How to use this DPA

This Data Processing Addendum ("DPA") is Layerre's standard Art. 28 GDPR / DSGVO agreement (Auftragsverarbeitungsvertrag / AVV) for customers who use the Services to process personal data of their own end users, employees, or customers ("Customer Content").

This DPA is incorporated into the Terms and Conditions when you are the controller of Customer Content and Layerre is your processor. To request a countersigned copy, email hello@layerre.com with your company name and a contact email.

Layerre remains an independent controller for account, billing, support, and website analytics data, as described in the Privacy Policy.

1. Parties and roles

Processor: Layerre, a sole proprietorship based in Ontario, Canada ("Processor," "we"). Contact: hello@layerre.com.

Controller: the customer entity or person that creates a Layerre account and submits Customer Content ("Controller," "you").

This DPA applies to the extent the GDPR / DSGVO, UK GDPR, or similar law applies to processing of Customer Content.

2. Subject matter and duration

Subject matter: hosting, processing, and rendering design templates, variants, uploads, and related API data so we can provide the Services
Duration: for as long as you have an account, plus the short backup/log window in the Privacy Policy after deletion
Nature: storage, retrieval, rendering to image/PDF, transmission, and deletion
Purpose: solely to provide the Services on your documented instructions (your API calls, dashboard actions, and these Terms)

3. Types of data and data subjects

You decide what Customer Content you submit. It may include, for example:

Names, titles, email addresses, photos, or other fields placed on certificates, badges, or marketing creatives
Images, logos, and text you upload or import from Canva

Data subjects may include your employees, customers, event attendees, or other people whose information you include in designs. Layerre does not decide those categories; you must have a lawful basis to provide that data to us.

4. Processor obligations

We will:

Process Customer Content only on your documented instructions, including this DPA and the Terms, unless required by law (in which case we will inform you unless the law prohibits it)
Ensure persons authorized to process Customer Content are bound by confidentiality
Implement appropriate technical and organizational measures, including TLS in transit, encryption at rest with our hosting providers, access controls, and authentication
Assist you, taking into account the nature of processing, with data-subject requests, DPIAs, and consultations with supervisory authorities, at your reasonable request
Notify you without undue delay after becoming aware of a personal data breach affecting Customer Content, and provide information reasonably available to us so you can meet GDPR Art. 33/34 (including the 72-hour controller notification where applicable)
Delete Customer Content when you delete your account or when the Services end, except for copies we must keep under law or that remain in backups for a limited time
Make available information reasonably necessary to demonstrate compliance with Art. 28, and allow audits as described below

5. Your obligations

You are responsible for:

Ensuring you have a lawful basis to collect and send Customer Content to Layerre
The accuracy of instructions and of personal data you submit
Not submitting special-category data (Art. 9 GDPR) unless you have a valid basis and have agreed that with us in writing
Responding to data-subject requests that concern your end users

6. Subprocessors

You authorize us to use the subprocessors listed in the Privacy Policy, currently:

Supabase, Inc.: Database hosting, authentication, and file storage (United States)
Stripe, Inc.: Payment processing and billing (United States)
Google LLC: Analytics (Google Tag Manager / Google Analytics 4), fonts, and optional Google sign-in (United States)
Cloudflare, Inc.: Website hosting, CDN, and security (United States)
Crisp IM SAS: In-app customer support chat (logged-in users) (European Union (France))
Resend, Inc.: Transactional email delivery (United States)
Canva Pty Ltd: Design import when you provide a Canva URL or connect a Canva design (Australia / global)
TrustViews: Public testimonials / social-proof widget (analytics cookies) (United States)
Slack Technologies, LLC: Internal operational alerts (errors, account-deletion notices) (United States)
Microsoft Corporation: Optional Microsoft sign-in (United States)

We will impose data-protection terms on subprocessors that are no less protective than this DPA. We remain responsible for their processing. We will post material subprocessor changes on the Privacy Policy. If you object on reasonable GDPR grounds, your remedy is to stop using the affected feature or to delete your account.

7. International transfers

Customer Content may be processed in Canada, the United States, and other countries where subprocessors operate. Canada benefits from an EU adequacy decision for PIPEDA-covered commercial organizations. Transfers to countries without adequacy rely on Standard Contractual Clauses and our vendors' DPAs.

8. Audits

You may request, no more than once per 12 months except after a confirmed breach, written information or a call to review our processing of Customer Content. On-site audits are available only if required by a supervisory authority or if written materials are insufficient, on reasonable notice, during business hours, and at your expense, without disrupting operations or exposing other customers' data.

9. Liability and term

Liability under this DPA is subject to the limitations in the Terms, except where prohibited by the GDPR / DSGVO. This DPA lasts for the term of the Services and survives as needed to delete or return Customer Content.

10. Governing law

This DPA is governed by the same law as the Terms (Ontario, Canada), without limiting mandatory GDPR / DSGVO rights of data subjects or supervisory authorities.

Contact

Layerre (sole proprietorship), Ontario, Canada · hello@layerre.com