Data Processing Agreement
Effective date: February 3, 2026This Data Processing Agreement (“Agreement”) forms part of the Terms of Service (“Principal Agreement”) between:
You (the “Company” or “Controller”) and Slashy Inc. (the “Processor”), together the “Parties”.
WHEREAS: (A) the Company acts as a Data Controller. (B) The Company wishes to use Services provided by the Processor, which involve the processing of personal data. (C) The Parties seek to implement a data processing agreement that complies with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable U.S. state privacy laws. It is agreed as follows.
1. Definitions
1.1 “Company Personal Data” means any Personal Data processed by Processor on behalf of Company pursuant to the Principal Agreement.
1.2 “Data Protection Laws” means the GDPR and, to the extent applicable, U.S. state privacy laws including the California Consumer Privacy Act.
1.3 “Subprocessor” means any third party appointed by Processor to process Personal Data on behalf of the Company.
1.4 The terms “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, and “Processing” shall have the same meaning as in the GDPR.
2. Processing of Company Personal Data
2.1 Processor shall:
(a) comply with all applicable Data Protection Laws in the Processing of Company Personal Data; and
(b) not Process Company Personal Data other than on the Company's documented instructions, unless required by law.
2.2 The Company instructs Processor to process Company Personal Data to provide the email, calendar, and video meeting services described in the Principal Agreement.
2.3 Processor shall not sell or share Company Personal Data for advertising or marketing purposes.
3. Processor personnel
Processor shall ensure that persons authorized to process Company Personal Data are subject to confidentiality obligations and that access is limited to those who need it to perform the Services.
4. Security
4.1 Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
(a) encryption of Personal Data at rest and in transit;
(b) access controls and authentication measures; and
(c) regular testing and assessment of security measures.
4.2 Processor maintains SOC 2 Type II compliance.
5. Subprocessing
5.1 Company authorizes Processor to engage Subprocessors. A current list of Subprocessors is available on our Security page.
6. Data subject rights
6.1 Processor shall promptly notify Company if it receives a request from a Data Subject and shall not respond except as instructed by Company or required by law.
6.2 Processor shall assist Company in responding to Data Subject requests, taking into account the nature of the Processing.
7. Personal Data Breach
7.1 Processor shall notify Company without undue delay upon becoming aware of a Personal Data Breach affecting Company Personal Data.
7.2 Processor shall cooperate with Company and take reasonable steps to assist in the investigation and remediation of each such breach.
8. Data transfers
8.1 Company Personal Data may be transferred to and processed in the United States.
8.2 For transfers of Personal Data from the EEA, the Parties agree to rely on the EU Standard Contractual Clauses as the transfer mechanism.
9. Deletion of Company Personal Data
Upon termination of the Services, Processor shall delete all Company Personal Data within 24 hours, unless retention is required by law. Backup copies shall be deleted within 7 days (up to 14 days during active incident investigations).
10. General terms
10.1 This Agreement is governed by the laws of the State of Delaware, USA.
10.2 This Agreement shall remain in effect for as long as Processor processes Company Personal Data.
10.3 In the event of any conflict between this Agreement and the Principal Agreement with respect to data protection, this Agreement shall prevail.
Contact
For questions about this Agreement or to request security documentation, contact us at:
Email: privacy@slashy.com