Data Processing Agreement

Section 1

Parties and Subject Matter

This DPA is between the customer that signs it ("you", the controller) and Remediada Holdings LLC, 30 N Gould St, Sheridan, WY 82801 ("we", the processor). It forms part of our Terms of Service and applies to personal data we process on your behalf while providing the Service ("customer personal data"). It meets Article 28 of the GDPR and of the UK GDPR.

Section 2

Duration

This DPA lasts as long as we process customer personal data for you. That ends when your account is closed and the data is erased under Section 11.

Section 3

Nature and Purpose of Processing

We process customer personal data only to provide the Service you use: scanning your websites, checking and fixing your documents, checking your app builds and source code, running your app in our emulator or simulator, writing fixes, and producing reports, accessibility conformance reports and draft accessibility statements. Processing includes collection, storage, rendering, analysis by automated systems (including AI models), modification when we apply a fix, transfer to our sub-processors, and deletion.

Section 4

Types of Personal Data

Whatever personal data is contained in the material you give us, which can include:

• names, email addresses, phone numbers and job titles shown on your web pages;
• text, photos, signatures and other content inside documents you upload;
• data shown on your app's screens in our screenshots, and data inside your app source code;
• account data of your users that appears in any of the above.

The Service is not designed to process special categories of personal data. Do not give us material containing them unless you have a lawful basis and it is needed for the check.

Section 5

Categories of Data Subjects

Your staff, your customers and users, and any other people whose personal data appears in your websites, documents, apps or source code.

Section 6

Our Obligations as Processor

We will:

• process customer personal data only on your documented instructions, which are these Terms, this DPA and your use of the Service, unless the law requires otherwise, and tell you if we think an instruction breaks data protection law;
• make sure everyone who processes it for us is bound by confidentiality;
• apply the security measures in Section 8;
• use sub-processors only as Section 7 allows;
• help you answer requests from data subjects exercising their rights, and help you with security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing;
• delete or return customer personal data as Section 11 describes;
• give you the information you need to show compliance with Article 28, and allow audits under Section 10.

Section 7

Sub-processors

You give us general authorisation to use the sub-processors listed on our sub-processors page. We will tell you by email at least 30 days before we add or replace one. You may object in writing within that period on reasonable data protection grounds; if we cannot resolve the objection, you may terminate the affected part of the Service and we refund any fees you prepaid for the period after termination. We bind each sub-processor to data protection obligations no less protective than this DPA, and we remain responsible to you for their performance.

Section 8

Security Measures

We apply the technical and organisational measures described on our security page and in Section 8 of the Privacy Policy. They include: encryption in transit (TLS) for all traffic; platform credentials encrypted at rest with AES-256-GCM; row-level security turned on for every database table, with separation between customers enforced in our application code on every request, because our servers use a service key that bypasses row-level security; uploads kept in a private storage bucket; access to production restricted to named individuals; and a snapshot of the original content of every applied fix, so a change can be rolled back on the platforms we write to. We may improve these measures but will not reduce the overall level of protection.

Section 9

Personal Data Breaches

We will notify you without undue delay after we become aware of a personal data breach affecting customer personal data, with the information we have about its nature, likely consequences and the measures taken, and we will add to it as we learn more.

Section 10

Audits

On request we will answer reasonable written questions about our processing and provide the documentation we have. If that is not enough to show compliance, you may audit our processing once a year, or after a breach, with at least 30 days' notice, during business hours, at your own cost, and under confidentiality. A supervisory authority may audit whenever the law allows.

Section 11

Deletion and Return

During the term you can export your account record, scans, fix jobs and messages from your dashboard. For uploads, screenshots, conformance reports and corrected files, ask us and we send them. We delete customer personal data on the schedule in the Privacy Policy, Section 9. When your account is closed, erasure starts 30 days later. It waits while a subscription, monitoring enrollment, account suspension or open payment dispute is still on the account, and a held account is checked again every week. The remaining customer personal data is then erased by an automatic job, unless the law requires us to keep it. An account the job cannot erase automatically is erased on request.

Section 12

International Transfers and Standard Contractual Clauses

Customer personal data is processed in the United States and in Singapore (see the sub-processors page). For transfers from the European Economic Area, the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 are incorporated into this DPA by reference:

• Module 2 (controller to processor) where you are a controller;
• Module 3 (processor to processor) where you act as a processor for your own customer.

For those clauses: you are the data exporter and we are the data importer; the optional docking clause (Clause 7) applies; under Clause 9 the general authorisation and notice period in Section 7 of this DPA apply; the optional redress wording in Clause 11 does not apply; Clauses 17 and 18 choose the law and courts of Ireland; and the details the Annexes require are Sections 1 to 8 of this DPA and the sub-processors page. For transfers from the United Kingdom, the UK International Data Transfer Addendum to those clauses applies. If the clauses conflict with this DPA, the clauses prevail.

Section 13

Order of Precedence

For customer personal data, this DPA prevails over the Terms of Service where they conflict. Nothing in this DPA reduces either party's obligations under the GDPR or the UK GDPR.