- Legal
Data Processing Addendum
This Data Processing Addendum (“DPA”) forms part of the A11yRemedy Terms of Service (“Terms”) between Oktohut Solutions Private Limited, India (“A11yRemedy”, “we”, “us”) and the customer that has agreed to the Terms (“Customer”, “you”). It applies automatically when you accept the Terms. You do not need to sign it separately.
1. Definitions
Terms not defined here have the meanings given in the Terms or in Data Protection Laws.
Data Protection Laws: all laws on personal data that apply to the processing under this DPA, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, India’s Digital Personal Data Protection Act 2023, and US state privacy laws.
Customer Personal Data: personal data that we process on your behalf in providing the Service, as described in Annex 1.
Sub-processor: a third party we engage to process Customer Personal Data.
Standard Contractual Clauses (SCCs): the clauses approved by European Commission Implementing Decision (EU) 2021/914.
UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
2. Roles
2.1 You are the controller of Customer Personal Data, or a processor acting for your own clients (“End Clients”). We are your processor, or your sub-processor where you act for End Clients.
2.2 This DPA does not cover personal data we process as a controller for our own purposes, such as account administration, billing, security and legal compliance. That processing is described in our Privacy Policy.
2.3 Paddle.com, our reseller and Merchant of Record, processes payment data as an independent controller. Paddle is not our Sub-processor under this DPA.
3. Your responsibilities
You confirm that:
4. Our obligations
4.1 Instructions. We process Customer Personal Data only on your documented instructions, unless the law requires otherwise. The Terms, this DPA and your configuration of the Service are your complete instructions. If we believe an instruction breaks Data Protection Laws, we will tell you.
4.2 Confidentiality. Everyone we authorise to process Customer Personal Data is bound by confidentiality obligations.
4.3 Security. We maintain the technical and organisational measures described in Annex 2. We may update these measures as long as the overall level of protection does not decrease.
4.4 Assistance. Taking into account the nature of the processing, we will help you respond to requests from individuals exercising their rights, and with data protection impact assessments and consultations with supervisory authorities. Much of this can be done by you directly in the Service. If we receive a request directly from an individual about Customer Personal Data, we will pass it to you and will not respond ourselves unless you instruct us to or the law requires it.
4.5 Personal data breaches. We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will give you the information you reasonably need to meet your own obligations, and take reasonable steps to contain and fix the breach.
4.6 Deletion. When your account closes, we will delete Customer Personal Data within 30 days, except where the law requires us to keep it. During those 30 days, you may ask for an export of your Scan Results. Backups are overwritten on a rolling 30-day cycle.
5. Sub-processors
5.1 You give us general authorisation to engage Sub-processors. The current Sub-processors are listed in Annex 3.
5.2 We will tell you at least 30 days before adding or replacing a Sub-processor, by email or by updating this DPA with notice in the app. You may object on reasonable data protection grounds within that period. If we cannot reasonably address your objection, you may terminate the affected Service, and we will refund prepaid fees for the unused part of your billing period.
5.3 We will impose data protection obligations on each Sub-processor that are no less protective than those in this DPA. We remain responsible for our Sub-processors’ performance.
6. International transfers
6.1 Customer Personal Data is stored in the European Union (see Annex 3). It is accessed from India by our personnel to operate and support the Service, and some Sub-processors are in the United States.
6.2 For transfers of Customer Personal Data from the EEA to a country without an adequacy decision, the parties agree that the SCCs are incorporated into this DPA by reference, as follows:
Module 2 (controller to processor) applies where you are a controller.
Module 3 (processor to processor) applies where you are a processor.
Clause 7: (docking clause) applies.
Clause 9: option (b), general authorisation, applies, with the notice period in section 5.2.
Clause 11: the optional language does not apply.
Clauses 17 and 18: the SCCs are governed by the law of Ireland, and disputes are resolved by the courts of Ireland.
Annexes: Annex I of the SCCs is completed with Annex 1 of this DPA, and Annex II with Annex 2 of this DPA.
6.3 For transfers from the United Kingdom, the UK Addendum applies. Its Table 1 to 3 information is taken from this DPA and the SCCs as set out above, and either party may end it as allowed by its section 19.
6.4 For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the competent authority is the Swiss Federal Data Protection and Information Commissioner.
6.5 Onward transfers to Sub-processors are protected by the SCCs or another valid transfer mechanism, such as the EU–US Data Privacy Framework.
7. Audits
We will make available the information reasonably needed to show that we comply with this DPA, including completed security questionnaires. If that information is not enough to demonstrate compliance, you may audit our compliance once a year, at your own cost, with at least 30 days’ written notice. The audit must take place during normal business hours and be subject to confidentiality obligations. Audits may be carried out remotely where possible.
8. Liability and precedence
Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Laws do not allow this. If this DPA conflicts with the Terms, this DPA prevails in relation to Customer Personal Data. If the SCCs conflict with this DPA, the SCCs prevail.
9. Term
This DPA remains in force for as long as we process Customer Personal Data for you.
Annex 1: Details of processing
Subject matter and duration: providing the Service under the Terms, for the term of your account plus the deletion period in section 4.6.
Nature and purpose: automated accessibility scanning of websites you configure; storing and displaying Scan Results; generating reports, accessibility statements and VPAT drafts; sending alerts; user and team management.
Categories of data subjects: your Authorised Users; your End Clients’ personnel whose details you enter; individuals whose personal data appears on websites you scan; contact persons named in accessibility statements.
Categories of personal data: names, email addresses and roles of Authorised Users; website login credentials you provide for authenticated scanning; contact details you include in statements and documents; personal data that appears in page content, page addresses or HTML fragments captured during scans; technical data such as IP addresses in logs.
Special categories: none intended.
Frequency of transfer continuous, for as long as the Service is used.
Annex 2: Technical and organisational security measures
Hosting: the application and its database are hosted in the EU (Finland). Off-site backups are stored in the EU (Netherlands) on a rolling 30-day cycle.
Encryption in transit: all traffic to the Service is encrypted with HTTPS/TLS.
Credentials: passwords are stored as one-way hashes. Website credentials for authenticated scanning are encrypted before storage and are never shown back after saving.
Data separation: each customer organisation’s data is logically separated, and access is scoped to that organisation.
Access control: role-based access within customer accounts. Administrative access to production systems is limited to authorised personnel on a need-to-know basis.
Abuse prevention: rate limiting on authentication and scanning endpoints, and checks that block scanning of private network addresses.
Monitoring: application error monitoring and server logs, with logs kept for 30 days.
Incident response: breach notification as set out in section 4.5.
Personnel: confidentiality obligations for everyone with access to Customer Personal Data.
Annex 3: Sub-processors
|
Sub-processor |
Purpose |
Location |
|---|---|---|
|
Hetzner Online GmbH |
Application hosting and database |
Finland (EU) |
|
Backblaze, Inc. |
Off-site database backups |
Netherlands (EU) |
|
Resend, Inc. |
Sending service emails (alerts, notifications) |
United States |
|
Functional Software, Inc. (Sentry) |
Application error monitoring |
United States |
|
OpenAI, L.L.C |
AI-drafted alt text and ARIA guidance (only on plans that include it) |
United States |
If you connect Slack, alerts are delivered to the Slack workspace you choose, under your own agreement with Slack.
Contact
Oktohut Solutions Private Limited, AN Square, WG 1-F-3/1120, Unichira Thoppil Road, Marottichuvadu, Edappally, Kochi, Ernakulam, Kerala 682021, India
Email: support@a11yremedy.com
Phone: +91 80894 62726