- DIGI5Y-branded DPA

- Subprocessor list

- TCD documentation

- Retention schedule

- Breach notification procedure

- DSAR handling process

Yes. DIGI5Y operates as a Data Processor under GDPR and has measures in place covering data agreements, security, subprocessor transparency, breach notification, and data subject rights — all aligned with EU GDPR requirements.

Yes. A DIGI5Y-branded DPA is required before go-live for all EU clients under GDPR Art. 28. It covers the subject matter, nature and purpose of processing, data types, and obligations of both parties.

Our subprocessors include: Core CRM Platform (USA), Stripe (payments, USA), Supabase (data/ops, USA/EU), ElevenLabs (AI voice, USA), N8N (automation), Twilio (SMS/phone, USA), and Mailgun/SendGrid (email delivery, USA). Clients are notified 30 days before any new subprocessor is added.

Data is hosted on AWS infrastructure, primarily in US-East and US-West regions. There is currently no EU-region data residency option. This is disclosed transparently in the DPA

We use Standard Contractual Clauses (SCCs) as approved by the European Commission (Decision 2021/914) — either Module 2 (Controller → Processor) or Module 3 (Processor → Sub-Processor), incorporated into your DPA.

We maintain: AES-256 encryption at rest, TLS 1.2+ in transit, role-based access control, MFA for admin accounts, logical client account isolation, automated backups, and SOC 2 Type II certification at the core platform level.

Data is retained while the service is active. Post-termination, client data is deleted or returned within 30–90 days. Backups are purged within the same window. System logs are retained up to 12 months for audit purposes, then deleted.

Your client (Controller) receives DSARs from end-users. DIGI5Y (Processor) assists within 5 business days with data extracts or deletions, at no additional charge. The platform supports native contact export and deletion.

DIGI5Y notifies the client within 24–48 hours of confirming a breach, covering: nature of breach, data types affected, number of individuals, likely consequences, and actions taken. All incidents are logged even if not reportable

Upon contract termination, your data will be deleted or returned within 30–90 days, as committed in the DPA. Backup copies are purged within the same window. You can request a data export before termination.

DIGI5Y is a small-scale processor and may not be required to appoint a formal DPO under GDPR Art. 37. However, a designated point of contact for data protection queries is available at [email protected].

Yes. MFA is enforced for all admin-level accounts on the DIGI5Y platform to prevent unauthorised access.

Yes. Each client account and location is logically separated. No data bleeds between client environments.

All API connections use token-based authentication (OAuth 2.0) and are transmitted over HTTPS. API keys and tokens are stored securely and never exposed in plain text.