Data processing agreement

1. Parties, scope and instructions

This Data Processing Agreement forms part of the Certinator terms between the customer accepting those terms ("Customer") and Emerjoe Rosas, trading as Certinator, Central Luzon, Philippines, contact support@certinator.com ("Processor"). It applies when the Customer submits personal data for hosted certificate processing. It applies for the service period and until covered data has been returned or deleted. The Customer’s account and any service order identify the customer and authorized account contact.

The Customer acts as controller, or as processor authorized by its controller. Certinator acts as processor or subprocessor for customer-directed certificate processing. Certinator’s independent controller activities, such as account administration and abuse prevention, are described separately in the privacy policy. The agreement follows the subject matter of GDPR Article 28; it is not a claim of certification and does not replace a required international-transfer agreement.

Documented instructions are the agreed terms, this DPA, any written service order and authenticated actions within the service. Certinator processes covered data only on those instructions, unless applicable law requires otherwise; where legally permitted, we inform the Customer before that legally required processing. We will inform the Customer if an instruction appears unlawful and may suspend it pending clarification.

2. Schedule A — processing details

Subject matter: generating and managing customer certificates. Duration: the service period plus the return/deletion period in section 7. Nature: receiving, storing, organizing, rendering, retrieving, transmitting and deleting data; public disclosure only on explicit issuance instructions. Purpose: delivering the Customer’s certificate workflow.

• Data subjects: customer staff, students, trainees, event participants and certificate recipients.
• Data categories: names and optional email/reference identifiers, achievements, issuer details, completion/issue/expiration dates and customer-supplied artwork.
• Excluded data: special-category data, criminal-offence data and unnecessary sensitive identifiers. The Customer must not submit them.
• Instruction and notification channel: the Customer’s authenticated account and its registered email; the Customer must keep its authorized contact current.
• Processor: Emerjoe Rosas, trading as Certinator, Central Luzon, Philippines. Privacy and processing contact: support@certinator.com.

3. Processor obligations

Certinator will ensure that persons authorized to process covered data are bound by confidentiality and have access only as required for their duties. We will apply measures appropriate to the risks, including the controls described in section 4, and will not intentionally reduce their overall level of protection during the service period.

Taking account of the nature of processing and information available, we will assist the Customer with data-subject requests and with applicable security, breach notification, impact assessment and regulatory consultation duties. We will forward requests relating to customer-controlled data without undue delay and will not respond on the Customer’s behalf except as instructed or legally required. Assistance beyond normal service support may be subject to reasonable agreed charges, without frustrating a legal obligation.

4. Schedule B — measures and incidents

The current application controls include authenticated account access, account-scoped database operations, scoped API keys, hashed key verification, encrypted recoverable key material, request validation, rate/concurrency limits and time-limited authenticated job downloads. The security page describes scope and limitations; no independent certification or penetration-test status is represented.

Access to production systems is restricted to authorized operators. We review access when roles change or credentials are suspected compromised, protect administrative access and maintain service changes through version control. Our infrastructure providers manage their own backup and recovery facilities; no dedicated customer recovery-time objective is included. On becoming aware of a personal-data breach affecting covered data, we will notify the Customer without undue delay, describe the nature, affected categories and likely consequences to the extent known, provide a contact and remediation information, and update that information as the investigation develops. The Customer determines its own regulatory and data-subject notifications.

5. Schedule C — subprocessors

The Customer generally authorizes Vercel for application hosting, server execution and background workflows, Neon for the application database and authentication, and Brevo for optional certificate email delivery that the Customer requests. Configured application compute and database region: Singapore. Provider infrastructure, global delivery and authorized operations can involve additional countries. The providers’ applicable contractual data-protection terms and subprocessor disclosures govern their downstream services.

We will impose written data-protection obligations on engaged subprocessors that provide protection required by applicable law and remain responsible for the performance of their obligations to the extent required by that law. We will notify the Customer at its registered account email at least 30 days before adding or replacing a subprocessor for covered data. The Customer may object within that period on reasonable data-protection grounds. If the parties cannot resolve the objection, the Customer may terminate affected processing before the change, with a pro-rata refund of prepaid unused affected service fees, if any.

6. International transfers

The service is hosted outside the EEA and does not offer EU-only residency. Where GDPR Chapter V or equivalent international-transfer rules require safeguards, the Customer must contact support before submitting covered data so the appropriate transfer agreement can be executed. We will not represent these transfers as protected by executed SCCs unless that agreement has actually been completed.

For a transfer requiring EU standard contractual clauses, the parties will use the appropriate module of Commission Decision 2021/914, complete the parties and processing annexes and address any required assessment and supplementary measures. The same applies to a required UK addendum or other local transfer instrument. A reference to the Commission’s Article 28 clauses (2021/915) is not a substitute for these transfer safeguards. Until necessary safeguards are in place, the Customer must use browser-only generation without saving personal data to the hosted service.

7. Assistance, audits and end of service

Certinator will provide information reasonably necessary to demonstrate compliance and permit proportionate audits by the Customer or an independent auditor bound by confidentiality. Audits must protect service security and other customers’ information. We will coordinate scope, timing and evidence without preventing an audit required by law or a competent authority.

At the end of processing, the Customer may request return of its covered data in a commonly used electronic format and deletion, or deletion without return. We will complete deletion from active systems within 30 days of a verified request unless law requires retention, in which case we will identify the requirement where legally permitted and restrict further use. Residual provider backups and execution logs remain protected, are not used for new processing and are removed under the applicable provider lifecycle; any limitation affecting the request will be explained to the Customer.

For public verification, revocation alone does not erase a record. We will handle a lawful deletion instruction separately, including removal of covered personal details where required. Copies already downloaded or held by third parties cannot be recalled. If we cannot comply with this DPA, we will inform the Customer and suspend affected processing; the Customer may terminate the affected service.

8. Priority and contact

This DPA prevails over conflicting general terms for covered personal-data processing. Mandatory transfer clauses prevail where applicable. Changes to this DPA follow the material-change notice in our terms and cannot retrospectively authorize a new use of personal data. Contact support@certinator.com for requests, transfer arrangements, evidence or an organization-specific signed copy. The agreement does not authorize us to use recipient data for advertising, sell it or train an AI model.