Data Processing Addendum (DPA) – Teamwins

Roles. Customer is the controller; Teamwins is the processor.

Scope. Processing is limited to providing and improving the Service, as documented by the Customer’s instructions through product configuration and the Terms.

Security. Teamwins maintains appropriate technical and organizational measures: encryption in transit and at rest, access controls, backups, logging, vulnerability management, and employee security training.

Confidentiality. Teamwins personnel are bound by confidentiality obligations and access personal data only as required to perform the Service.

Sub‑processors. Teamwins engages vetted sub‑processors (e.g., Vercel, Supabase, Stripe) under written agreements. Customer authorizes these sub‑processors; Teamwins remains responsible for their performance.

International transfers. Where data is transferred outside the EU/EEA, Teamwins implements appropriate safeguards and ensures an adequate level of protection. Transfers outside the EU/EEA will rely on Standard Contractual Clauses (SCCs) or equivalent safeguards.

Data subject rights. Teamwins assists the Customer in responding to requests for access, rectification, deletion, portability, and objection, to the extent possible.

Incident response. Teamwins will notify the Customer without undue delay after becoming aware of a personal data breach and will provide available information and cooperation.

Audits. Upon reasonable notice, Teamwins will make available information necessary to demonstrate compliance and allow audits by the Customer or an appointed auditor, subject to confidentiality. Audits will be limited to once per year, unless required by law or following a confirmed incident.

Return/Deletion. Upon termination of the Service, Teamwins will delete or return personal data within 60 days, unless retention is required by law.

Execution & requests. Execution of this DPA and any related requests will follow the procedures outlined in the Terms.