Data processing agreement (dpa) — Oh Dear

Cited by

Facts read from this source

• Entity Report an error

  “"Oh Dear" (us, we) - Immutable VOF, Hemelshoek 277, 2590 Berlaar, Belgium (VAT: BE 0699.594.682)”

• DPA effective date Report an error

  “Last updated: January 19th, 2026 Effective date: January 19th, 2026”

• Applicable law Report an error

  “"Applicable Data Protection Law" means the GDPR, the Belgian Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, and any other applicable Union or Member State data protection laws”

• Sensitive data Report an error

  “Oh Dear does not require or intentionally collect sensitive personal data (special categories under GDPR Article 9).”

• Confidentiality Report an error

  “Background checks are completed for team members with access to production systems”

• Encryption in transit Report an error

  “Encryption in transit: All connections use TLS 1.2 or higher”

• Access controls Report an error

  “Access controls: Multi-factor authentication, SSH key-based access, principle of least privilege”

• Hosting certification Report an error

  “Infrastructure security: Primary hosting with ISO 27001 certified provider (Combell, Belgium)”

• Authorization Report an error

  “The Customer provides general written authorization for Oh Dear to engage Sub-processors to assist in providing the Services, in accordance with GDPR Article 28(2).”

• Objection window Report an error

  “please contact us at privacy@ohdear.app within 30 days of the change”

• Objection remedy Report an error

  “If no alternative is reasonably available, you may terminate the affected Services without penalty and receive a pro-rata refund of any prepaid fees for the terminated Services”

• Data subject rights assistance Report an error

  “Oh Dear will assist the Customer in responding to requests from Data Subjects to exercise their rights under GDPR”

• Breach notification SLA Report an error

  “Notify the Customer without undue delay, and in any case within 48 hours of becoming aware of the breach”

• Records of processing Report an error

  “Oh Dear maintains records of processing activities carried out on behalf of Customers in accordance with Article 30(2) of the GDPR.”

• Primary region Report an error

  “Oh Dear's primary data storage is in Belgium (EU) with Combell.”

• Transfer mechanism Report an error

  “Standard Contractual Clauses: The European Commission's SCCs (Commission Implementing Decision (EU) 2021/914), incorporated by reference into this DPA”

• Scc governing law Report an error

  “The governing law is Belgian law Disputes shall be resolved by the courts of Antwerp, Belgium”

• Supervisory authority Report an error

  “The competent supervisory authority is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit)”

• Deletion on termination Report an error

  “Delete or anonymize Personal Data within 30 days of account termination, unless retention is required by law”

• Backup retention Report an error

  “Delete Personal Data from backups in accordance with our backup retention schedule (maximum 60 days for active backups)”

• Export Report an error

  “Allow the Customer to export their data via our API before account deletion”

• Changes notification Report an error

  “Material changes (changes affecting Customer's data protection rights or obligations): We will provide 30 days' notice via email.”

• Conflict precedence Report an error

  “In case of conflict between this DPA and our Terms & Conditions, this DPA prevails with respect to data protection matters.”

• Processing purposes Report an error

  “Monitor websites and servers for uptime, performance, and availability”

2 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Agency Developer European sovereignty
• The Customer Support Lead European sovereignty
• The E-Commerce Operations Manager European sovereignty
• The SaaS Platform Engineer European sovereignty
• The Information Security Officer European sovereignty
• The Skeptic European sovereignty