Data Processing Agreement
Last updated: June 15, 2026
This Data Processing Agreement (DPA) summary describes how SUPUP processes personal data on behalf of Customers when providing the software platform. It supplements the SaaS Terms of Service. A signable DPA is available to enterprise Customers on request.
1. Roles of the Parties
For personal data contained in Customer Data, the Customer acts as the data controller and SUPUP acts as the data processor, processing such data solely on the Customer's documented instructions in order to provide the Service.
2. Purpose and Scope of Processing
SUPUP processes operational data solely for the purpose of making the software work for the Customer — for example, to synchronize data, run automations, generate analytics, and operate the dashboard and API. We do not use Customer Data for advertising and we do not sell Customer Data to third parties.
3. Security Measures
SUPUP maintains enterprise-grade technical and organizational security measures appropriate to the risk, including encryption in transit and at rest, access controls, network protections, logging, and monitoring. See our Security & Compliance page for details.
4. Sub-processors
SUPUP uses a limited set of vetted sub-processors (such as cloud-infrastructure and operational tooling providers) under contractual obligations consistent with this DPA. A current list is available on request, and we provide notice of material changes.
5. International Transfers
Where personal data is transferred across borders, SUPUP relies on appropriate safeguards, such as Standard Contractual Clauses, to ensure an adequate level of protection.
6. Data Subject Rights and Breach Notification
SUPUP assists Customers, taking into account the nature of processing, in responding to requests from data subjects exercising their rights. We will notify affected Customers without undue delay after becoming aware of a personal-data breach affecting their data.
7. Return and Deletion
Upon termination, SUPUP will, at the Customer's choice, make Customer Data available for export for a limited period and then delete it in accordance with our standard retention practices, unless retention is required by law.
This document is provided for general informational purposes and does not constitute legal advice. For questions, contact support@supup.io.