Data Processing Agreement

01Parties and acceptance

This Data Processing Agreement (DPA) is between LIFTSOFT LLC, the operator of Remoqa (Remoqa, we or us), and the customer identified in the written acceptance of this DPA (Customer or you). Our privacy and DPA contact is our General Director at [email protected]. Company details are available at remoqa.com/terms#operator.

The Customer may be an organisation or an individual acting as a controller, or a processor authorised by its controller to appoint Remoqa. An individual purchasing a subscription for an organisation does not, by that purchase alone, establish authority to enter into this DPA for the organisation.

To enter into this DPA, contact [email protected]. Before the covered processing begins, the parties must complete the applicable schedules and record their agreement by signature or an exchange of written confirmations that identifies this version, the Customer, the covered account or organisation and the authorised representatives. Section 16 lists the particulars to record. Reading this page, creating an account or accepting the general Terms does not by itself conclude this agreement. The dates shown above apply to the published standard terms. This DPA becomes binding between Remoqa and a Customer on the date recorded in their written acceptance; the published dates do not retroactively create an agreement or authorise earlier processing.

02Scope and roles

Customer Personal Data means personal data Remoqa processes on your behalf to provide the agreed remote-access, organisation, device-management, audit or related support functions described in Schedule A. Personal data, controller, processor, processing and personal data breach have the meanings given by the data-protection law applicable to that processing, including the EU GDPR or UK GDPR where applicable.

You determine the purposes and essential means of that processing. Remoqa acts as your processor, or as a subprocessor where you act for another controller. In the latter case, you must have authority for the instructions and appointments made under this DPA, and Remoqa will assist you in meeting the corresponding obligations to your controller.

Remoqa separately determines the purposes and means of its own account administration, billing, fraud prevention, service security and legal records, as explained in the Privacy Policy at remoqa.com/privacy. The role depends on the particular activity: an organisation audit event processed for you is covered here even if separate security processing of related information is undertaken by Remoqa as a controller. We will not reclassify Customer Personal Data simply to avoid an instruction or deletion obligation. Purely personal or household use does not by itself require a controller-processor agreement.

03Instructions and Customer duties

We will process Customer Personal Data only on your documented instructions, including instructions concerning transfers. Initial instructions consist of this DPA, the completed schedules, the agreed Services and actions taken by your authorised users within those Services. Further instructions may be sent to [email protected]; both parties must keep a record. We will verify authority where necessary and inform you promptly if an instruction cannot be performed through the agreed Services.

You are responsible for a lawful basis, required notices and permissions, the accuracy and relevance of the information you provide, and lawful access to the devices and people involved. You must select appropriate access permissions, protect your endpoints and credentials, and avoid submitting unnecessary personal data. These responsibilities do not remove Remoqa's own duties.

We will immediately tell you if we consider an instruction to infringe applicable data-protection law and suspend the affected instruction while it is resolved. If law requires processing outside your instructions, we will inform you beforehand unless legally prohibited, limit processing to what is required and assess any conflict with this DPA or an applicable transfer instrument. Where EU or UK GDPR applies, an exception to instructions or erasure must meet the corresponding statutory requirements; a conflicting third-country demand is not automatic permission to disregard them.

We will not sell Customer Personal Data, use it for advertising or train general-purpose AI models on it. Processing for our own independent purposes is not authorised by this DPA.

04Personnel and confidentiality

We will allow access to Customer Personal Data only to authorised personnel who need it for the agreed processing, assistance or security obligations. Those persons must be bound by confidentiality obligations or an applicable statutory duty. We will provide appropriate data-protection instructions and review access when responsibilities change or access is no longer needed. These obligations continue after a person stops working on the Services.

05Security

We will maintain technical and organisational measures appropriate to the risks to individuals, taking account of the processing, available technology and implementation costs. Schedule B specifies the contractual measures for the agreed Services. We will review their effectiveness and update them as necessary without materially reducing the overall protection of Customer Personal Data.

Before acceptance, we will provide the information reasonably needed to assess those measures and agree any additional safeguards required for the intended use. Detailed infrastructure addresses, topology and sensitive security material may be supplied confidentially rather than published. Confidentiality must not prevent the Customer or a competent authority from obtaining information required by law. This DPA does not claim an independent certification or guarantee that every possible risk is eliminated.

06Rights requests and assistance

Taking account of the nature of the processing, we will help you respond to requests for access, correction, erasure, restriction, portability, objection and other applicable rights. We will promptly forward a request concerning Customer Personal Data to your designated contact and will not decide it on your behalf unless you instruct us to do so or law requires a response. We may acknowledge receipt and identify the responsible contact.

