Data Processing Agreement (DPA)

Definitions

• Personal Data: any information relating to an identified or identifiable individual processed through the Service.
• Processing: any operation performed on Personal Data (collection, storage, use, deletion, etc.).
• Sub-processor: a third party engaged by us to process Personal Data on the Controller's behalf.
• Data Subject: the individual to whom the Personal Data relates.

Roles

• The Controller determines the purposes and means of processing Personal Data.
• The Processor processes Personal Data only on the Controller's documented instructions.

Scope of Processing

• Subject matter: provision of the Service.
• Duration: the term of the underlying agreement.
• Nature and purpose: hosting, storage, analysis, and support related to the Service.
• Types of data: as determined by the Controller (typically names, emails, account details, and any other data the Controller uploads).
• Categories of data subjects: the Controller's users, customers, employees, or other individuals whose data is processed through the Service.

Processor Obligations

We will:

• Process Personal Data only on the Controller's documented instructions.
• Ensure personnel handling Personal Data are bound by confidentiality.
• Implement reasonable technical and organizational security measures.
• Assist the Controller with responses to data subject requests, where reasonably possible.
• Notify the Controller without undue delay of any data breach affecting Personal Data.

Sub-processors

The Controller authorizes us to use Sub-processors to provide the Service. We will:

• Maintain a current list of Sub-processors available on request.
• Ensure Sub-processors are bound by written terms providing protections equivalent to this DPA.
• Notify the Controller of any new Sub-processor, giving an opportunity to object.

Security Measures

We will maintain reasonable security measures, including:

• Encryption of data in transit and at rest.
• Access controls and authentication.
• Regular backups.
• Monitoring and logging.
• Employee training on data security.

Data Subject Requests

If we receive a request from a Data Subject (access, deletion, correction, etc.), we will promptly notify the Controller and not respond directly unless instructed to do so. We will provide reasonable assistance to help the Controller fulfill its obligations.

Data Breach Notification

We will notify the Controller without undue delay (and in any case within 72 hours where feasible) after becoming aware of a personal data breach. The notification will include known details about the breach and the steps we are taking.

International Transfers

If Personal Data is transferred outside the country of origin, we will ensure appropriate safeguards are in place, such as standard contractual clauses where applicable.

Return or Deletion of Data

Upon termination of the Service, we will, at the Controller's choice, return or delete all Personal Data, unless retention is required by law. Deletion will occur within a reasonable period.

Audits

The Controller may, upon reasonable written notice and no more than once per year (except in case of a suspected breach), request information necessary to demonstrate compliance with this DPA. We may provide third-party audit reports (e.g., SOC 2) to satisfy this requirement.

Liability

Liability under this DPA is subject to the limitations set out in the main agreement between the parties.

Governing Law

This DPA is governed by the same law as the main agreement (laws of the State of Texas, United States).

Order of Precedence

In case of conflict between this DPA and the main agreement, this DPA prevails on matters of data protection.

Contact

For data protection questions: