Data processing agreement
Version 2026-09-28
Parties and scope
This agreement (Article 28 GDPR) applies when Gaffiero Digital (processor) processes personal data of your clients and staff on your behalf (controller) to provide Sloted.
Instructions
We process personal data only on your documented instructions — your use of Sloted's features — and not for our own purposes.
Confidentiality and security
Our staff are bound by confidentiality. We apply appropriate technical and organisational measures: encryption in transit and at rest, per-business data isolation enforced by the database (row-level security), least-privilege access, audit logs, 2FA, and field-level encryption for sensitive form data.
Sub-processors
You authorise the sub-processors listed in our privacy policy. We will give 30 days' notice of changes; you may object.
Assistance
We help you respond to data-subject requests (export and erasure tools are built in), with security, breach notification (without undue delay and within 48 hours of becoming aware) and DPIAs.
Location
Personal data is hosted in the EU. Any transfer outside the EEA uses Standard Contractual Clauses.
End of processing
On termination we delete personal data within 30 days, after you have had the chance to export it, unless the law requires us to keep it.