We will assist with security obligations, breach assessments and notifications, data-protection impact assessments and prior consultation with regulators, taking account of the information available to us. We will provide relevant records and cooperate within the time reasonably needed to meet the applicable deadline. Use available cabinet controls where suitable; contact [email protected] for data or actions not available through those controls. An account closure or a partial audit export is not necessarily a complete response to a rights request.

07Personal data breaches

We will notify your designated contact without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Initial notification will not wait for a complete investigation or for Remoqa to decide whether the breach is reportable to a regulator. The ordinary support working hours and initial-response promise do not postpone this obligation.

As information becomes available, we will describe the incident, affected categories and approximate numbers of individuals and records where known, likely consequences, containment and remedial measures, and a contact for further information. We may provide this in stages without undue further delay. We will preserve relevant evidence, investigate, take appropriate corrective measures and cooperate with your assessment and response.

You determine notifications to individuals or regulators for processing you control, with our assistance. We will not make a notification in your name without authorisation unless legally required. You must keep your notification contact current and available to receive urgent messages.

08Subprocessors

By entering into the completed DPA, you give general written authorisation for the subprocessors identified in Schedule C, solely for the listed activities. We will use written terms imposing equivalent data-protection duties on them, assess their ability to protect Customer Personal Data and remain responsible to you for their performance of those duties.

We will give at least 30 calendar days of advance written notice to your designated contact before adding or replacing a subprocessor that will receive Customer Personal Data. The notice will identify the provider, task, relevant data and countries. You may object on reasonable data-protection grounds during that period. A website update alone does not replace the notice.

We will work with you on an alternative or safeguards addressing a timely objection. We will not send your Customer Personal Data to the proposed provider while that objection remains unresolved. If a suitable solution cannot be agreed, either party may end the affected part of the Services before the change; unused prepaid fees for that discontinued part will be returned. Required deletion, return and assistance obligations continue.

09Locations and international transfers

Primary application, database and backup hosting is in Singapore. Current shared relay locations are Singapore and the Netherlands. Routing takes account of latency, location, availability and connection continuity; it does not guarantee processing within your country. Authorised Remoqa personnel may access Customer Personal Data remotely from countries where they work, including Russia, subject to the locations and safeguards agreed with the Customer and the requirements of this section. Schedule C identifies email processing locations.

Additional relay locations or other material changes to processing countries require advance information and the same 30-calendar-day notice and objection process as in section 8. Routing remains within the agreed locations until the applicable requirements are met. Selecting the nearest available relay or accepting this DPA does not dispense with international-transfer requirements.

Before a restricted transfer begins, the parties must identify the exporter and importer, their roles, the data and destinations, and establish an applicable lawful transfer mechanism and any necessary assessment or supplementary safeguards. Where appropriate, this may require separately completed EU standard contractual clauses, a UK Addendum or IDTA, or another valid instrument. The correct instrument and scope depend on the actual parties and processing; none is deemed executed merely by linking this DPA.

Where a transfer mechanism is required for the covered processing, the parties must complete and enter into the applicable transfer terms and annexes in a separate Customer-specific schedule before the transfer begins. That schedule forms part of the agreement and is not published on this page. Where no separate transfer instrument is required, the parties record the applicable basis in the Customer's acceptance record. If the necessary protection cannot be provided, we will suspend the affected transfer and cooperate on a lawful alternative or return and deletion. This DPA supplements, and does not replace or alter, mandatory transfer terms.

10Return deletion and retention

We will retain Customer Personal Data only for the agreed processing and your documented retention instructions. At the end of the covered Services, you may choose return followed by deletion, or deletion without return, by writing to [email protected]. You may change that choice before completion. If you give no different instruction, deletion is the default.

We will complete the chosen return and deletion from active systems without undue delay and within 30 days after the covered Services end, unless a shorter period is legally required. Return will use a reasonably usable format appropriate to the data, and copies will then be deleted. The same process applies to a verified earlier deletion instruction within its agreed or legally required deadline. We will obtain the necessary action from subprocessors and confirm completion in writing, identifying any permitted outstanding backup copies or legal exception.

Backup copies will be isolated from ordinary use when the deletion instruction is implemented and erased or irreversibly overwritten within 30 calendar days after deletion from active systems. During that period they may be used only for necessary recovery under controlled access or legally required retention. If recovery occurs, applicable deletion instructions must be reapplied before the recovered data returns to ordinary use.

