# Data Processing Agreement (DPA) — Chaello Online

> ⚠️ TEMPLATE — not legal advice. Have a qualified lawyer review before use.
> Applies to the online (SaaS) service where Chaello processes personal data on
> behalf of a business customer (e.g. under GDPR).

**Effective date:** [Effective Date]
**Processor:** Chaello — [Legal Entity Name], [Jurisdiction].
**Controller:** the business customer using the Service.

## 1. Roles
For business data you upload, you are the **Controller** and Chaello is the
**Processor**, processing personal data only on your documented instructions
(i.e. to provide the Service).

## 2. Subject matter & duration
Processing lasts for the term of your subscription plus any legally required
retention.

## 3. Nature & purpose
Hosting and processing your business records (customers, invoices, payments, etc.)
to deliver the Service.

## 4. Categories of data & data subjects
Your customers/contacts and their contact and transaction details, as entered by
you.

## 5. Security
Chaello implements appropriate technical and organizational measures, including
encryption in transit (HTTPS) and access controls. (Desktop data is encrypted at
rest on the user's device.)

## 6. Sub-processors
Chaello uses vetted sub-processors (e.g. hosting/CDN provider; payment provider
Paddle) under contract. A current list is available on request; we give notice of
changes.

## 7. Assistance
Chaello will reasonably assist you with data-subject requests, breach
notification, and DPIAs.

## 8. Sub-processing & transfers
International transfers use appropriate safeguards.

## 9. Deletion/return
Chaello does not delete Customer data on its own initiative. On termination the
account is disabled and the data retained intact for at least twelve months, so
that the Customer can export records it may be legally required to keep. Data is
returned on request at any time in that period, in a complete machine-readable
export.

Erasure is carried out only on the Customer's written instruction, sent from the
address registered on the account, and is performed only by the platform owner —
it cannot be triggered by Chaello staff or by an administrator within the
Customer's own organisation. Erasure is irreversible.

## 10. Audit
Chaello will make available information reasonably necessary to demonstrate
compliance.

## Contact
[privacy@chaello.com]