Data Processing Addendum

This DPA applies when BANANA-GOAT processes personal data on behalf of Customer in connection with the BANANA-GOAT platform — for example viewer analytics events, end-user technical data related to share/embed delivery, or other personal data Customer submits through the service.

For that processing, Customer is the controller (or a processor instructing BANANA-GOAT) and BANANA-GOAT is the processor (or sub-processor). BANANA-GOAT remains an independent controller for account administration, billing, platform security, and product operations as described in the Privacy Policy.

BANANA-GOAT processes personal data only on documented instructions from Customer, including through configuration of the service, unless EU or Member State law requires otherwise. Customer is responsible for the lawfulness of its instructions and for providing required notices to data subjects.

BANANA-GOAT ensures that persons authorized to process personal data are bound by confidentiality obligations and implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or alteration, taking into account the nature of the secure 3D delivery service.

Customer authorizes BANANA-GOAT to engage sub-processors needed to operate the service, including hosting and infrastructure providers such as Microsoft Azure, payment providers such as Stripe for subscription processing, and other providers listed or described in the Privacy Policy.

BANANA-GOAT remains responsible for sub-processor performance and will impose data-protection obligations no less protective than those in this DPA.

Where personal data is transferred outside the EEA, United Kingdom, or Switzerland, BANANA-GOAT uses appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, or other lawful mechanisms as required.

Taking into account the nature of processing, BANANA-GOAT assists Customer with data-subject requests, security incident notifications, data-protection impact assessments, and consultations with supervisory authorities where reasonably required and permitted by law.

BANANA-GOAT will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data processed under this DPA, and will provide information reasonably available to help Customer meet its own notification obligations.

Upon termination of the service or on written request, BANANA-GOAT will delete or return Customer personal data processed under this DPA, except where retention is required by law or necessary for secure backup rotation for a limited period.

BANANA-GOAT will make available information reasonably necessary to demonstrate compliance with this DPA. On reasonable written notice, and no more than once per year unless required by a supervisory authority or following a confirmed breach, Customer may audit BANANA-GOAT’s relevant processing activities, subject to confidentiality and security constraints.

Liability under this DPA follows the limitations in the Terms of Service unless mandatory law provides otherwise. If there is a conflict between this DPA and other documents regarding personal-data processing, this DPA controls for that subject.

Contact info@banana-goat.com for a signed enterprise DPA package. This page is a public reference draft aligned with our Privacy Policy and Terms.