Data Processing Addendum (DPA)
1. Roles of the Parties
Customer as Controller – Customer acts as the controller of personal data stored in its tenant on the TF Platform (“The Future Platform”).
Simptel as Processor – Simptel acts as processor only with respect to personal data in Customer’s tenant and processes such data solely on Customer’s documented instructions.
Customer Responsibility – Customer is responsible for:
Selecting its hosting region (Azure, AWS, or Google Cloud);
Managing tenants, access rights, and identity configurations;
Configuring and managing third-party integrations.
While the TF Platform makes integrations easy, all third-party integrations (and their API keys or credentials) remain Customer’s sole responsibility.
2. Subject Matter and Scope
Simptel processes Customer Personal Data only for the provision of the TF Platform, an identity and security platform.
3. Processing Location
Tenant Data – Customer Personal Data is processed exclusively in the region selected by Customer (Azure, AWS, or Google Cloud). Simptel does not replicate or transfer tenant data outside the selected region.
DNS Services – The TF Platform uses Google DNS for the
tfplatform.comdomain, which may involve processing outside the selected region.TLS Certificates – TLS certificates are issued by Let’s Encrypt by default. Customers may alternatively provide their own certificates.
Customer Organizational Data – Data relating to Customer’s own organization (e.g., billing, invoicing, contracting, and account administration) is processed in the Netherlands by Simptel. For these purposes, Simptel also uses the following service providers:
Bird.com – communications;
Azure Marketplace – subscriptions and procurement;
Stripe – payments and billing;
Moneybird – bookkeeping and accounting.
This processing is separate from Customer’s tenant data.
4. Nature and Purpose of Processing
Simptel processes Customer Personal Data solely to:
Host, encrypt, and secure tenant data in the chosen region;
Provide the features and functionality of the TF Platform;
Manage billing, invoicing, and contracting for Customer’s organization.
5. Categories of Data and Data Subjects
Categories of Data: Identity data, authentication data, access logs, and any other information uploaded or configured by Customer.
Data Subjects: End-users of Customer’s tenant, such as employees, partners, or customers.
Customer determines what data is processed.
6. Security Measures
Simptel maintains technical and organizational measures appropriate to the risk, including:
Encryption – All tenant data is encrypted at rest and in transit using AES-based best practices;
TLS – Secured by Let’s Encrypt or Customer-provided certificates;
Access Controls – Strict authentication and authorization measures;
Logging & Monitoring – Security and compliance monitoring;
Tenant Isolation – Logical and physical separation of tenants;
Certifications – Simptel is ISO/IEC 27001:2022 certified and maintains SOC 2 Type II compliance, supported by yearly independent audits.
7. Sub-Processors
Authorized sub-processors are limited to:
For Tenant Data
Google – DNS services for
tfplatform.com;Let’s Encrypt – TLS certificate authority;
Cloud provider chosen by Customer – Azure, AWS, or Google Cloud, in the region selected by Customer.
For Customer Organizational Data
Bird.com – communications;
Azure Marketplace – subscription and procurement;
Stripe – payments and billing;
Moneybird – bookkeeping and accounting.
Simptel Entities
Simptel B.V. – Netherlands;
Simptel Services B.V. – Netherlands;
Simptel India Private Limited – India
Simptel will update this list at least 30 days before engaging a new sub-processor.
8. International Data Transfers
Tenant Data – Remains in the Customer-selected region, except for DNS services.
TLS Certificates – Let’s Encrypt may process limited technical data (domain validation) outside the selected region.
Customer Organizational Data – Processed in the Netherlands, with Stripe and Bird.com potentially involving transfers outside the EEA.
Where transfers outside the EEA/UK occur, Simptel ensures appropriate safeguards, including Standard Contractual Clauses.
9. Assistance to Customer
Simptel will assist Customer, where reasonably possible, with:
Responding to data subject rights requests;
Supporting Data Protection Impact Assessments (DPIAs);
Providing documentation to demonstrate GDPR compliance.
10. Return or Deletion of Data
Upon termination of services, Simptel will delete or return Customer Personal Data, unless retention is required by law.
11. Audit Rights
Simptel provides documentation and evidence of compliance, including ISO 27001 and SOC 2 reports. Customer may conduct audits with reasonable notice and subject to confidentiality.
12. Liability
Each party’s liability under this DPA is subject to the limitations of liability agreed in the Terms & Conditions.
13. Governing Law
This DPA is governed by the laws of the Netherlands.
Last updated