Roles of the parties
The customer acts as data controller for personal data entered, synchronised or managed within the Esdra platform. Esdra acts as data processor within the limits of the customer’s documented instructions.
This DPA supplements the terms of service and applicable commercial agreements.
Subject matter, duration, nature and purpose
- Subject matter: processing the data required to provide the platform, hosting, support, synchronisations, integrations, EVA AI and connected services.
- Duration: for the term of the contract and for the period required for deletion, return, backups, legal obligations or the defence of rights.
- Nature: collection, recording, organisation, storage, consultation, processing, disclosure, deletion and technical support.
- Purpose: provision and maintenance of the Esdra service on behalf of the customer.
Categories of data and data subjects
- Data relating to end customers, prospects, suppliers, staff, account users, business contacts and individuals named in documents managed by the customer.
- Identification and contact data, orders, purchase history, stock levels, communications, documents, logs, preferences and operational data required for the service.
Esdra’s obligations as data processor
- Process data only on the customer’s documented instructions.
- Ensure that persons authorised to process data are bound by confidentiality.
- Implement technical and organisational measures appropriate to the risk.
- Assist the customer in handling data subject rights where technically possible.
- Assist the customer with security, personal data breaches, DPIAs and prior consultations, within the scope of the service.
- Delete or return data at the end of the relationship, unless retention is legally required.
- Provide reasonable information to demonstrate compliance with the DPA.
Subprocessors
The customer authorises Esdra to use subprocessors required to provide the service. Esdra maintains an up-to-date list of subprocessors and imposes obligations consistent with this DPA.
Any material changes will be communicated by reasonable means, allowing the customer to raise objections where provided for by the applicable agreements.
Personal data breaches
If a personal data breach involves data processed on the customer’s behalf, Esdra will notify the customer without undue delay after becoming aware of it and provide the information reasonably available.