Any legally required exception must be limited to the relevant data, purpose and period, with restricted access and notice to you unless prohibited. Where EU or UK GDPR applies, the exception must satisfy the corresponding law. Independent controller records, such as a purchase record Remoqa is required to keep, are governed by the Privacy Policy and must not become a reason to retain unrelated Customer Personal Data.

The account-restoration periods described in the Privacy Policy do not automatically authorise continued retention of Customer Personal Data after your processing instructions end. Support correspondence held solely on your behalf is also subject to this section; the general support retention period is not permission to override an earlier applicable deletion instruction. Data held independently on your devices or by other participants remains under their responsibility.

11Information and audits

We will provide information needed to demonstrate compliance with this DPA and applicable processor duties, and allow and contribute to audits and inspections by you or an independent auditor you appoint. Relevant documentation may be reviewed first, but it does not replace an inspection where that is needed to verify compliance.

Routine audits should use reasonable advance notice, confidentiality protections and a scope relevant to your processing. Safeguards may protect other customers and sensitive security information but must not prevent a meaningful audit. Urgent concerns, a breach or a regulator's requirement may justify shorter notice or additional inspection. We will cooperate with competent authorities and address identified shortcomings. Any agreed charge for additional assistance must be reasonable and must not obstruct mandatory rights or compliance.

12Term precedence and changes

This DPA continues while we or our subprocessors hold Customer Personal Data on your behalf, including during return and deletion. The confidentiality, security and assistance duties remain applicable for that period. The general Services contract remains in place except where this DPA specifically provides otherwise.

For Customer Personal Data, this DPA takes priority over conflicting general Terms or Privacy Policy descriptions. Mandatory law and any applicable mandatory transfer clauses take priority over this DPA. No provision limits an individual's or regulator's statutory rights or excludes liability where the law prohibits that exclusion. No new exclusive jurisdiction or arbitration requirement is created here.

A change to an accepted DPA requires the parties' written agreement, with at least 30 calendar days of advance notice for a proposed material change unless law requires earlier action. Provider or location changes may follow the notice and objection process expressly agreed in sections 8 and 9. Publishing a revised page alone does not amend an accepted version or retrospectively authorise processing.

13Schedule A - Processing details

The completed acceptance must identify any different categories, purposes, recipients or safeguards for the Customer's use. A new feature requiring materially different processing must be covered by documented instructions and necessary safeguards before that processing starts.

14Schedule B - Security measures

The following are Remoqa's commitments for processing under an accepted DPA. They must be supported by the actual configuration and operational procedures for the covered Services. Customer-controlled endpoint security, permissions and exported copies remain the Customer's responsibility.

Any Customer-specific requirements and evidence needed to establish suitability must be included in the completed agreement. This schedule does not assert a particular certification, an independently audited production configuration or a service-availability percentage.

15Schedule C - Subprocessors and locations

Remoqa maintains this register to reflect the providers used for Customer Personal Data, including any separate relay operator or support-forwarding service. Further processors in a provider's chain remain subject to equivalent obligations and the authorisation and notice arrangements in section 8. Remote personnel access is described in section 9; our personnel are not a separate subprocessor merely because of their working location.

The DigitalOcean CDN is used only for the informational landing. Landing analytics and independent sign-in or payment processing are described in the Privacy Policy and are not automatically authorised as processing of Customer Personal Data under this schedule. A private relay host independently selected and contracted by the Customer is the Customer's provider; if Remoqa appoints a provider on the Customer's behalf, it must be included in the agreed register.

DigitalOcean data processing agreement ↗

Plunk Cloud data processing agreement ↗

16Schedule D - Acceptance record

The signed agreement or written confirmation exchanged by both parties must identify the following particulars. They are completed for the specific Customer and are not published on this page.

• The Customer's legal name, address, authorised representative and role as controller or processor; where relevant, the controller on whose behalf it acts.
• The covered Remoqa account and organisation identifiers, Services, applicable DPA version, commencement date and designated privacy and urgent incident contacts.
• Confirmed party contact and postal details, including Remoqa's full address; any additional processors, countries, processing categories or Customer-specific safeguards.
• The Customer-specific transfer schedule completed under section 9, including any binding transfer terms and annexes, or the documented basis on which no separate transfer instrument is required; and any shorter retention or different return instructions permitted by law.
• Evidence of each party's acceptance and authority, with a copy of the completed DPA and schedules available to both parties.

Send the request and necessary particulars to [email protected]. Avoid including unrelated personal data or sensitive information. A request to discuss or complete this agreement is not acceptance until both parties record their agreement.