Data Processing Agreement

• Controller — the customer entity using SwiftTune.
• Processor — SwiftTune.

The Processor processes personal data only to provide the Service described in the Terms of Service. Processing duration matches the Service subscription term plus any post-termination retention required by law.

Storage, indexing, retrieval and computational processing of the documents and personal data the Controller submits, strictly to deliver the Service.

• Authentication identifiers (email, name) of end users.
• Document content uploaded by the Controller.
• Operational metadata (timestamps, IPs) of users.

• Process only on documented Controller instructions.
• Ensure persons authorised to process data are under appropriate confidentiality obligations.
• Implement technical and organisational measures appropriate to the risk (Art. 32 GDPR).
• Engage sub-processors only with prior general authorisation — the current list is in the Sub-processors clause of the Privacy Policy — and notify the Controller of intended changes.
• Assist the Controller with data subject rights and impact assessments where reasonably required.
• Notify the Controller without undue delay of any personal data breach.
• Return or delete all personal data at the end of the Service relationship, at the Controller’s choice.
• Make available all information necessary to demonstrate compliance with Art. 28 GDPR.

All processing happens within the European Union. No transfer of personal data outside the EEA occurs without the Controller’s prior written consent and an appropriate transfer mechanism (Standard Contractual Clauses, adequacy decision, and similar).

On reasonable notice (at least 30 days) the Controller may request an audit of compliance with this DPA, at its own cost, no more than once per twelve-month period (except in case of a material breach).

Liability under this DPA is subject to the cap and exclusions set in the Terms of Service.

For DPA enquiries or to request a signed copy: info@swifttune.workers.dev.