Data Processing Addendum
This Data Processing Addendum (DPA) forms part of the Terms of Service and governs the processing of personal data that Entregarte (Vidasoft) carries out on behalf of the user when the user acts as controller. In case of conflict on data protection matters, this DPA prevails.
1. Roles of the parties
When your end clients upload files through your campaigns, you are the controller of that data and Entregarte is the processor handling it on your documented instructions (including those given through the service configuration).
2. Subject matter, duration, nature, and purpose
We process the data for the sole purpose of providing the file-validation service, for the duration of the contract. The nature of the processing includes storage, technical and AI analysis, and making results available.
3. Categories of data and data subjects
- Data: the uploaded files and their metadata (file name, date and time, uploader IP address) and any data those files may contain.
- Data subjects: the printer's end clients and any person whose data appears in the files.
4. Processor obligations
Entregarte undertakes to:
- Process the data only on your documented instructions.
- Ensure that persons authorised to process it are bound by confidentiality.
- Apply the security measures of GDPR art. 32 (see Annex II).
- Assist you, as far as possible, in responding to data subject requests.
- Help you meet your obligations on security, breach notification, and impact assessments.
- Notify you without undue delay of any security breach it becomes aware of.
- At your choice, delete or return the data at the end of the service, unless a legal obligation requires retention.
- Make available the information needed to demonstrate compliance and allow reasonable audits.
5. Subprocessors
You authorise us to use the subprocessors listed in the Privacy Policy (EU hosting, Stripe, Sentry, Cloudflare, and AI providers), with whom we sign contracts with equivalent safeguards. We will give reasonable notice of adding or replacing subprocessors, and you may object on justified grounds.
6. International transfers
Where a subprocessor processes data outside the European Economic Area, appropriate safeguards will apply (European Commission Standard Contractual Clauses or an adequacy decision).
7. Liability and governing law
Each party's liability is governed by the Terms of Service. This DPA is governed by Spanish law and the GDPR.
Annex I - Processing details
Subject matter: validation of print artwork. Duration: the term of the contract. Nature and purpose: storage and technical/AI analysis to validate files. Types of data: files and metadata. Data subjects: end clients and persons whose data appears in the files.
Annex II - Security measures
Encryption in transit (HTTPS), role-based access control, hashed passwords, regular backups, antivirus scanning of uploaded files, activity logging, and logical separation of data per organization.