Data Processing Agreement (DPA)

Last updated: 2026-06-18

This data processing agreement ("DPA") governs Talviqo's processing of personal data on behalf of the customer in accordance with Article 28 of the GDPR.

1. Parties and roles

The customer is the controller and Talviqo, company reg. no., is the processor.

2. Subject matter and duration

The processor processes personal data only to provide the service, for the term of the agreement and for the time required for wind-down.

3. Obligations of the processor

• Process data only on documented instructions from the controller.
• Ensure that authorised persons are bound by confidentiality.
• Implement appropriate security measures in accordance with Article 32.
• Assist the controller in fulfilling data subject rights and notification obligations.
• Delete or return data at the end of the agreement.

4. Sub-processors

The processor may engage sub-processors (e.g. hosting and infrastructure) provided that equivalent obligations are imposed on them by contract. A current list is available on request.

5. Transfers to third countries

Transfers outside the EU/EEA take place only with appropriate safeguards, such as the European Commission's standard contractual clauses.

6. Security incidents

The processor notifies the controller without undue delay after becoming aware of a personal data breach.

7. Audit

The processor provides the controller with the information necessary to demonstrate compliance with the obligations in Article 28, and allows for audits.

8. Contact

Questions about this agreement? Email gdpr@talviqo.com.