Data Processing Agreement

Overview

This data processing agreement (DPA) reflects the obligations of Rovela as a processor of personal data on behalf of its customers, in support of the General Data Protection Regulation and equivalent laws. It is available, signed, to customers who need it for their own compliance — write to the contact below.

Roles

For the data an organization holds about its own contacts and their mail, the customer is the controller and Rovela acts as the processor , processing that data only to provide the service the customer asked for. The operator decides nothing about why that data is held or how it is used beyond carrying out the customer's instructions.

Security measures

Rovela maintains technical and organizational measures appropriate to the data processed. These include:

• Encryption of data in transit (TLS) and at rest on encrypted volumes.
• Role-based access control, individual administrative credentials, and audit logging of administrative actions.
• Prompt patching and a documented process for responding to security incidents.

Retention and deletion

Data is retained for the periods stated in the Privacy Policy and deleted on account deletion. A customer may request export or deletion of their organization's data at any time, as described there.

Sub-processors

The third parties Rovela relies on are listed on the Sub-processors page. New sub-processors are announced in advance where practical, and a customer may object to a change as permitted by law.

Contact

For a signed copy of this DPA, or any question about it, write to support@rovela.dev.