Last updated: Jun 1, 2026
This Data Processing Agreement ("DPA") forms part of the agreement between you ("Customer", "Controller", or "you") and Saaslinks ("we", "us", "Processor") governing your use of the Saaslinks marketplace and related services (the "Services"). It applies where, in the course of using the Services, we process personal data on your behalf. By creating an account, funding a wallet, or otherwise using the Services, you agree to the terms of this DPA. If you require a countersigned copy for your own records, contact us through the Contact and Support page and we will provide one.
This DPA supplements and is incorporated into our Terms of Service and should be read alongside our Privacy Policy. Where this DPA conflicts with the Terms of Service on matters of personal data processing, this DPA controls.
Terms used but not defined here have the meaning given in applicable data protection law.
For Personal Data you submit to the Services (for example, the contact and billing details of your colleagues, or end-customer data you choose to include in order notes), you act as the Controller and we act as the Processor. For data we collect for our own purposes (such as account security, billing, fraud prevention, and product analytics), we act as an independent Controller, and that processing is governed by our Privacy Policy rather than this DPA.
We will:
You provide general authorization for us to engage the Subprocessors listed in the table below to process Personal Data in connection with the Services. We impose data protection obligations on each Subprocessor that are no less protective than those in this DPA, and we remain responsible for the performance of each Subprocessor's obligations.
We will inform you of any intended addition or replacement of a Subprocessor, giving you a reasonable opportunity to object on legitimate data-protection grounds. If you object and we cannot reasonably accommodate the objection, you may terminate the Services in accordance with the Terms of Service. To receive notice of changes to our Subprocessor list, contact us through the Contact and Support page.
The current list of Subprocessors and the role each performs is set out in the section below.
We maintain appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These include, as appropriate to the risk:
These measures may be updated over time provided that the level of protection is not materially decreased.
We will notify you without undue delay after becoming aware of a Personal Data breach affecting Personal Data we process on your behalf. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. We will cooperate with you and take reasonable steps to assist in your investigation and any notifications you are required to make.
Payment card processing is handled by our payment Subprocessor (Stripe). We do not store complete payment card numbers on our systems. The processing of cardholder data by the payment Subprocessor is governed by that provider's own terms and PCI DSS obligations. For how wallet balances, charges, and refunds are handled, see our Refund and Wallet Policy.
We will, on reasonable prior written request and no more than once per twelve-month period (unless required more frequently by a Supervisory Authority or following a Personal Data breach), make available information reasonably necessary to demonstrate compliance with this DPA. Where an on-site audit is required by Applicable Data Protection Law, the parties will agree in advance on its scope, timing, and reasonable cost allocation, conducted so as to minimize disruption to our business and to protect the confidentiality and security of other customers' data.
Where processing of Personal Data involves a transfer outside the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, the transfer is governed by the Standard Contractual Clauses adopted by the European Commission, incorporated into this DPA by reference, together with the UK International Data Transfer Addendum where the UK GDPR applies. We and our Subprocessors apply supplementary measures where appropriate to ensure an essentially equivalent level of protection. The SCCs prevail over any conflicting term in this DPA in respect of such transfers.
Where we process personal information of California residents on your behalf, we act as a "service provider" as defined under the CCPA/CPRA. We will not sell or share such personal information, will not retain, use, or disclose it for any purpose other than performing the Services or as otherwise permitted by the CCPA/CPRA, and will not combine it with personal information from other sources except as permitted. We certify that we understand and will comply with these restrictions. California residents can review their available options on our Your Privacy Choices page.
Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service. This DPA takes effect when you begin using the Services and continues for as long as we process Personal Data on your behalf. Sections relating to confidentiality, deletion, audits, and liability survive termination as necessary to give them effect.
Questions about this DPA, requests for a countersigned copy, or data protection inquiries can be directed to us through the Contact and Support page. We respond to data protection requests within a reasonable time and in accordance with Applicable Data Protection Law.
Need a countersigned DPA before you fund a wallet?
Reach out and we will send a signed copy for your records. Standard for agencies and funded SaaS teams.
Contact us