Data Processing Addendum

Last updated: 5 October 2026

If an app you host on RightSide processes personal data, for example your users' accounts, you are the controller of that data and Poligon Tech acts as your processor. A Data Processing Addendum (DPA) under Article 28 GDPR is available on request.

How to get the DPA

Email [email protected] with your organisation's legal name and address and the account email. We will send the DPA for signature. Once signed, it forms part of your agreement with us under the Terms of Service.

What the DPA commits us to

This summary is for convenience. The signed DPA governs. As your processor, Poligon Tech will:

Follow your instructions. Process personal data only on your documented instructions, which are the Terms of Service, the DPA and how you configure and use the service, unless the law requires otherwise. We will tell you if we believe an instruction breaks data protection law.
Keep it confidential. Make sure that everyone authorised to process the data is bound by confidentiality.
Secure it. Apply appropriate technical and organisational measures under Article 32 GDPR. The current measures are described on our security page and in the Privacy Notice.
Control sub-processors. Use sub-processors only under a written contract that imposes equivalent obligations, keep the list current (see the recipients in our Privacy Notice), and tell you in advance of changes so that you can object.
Help with data subject requests. Help you answer requests from the people whose data your app processes, such as access or deletion requests.
Help with compliance. Help you with security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to us.
Report breaches. Notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
Delete or return data at the end. When the service ends, delete or return the personal data at your choice, and delete remaining copies unless the law requires us to keep them. During the private beta there are no backups, so no backup copies remain.
Show compliance and allow audits. Make available the information needed to demonstrate compliance with Article 28, and allow for and contribute to audits and inspections by you or an auditor you appoint, on reasonable notice.
Transfer data lawfully. Transfer personal data outside the European Economic Area only with a valid safeguard, such as an adequacy decision or Standard Contractual Clauses.

What the processing covers

Subject matter: hosting, building, running and routing your apps, and the RightSide hosted sign-in if your app uses it.
Duration: for as long as you use RightSide, plus the deletion periods in the Privacy Notice.
Data subjects: the users and visitors of your apps.
Types of data: whatever your app processes. If you use hosted sign-in: email addresses, password hashes, session records and sign-in rate-limit records.

You remain responsible for having a lawful basis for your app's processing, for your own privacy notice, and for not processing special categories of data unless you have assessed that RightSide's measures are adequate for them.