Data Processing Addendum
Data-protection terms between Opright and each workspace customer.
This Data Processing Addendum (“DPA”) forms part of the Opright Terms between Opright and the business or organization controlling a workspace (“Customer”). It applies when Opright processes personal data for Customer to provide the service.
1. Roles and instructions
Customer is the controller or business and Opright is the processor or service provider for Customer Data. Opright will process Customer Data only to provide, secure, maintain, and support Opright; follow Customer’s documented use of the service; comply with law; or as otherwise agreed in writing. The Terms, settings, support requests, and lawful product actions are Customer’s documented instructions.
2. Customer responsibilities
Customer will provide lawful instructions, give required privacy notices, obtain required consents, honor individual rights, limit access, and avoid submitting data not appropriate for Opright. Customer is responsible for its own employees, contractors, customers, retention choices, and lawful use of outputs.
3. Confidentiality and security
Opright will ensure that people authorized to process Customer Data are bound by confidentiality obligations and will maintain reasonable technical and organizational safeguards appropriate to the risk. Current measures are summarized at Security at Opright.
4. Subprocessors
Customer gives general authorization for the subprocessors on the Subprocessor List. Opright will require subprocessors to protect Customer Data consistently with applicable obligations. Opright will post material additions before or when they begin processing Customer Data when practical. A Customer with a reasonable data-protection objection may contact Opright; if no reasonable alternative exists, either party may end the affected service.
5. Individual requests
Taking into account the nature of processing, Opright will reasonably assist Customer with verified requests for access, correction, deletion, portability, restriction, or objection. If Opright receives a request about Customer Data directly, Opright may refer it to Customer and will not independently act contrary to Customer’s lawful instructions.
6. Security incidents
Opright will notify Customer without undue delay after confirming a breach of Customer Data for which notice is required. Notice will include available information about the nature of the incident, affected data, likely consequences, and mitigation. Notice is not an admission of fault. Customer is responsible for notices it must give unless law assigns that duty to Opright.
7. Return and deletion
During an active account, owners can export available workspace data. After termination or a verified deletion request, Opright will delete or de-identify Customer Data according to the published retention schedule, unless law requires retention. Data in backups is isolated from normal use and removed as backups cycle out.
8. Assistance and information
Opright will provide information reasonably necessary to demonstrate compliance with this DPA and will respond to reasonable security questionnaires. Formal audits must be legally required or based on credible evidence, use an independent qualified auditor, protect confidentiality, avoid service disruption, and be at Customer’s expense unless a material Opright breach is found.
9. International transfers
Opright is currently offered to U.S. businesses. If Customer’s use later requires a specific international transfer mechanism, the parties will cooperate in good faith to put an applicable mechanism in place before that processing begins.
10. Priority and contact
If this DPA conflicts with the Terms about processing Customer Data, this DPA controls. Other Terms remain unchanged. Contact support@mail.oprightapp.com for data-protection matters.