Data Processing Agreement

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person
• "Data Subject" means the individual to whom Personal Data relates
• "Controller" means the entity determining the purposes and means of processing
• "Processor" means the entity processing Personal Data on behalf of the Controller
• "Sub-processor" means any third party engaged by the Processor to process Personal Data

2. Scope and Roles

You (Controller) are responsible for:

• Determining the purposes and means of processing Personal Data
• Ensuring compliance with data protection laws
• Obtaining necessary consents from Data Subjects
• Responding to Data Subject requests

We (Processor) are responsible for:

• Processing Personal Data only according to your documented instructions
• Implementing appropriate technical and organizational security measures
• Assisting with Data Subject requests and compliance obligations
• Notifying you of any data breaches

3. Processing Instructions

We process Personal Data only:

• As necessary to provide the Services
• As documented in our Privacy Policy and these Terms
• As instructed by you through your use of the platform
• As required by applicable EU or Member State law

If we believe an instruction violates GDPR or other data protection laws, we will immediately inform you.

4. Nature and Purpose of Processing

5. Security Measures

We implement appropriate technical and organizational measures including:

Technical Measures

• AES-256 encryption at rest, TLS 1.3 in transit
• Multi-factor authentication (MFA)
• Role-based access control (RBAC)
• Automated security patching
• Intrusion detection and prevention systems
• Regular vulnerability scanning

Organizational Measures

• Data protection by design and default
• Staff training on data protection
• Confidentiality agreements with employees
• Incident response procedures
• Annual security audits
• ISO 27001-aligned infrastructure

6. Sub-processors

We may engage Sub-processors to assist in providing the Services. Current Sub-processors:

We will notify you of any changes to Sub-processors with 30 days' notice. You may object to new Sub-processors within 14 days.

7. Data Subject Rights

We will assist you in responding to Data Subject requests including:

• Providing access to Personal Data
• Correcting inaccurate data
• Deleting Personal Data (right to erasure)
• Restricting processing
• Providing data portability

Our platform provides self-service tools for many Data Subject requests. We will respond to your assistance requests within 72 hours.

8. Data Breach Notification

In the event of a Personal Data breach:

• We will notify you without undue delay (within 48 hours)
• Notification will include nature of breach, affected data, and remediation steps
• We will cooperate with your breach response and notification to authorities
• We will document all breach incidents and response measures

9. International Transfers

Personal Data is processed exclusively within the European Union. No transfers to third countries occur unless:

• You explicitly authorize such transfer
• Appropriate safeguards are in place (SCCs, adequacy decision)
• We obtain your prior written consent

10. Return and Deletion of Data

Upon termination of Services:

• You have 30 days to export all Personal Data
• After 30 days, we will securely delete all Personal Data
• Deletion includes all copies and backups (except as required by law)
• We will provide written confirmation of deletion upon request

11. Audit Rights

You have the right to audit our compliance with this DPA:

• We provide security documentation and certifications upon request
• On-site audits may be conducted with 30 days' notice (costs borne by you)
• We will cooperate with audits by supervisory authorities

12. Contact Information