Data Processing Addendum (DPA)

This Data Processing Addendum ("DPA") applies to all users of FinalSaying and forms part of our Terms of Service and Privacy Policy. It describes how personal data is processed by FinalSaying in compliance with the EU General Data Protection Regulation (GDPR).

1. Introduction

FinalSaying is a digital service operated by Vilva Athiban ("we", "our", "us"), an individual developer based in Germany. We act as a "Processor" under the GDPR when processing personal data on behalf of our users ("Controllers"). This DPA outlines our responsibilities and commitments under Article 28 of the GDPR.

By using FinalSaying, you acknowledge and agree to this DPA.

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on personal data, including storage, transmission, or deletion.
• "Controller" means you, the user, who determines the purposes and means of processing.
• "Processor" means FinalSaying, processing data on your behalf.
• "Sub-Processor" means a third-party service engaged to process personal data on behalf of FinalSaying.
• "SCCs" means Standard Contractual Clauses approved by the European Commission for lawful international data transfers.

3. Scope and Details of Processing

• Subject Matter: Operation of the FinalSaying SaaS platform.
• Duration: For as long as the user account remains active or until data is deleted.
• Nature and Purpose: Secure storage, encryption, and delivery of user-defined messages and instructions.
• Data Types: Name, email address, contact information of message recipients, encrypted message content, payment metadata.
• Data Subjects: Users of FinalSaying and their designated recipients.

4. Our Obligations as Processor

We commit to:

• Only process personal data on your documented instructions.
• Ensure our personnel are bound by confidentiality.
• Implement appropriate technical and organizational security measures.
• Notify you without undue delay if we become aware of a personal data breach.
• Assist you in fulfilling your obligations under GDPR, including subject access requests.
• Provide documentation or audit support on request.
• Delete or return personal data upon request or termination of service.

5. Sub-Processors

We currently use the following authorized Sub-Processors:

We will inform users of any intended changes to Sub-Processors, allowing you to object within a reasonable period.

6. International Transfers

When we transfer personal data outside the European Economic Area (EEA), we ensure it is protected by appropriate safeguards, including Standard Contractual Clauses (SCCs), to maintain an adequate level of data protection.

7. Data Security

We apply the following security practices:

• End-to-end encryption of messages and attachments.
• TLS for data in transit.
• Secure user authentication.
• Role-based access controls.
• Regular monitoring and threat mitigation.

8. Data Subject Rights

We will assist you in responding to requests from data subjects regarding access, correction, deletion, or portability of their personal data as required by GDPR.

9. Deletion or Return of Data

Upon service termination or on request, we will delete or return all personal data, except where retention is required by law.

10. Changes to This DPA

We may update this DPA from time to time. Continued use of the FinalSaying service after changes indicates acceptance of the updated terms.

11. Governing Law

This DPA is governed by and shall be construed in accordance with the laws of Germany. Jurisdiction lies with the courts of Berlin.

12. Contact

For questions or concerns regarding this DPA, please contact:

Vilva Athiban Periyasamy Boominathan

📧 contact@finalsaying.com

📍 Berlin, Germany

By using FinalSaying, you automatically agree to the terms outlined in this DPA.