Data Processing Agreement

1. Scope

This DPA forms part of the agreement between Cavas (the "Processor") and the customer (the "Controller") and applies where Provisore processes personal data contained in the Controller's server configuration, deploy logs, or team records on the Controller's behalf, within the meaning of GDPR art. 28.

2. Nature and purpose of processing

Processing is limited to what is necessary to provide the service: storing configuration, executing operations on the Controller's servers at the Controller's direction, and displaying resulting logs. Categories of data subjects: the Controller's team members and, incidentally, end users whose data appears in logs.

3. Processor obligations

• Process personal data only on documented instructions from the Controller.
• Ensure personnel are bound by confidentiality.
• Implement the technical and organisational measures described in Annex II (encryption at rest and in transit, 2FA, audit logging, least-privilege access).
• Assist the Controller with data-subject requests and breach notifications (within 48 hours of becoming aware).
• Delete or return all personal data within 30 days of contract termination.

4. Sub-processors

The Controller grants general authorisation for the sub-processors listed at provisore.com/legal/subprocessors. We will give 30 days' notice before adding or replacing a sub-processor, during which the Controller may object.

5. Audits

On reasonable notice, and no more than once per year, the Controller may audit compliance with this DPA, either through documentation we provide or, where legally required, an on-site inspection under NDA.

6. Signing

A countersigned copy of this DPA is available on request to legal@cavas.dk. For most customers this pre-signed DPA applies automatically upon subscription.