of permitted processing.
2. Security and personnel
The agreement addresses appropriate technical and organisational measures, authorised personnel, confidentiality commitments, access controls and the customer’s responsibility for lawful instructions and account configuration.
3. Assistance
The agreement describes reasonable assistance with data-subject requests, security incidents, risk assessments, regulator consultations and information needed to demonstrate compliance.
4. Subprocessors and transfers
The agreement covers subprocessor authorisation, flow-down obligations, change notifications and lawful safeguards for restricted international transfers where required.
5. Return and deletion
At the end of services, personal data is returned or deleted as agreed, subject to lawful retention obligations and documented backup cycles.
6. Requesting the DPA
Authorised procurement or legal contacts may request the current enterprise DPA from [email protected].