Data Processing Addendum (DPA)

This Data Processing Addendum ("DPA") applies to all users of FinalSaying and forms part of our Terms of Service and Privacy Policy. It describes how personal data is processed by FinalSaying in compliance with the EU General Data Protection Regulation (GDPR).

1. Introduction

FinalSaying is a digital service operated by Vilva Athiban ("we", "our", "us"), an individual developer based in Germany. This page explains the roles involved in processing personal data through the Service, the providers we rely on, and the commitments we make about how data is handled.

Our role — please read this first. For individuals using FinalSaying for their own personal purposes, we are the data Controller, not a Processor: we decide how and why data is processed, and our obligations to you are those set out in our Privacy Policy. An earlier version of this page described us as a Processor acting on your behalf, which was not correct for a consumer service, and we have corrected it. Nothing about how we actually handle your data has changed. Where the sections below describe commitments in processor-style language (security measures, sub-processors, international transfers, deletion), we give those same commitments to you as Controller.

When we would act as a Processor. If an organisation (rather than a private individual) ever uses the Service to process personal data for its own business purposes, that organisation is the Controller and we would act as its Processor. In that case the terms below operate as a data processing agreement under Article 28 GDPR. If you need a signed Article 28 agreement, contact us.

By using FinalSaying, you acknowledge and agree to this DPA.

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on personal data, including storage, transmission, or deletion.
• "Controller" means the party that determines the purposes and means of processing. For consumer use of FinalSaying that is us; for the organisational scenario described in Section 1, it is the organisation.
• "Processor" means a party processing personal data on a Controller's behalf — the role FinalSaying takes only in that organisational scenario.
• "Sub-Processor" means a third-party service engaged to process personal data on behalf of FinalSaying.
• "SCCs" means Standard Contractual Clauses approved by the European Commission for lawful international data transfers.

3. Scope and Details of Processing

• Subject Matter: Operation of the FinalSaying SaaS platform.
• Duration: For as long as the user account remains active or until data is deleted.
• Nature and Purpose: Secure storage, encryption, and delivery of user-defined messages and instructions.
• Data Types: Name, email address, contact information of message recipients, encrypted message content, payment metadata.
• Data Subjects: Users of FinalSaying and their designated recipients.

4. Our Obligations

We commit to the following, whether we are acting as Controller (consumer use) or as Processor (organisational use):

• Process personal data only for the purposes described in our Privacy Policy or, where we act as Processor, on the Controller's documented instructions.
• Ensure our personnel are bound by confidentiality.
• Implement appropriate technical and organizational security measures.
• Notify you without undue delay if we become aware of a personal data breach.
• Assist you in fulfilling your obligations under GDPR, including subject access requests.
• Provide documentation or audit support on request.
• Delete or return personal data upon request or termination of service.

5. Sub-Processors

We currently use the following authorized Sub-Processors:

We will inform users of any intended changes to Sub-Processors, allowing you to object within a reasonable period.

6. International Transfers

When we transfer personal data outside the European Economic Area (EEA), we ensure it is protected by appropriate safeguards, including Standard Contractual Clauses (SCCs), to maintain an adequate level of data protection.

7. Data Security

We apply the following security practices:

• Encryption at rest (AES-256-GCM) of message text and subjects, with the key held on our server. Photo attachments are not encrypted; see our security page.
• TLS for data in transit.
• Secure user authentication.
• Role-based access controls.
• Regular monitoring and threat mitigation.

8. Data Subject Rights

We will assist you in responding to requests from data subjects regarding access, correction, deletion, or portability of their personal data as required by GDPR.

9. Deletion or Return of Data

Upon service termination or on request, we will delete or return all personal data, except where retention is required by law.

10. Changes to This DPA

We may update this DPA from time to time. Continued use of the FinalSaying service after changes indicates acceptance of the updated terms.

11. Governing Law

This DPA is governed by and shall be construed in accordance with the laws of Germany. Jurisdiction lies with the courts of Berlin.

12. Contact

For questions or concerns regarding this DPA, please contact:

Vilva Athiban Periyasamy Boominathan

📧 contact@finalsaying.com

📍 Berlin, Germany

By using FinalSaying, you automatically agree to the terms outlined in this DPA.