Skip to main content

Data Processing Agreement (DPA)

Last updated: 2026-10-15

Last Updated: October 15, 2026

Effective Date: October 15, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you (the "Customer") and GigTry (the "Processor", "we", "us"). It applies where we process personal data on your behalf when you use the Services — for example, when you upload contacts, content, or end-user data into GigTry tools. The GDPR-standard contractual clauses incorporated by reference below are available on request at dpo@gigtry.com.

1. Definitions

  • "Personal Data", "Processing", "Controller", "Processor", "Data Subject" and "Supervisory Authority" have the meanings given in the GDPR (Regulation (EU) 2016/679) and, where applicable, the UK GDPR and the Swiss FADP.
  • "Customer Data" means any personal data you submit to the Services to be processed on your instructions.

2. Roles of the Parties

For Customer Data, you are the Controller and GigTry is the Processor. We process Customer Data only on your documented instructions (these Terms, this DPA, and your tool configuration), except where EU or member-state law requires otherwise — in which case we will inform you before processing unless legally prohibited.

3. Our Commitments as Processor

  1. Confidentiality. Personnel authorized to process Customer Data are bound by confidentiality obligations.
  2. Security. We maintain technical and organizational measures appropriate to the risk, including TLS 1.2+ in transit, encryption at rest at the hosting provider, access controls, and least-privilege administration (see the Security section of the Privacy Policy).
  3. Sub-processors. We engage the sub-processors listed in the Privacy Policy (hosting, payment, analytics, email, AI inference). We impose the same data-protection obligations on them by contract. We will notify you of additions or replacements affecting Customer Data and give you a reasonable opportunity to object.
  4. Data subject rights. We assist you, taking into account the nature of the processing, in responding to requests to access, rectify, erase, restrict, port, or object to the processing of personal data.
  5. Breach notification. We notify you without undue delay (and within 72 hours where feasible) after becoming aware of a personal data breach affecting Customer Data.
  6. Deletion / return. On termination, we delete or return Customer Data on request, except where retention is required by law (see the retention schedule in the Privacy Policy).
  7. Records and audits. We keep records of processing required by GDPR Art. 30(2) and make available information reasonably necessary to demonstrate compliance. Audits by questionnaire; on-site audits only where legally required and on 30 days' notice, no more than once per year.
  8. Transfers. International transfers rely on the mechanisms described in the Privacy Policy (EU SCCs, UK Addendum, Swiss adaptations, EU-US / Swiss-US Data Privacy Framework where certified).

4. Your Responsibilities

As Controller, you warrant that you have a lawful basis for submitting Customer Data to the Services, that you have provided required notices to data subjects, and that your use of the Services complies with applicable law (including the AI-processing and consent rules referenced in our Privacy Policy).

5. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service, except where limitation is not permitted by data protection law.

6. Contact

Data protection contact: dpo@gigtry.com. Regional privacy addenda (EU/EEA, UK, Switzerland, US state laws, China PIPL, Japan APPI, South Korea PIPA, Singapore PDPA, UAE, Saudi Arabia, Qatar, and others) are contained in the Privacy Policy.