Data Processing Agreement

Where we process personal data on your instructions to deliver a service, you act as the data controller and Cyberphoenix acts as the data processor. Where we determine our own purposes (for example, running our website), we act as controller under our Privacy Policy.

We process personal data only to provide the agreed services, for the duration of the engagement, and in line with your documented instructions and applicable law.

• Process personal data only on your documented instructions.
• Ensure people authorized to process data are bound by confidentiality.
• Apply appropriate technical and organizational security measures.
• Engage subprocessors only under written terms and tell you of changes.
• Assist you with data-subject requests and with security and breach obligations.
• Delete or return personal data at the end of the engagement, as you choose.

We use vetted subprocessors for hosting, analytics, scheduling, and communications. A current subprocessor list is available on request, and we give notice before adding a new one so you can object.

Where personal data is transferred across borders, we use appropriate safeguards such as standard contractual clauses. The data-center region for any third-party tooling is chosen deliberately with data-residency in mind.

To put a signed DPA in place, contact support@cyberphoenixscamdefense.com. We will share the full agreement and complete it as part of your engagement.