Data Processing Agreement.

Who this DPA is between#

SaleSqueze d.o.o. (“Processor”) and the customer (“Controller”) executing the SaleSqueze platform terms. The DPA is incorporated into the platform terms by reference; signing the platform terms commits both parties to this DPA.

What’s being processed#

Two data categories:

Category A: customer data#

Information you provide to operate the platform. brand assets, product catalog, pricing rules, dealer information, internal user accounts.

Category B: end-buyer data#

Information your end buyers (configurator users) submit through configurators we host for you. Configuration choices, contact details, quote requests, payment information.

For both, you are the controller and SaleSqueze is the processor under GDPR Article 28.

Processing purposes#

We process Category A and Category B data only:

• To deliver the contracted service.
• To provide support when you request it.
• For aggregated, anonymised analytics to improve the platform.
• To comply with legal obligations.

We don’t process for any purpose outside these. We don’t share with third parties beyond the sub-processors disclosed on the security page.

Sub-processors#

Listed on the security page. The current list at any given time is the canonical one; this DPA is updated with material changes to the list. You receive 30 days’ notice of new sub-processors and may object on reasonable grounds.

Security measures#

• Encryption in transit (TLS 1.2 minimum, TLS 1.3 preferred).
• Encryption at rest (AES-256).
• Access control via SSO with audit logging.
• Production access for SaleSqueze personnel is time-boxed, audited, and only granted with your explicit permission for support cases.
• Annual penetration testing.
• SOC 2 type II in progress.

Full security posture is on the security page.

Data subject rights#

You’re responsible for responding to data subject requests (access, rectification, erasure, portability) made by your end buyers. We help by:

• Providing the tools to export end-buyer data on demand.
• Deleting end-buyer data on request, subject to legal retention obligations.
• Responding to your requests for assistance within 5 working days.

Data breach notification#

We notify you of any personal data breach affecting your data without undue delay, and in any case within 24 hours of becoming aware. The notification includes:

• Nature of the breach (categories and number of data subjects, categories and number of records).
• Likely consequences.
• Measures taken or proposed to address it.
• Contact point for further information.

Sub-processor transfers#

EU customer data is processed in EU regions (primary eu-central-1, failover eu-west-1). For sub-processors in other regions, transfers are protected by Standard Contractual Clauses or equivalent safeguards.

Audit rights#

You may audit our compliance with this DPA once per year, on reasonable notice (typically 30 days). For customers under NDA we make the SOC 2 type II report available in lieu of bespoke audit when it issues.

Term#

The DPA applies for the duration of the platform terms. On termination:

• Category A and Category B data are returned to you in a structured format on request.
• Or deleted, on your request, subject to legal retention obligations.

We retain a minimal record of the relationship (billing, contract record) for the legal retention period.

Liability and governing law#

Inherited from the platform terms.

How to get the signed DPA#

For customers under NDA who need a counter-signed copy with their organisation’s name, email legal@salesqueze.com or use the contact page with topic “Legal”. Standard turnaround: 3 working days.

For related legal docs: privacy policy, GDPR overview, security posture, SLA.