Cryovo Data Processing Agreement
Between Cryovo ("Processor") and the customer ("Controller"). Template for counsel review.
This DPA applies to any Personal Data Cryovo processes on the Controller's behalf in connection with the Cryovo cold-chain/F-gas compliance platform.
1. Roles & allocation of responsibility
The Controller is responsible for the lawfulness of its processing, the accuracy of the data it provides, and satisfying its own regulatory obligations (FSMA 204, 21 CFR Part 11, F-gas). Cryovo is the Processor and processes data only on the Controller's documented instructions. Cryovo does not determine whether the Controller is compliant; providing the service is not a representation of compliance.
2. Permitted processing
Only to: provide and secure the service, generate compliance records/reports, comply with law, and improve the product with aggregate non-identifying data. Cryovo shall not use Compliance Data for unrelated purposes.
3. Sub-processors
Cryovo uses sub-processors (e.g. Supabase for hosting, Stripe for payments, Vercel for hosting) and maintains a list, informing the Controller of material changes.
4. Security
Appropriate technical and organisational measures (encryption in transit, access controls, least-privilege). Cryovo does not claim a specific certification (e.g. SOC 2, ISO 27001) unless separately obtained.
5. Data subject rights
Cryovo will assist the Controller in responding to data subject requests (access, correction, deletion, portability) and complying with applicable data protection law.
6. Retention & deletion
On termination, Cryovo will delete or return the data as directed, except where retention is required by law. Data is processed only as long as needed for the service or as required by law.
7. International transfers
Where data is transferred outside the EEA/UK, Cryovo will use appropriate safeguards (e.g. Standard Contractual Clauses) to the extent required by law.
8. Liability
Nothing in this DPA alters the liability allocation in the Cryovo Terms of Service.