Data Processing Agreement

A Data Processing Agreement is the written contract required by Article 28 of the GDPR whenever one organization processes personal data on behalf of another. Your organization is the data controller; Renviq is the data processor acting on your documented instructions.

The DPA fixes in writing what data we process, why, for how long, where, with which sub-processors, and what happens at termination.

Most Renviq customers do not need to sign a separate DPA. Our standard Terms of Service include the processor obligations of Article 28 by reference, which is sufficient for most rental operators and small organizations.

If your procurement, legal, or compliance team requires a standalone signed DPA — typical for regulated industries, public-sector contracts, or larger enterprises — we provide one without additional fees.

Our standard DPA mirrors the structure of the European Commission's standard contractual clauses for controller-to-processor relationships (Commission Implementing Decision 2021/915).

It covers: subject matter and duration of processing; nature, purpose, and categories of personal data and data subjects; controller and processor obligations; sub-processor authorization (the list matches the Subprocessors section of our Privacy Policy); the technical and organizational security measures we apply; the international-transfer mechanism (SCCs where applicable); audit rights and how they are exercised; data return and deletion at termination; and liability allocation.

Email support@renviq.io with: (1) your organization's registered legal entity name and address; (2) the name and contact email of the person authorized to sign on your behalf; (3) the date by which you need the executed copy.

We send our standard DPA within 2 business days. Counter-signature happens by e-signature — there is no need to print, scan, or post anything.

The sub-processors we engage are listed in the Subprocessors section of our Privacy Policy at /legal/privacy. Material changes to that list are notified to executed DPA counterparties at least 30 days in advance via the email address on file.

Questions about our DPA, our processor obligations, or a specific clause: support@renviq.io.