Enterprise Data Processing Agreement (DPA)

5. Government Data Request Handling Policy (Annex B)

Processor adheres to a strict government request protocol to protect Controller data against unlawful or overbroad government access demands:

• Challenge Requirement: Processor agrees to review and legally challenge any government order, warrant, or subpoena that is overbroad, unlawful, or technically invalid.
• Customer Notification: Processor will promptly notify Controller before disclosing data, unless explicitly prohibited by law. In cases involving gag orders, Processor will seek legal relief to vacate the gag order.
• Data Minimization: If legally compelled to comply, Processor will disclose only the strict minimum data required by law.

7. Data Subject Rights & Processor Assistance

Processor shall assist Controller by implementing appropriate technical and organizational measures for the fulfillment of Controller’s obligation to respond to requests exercising Data Subject rights under GDPR/CCPA.

• Response Window: Processor will respond to Controller data subject requests within 30 calendar days.
• Data Portability: Processor will export relevant scan logs or account records in standard JSON or CSV formats upon request.
• DPIA & Regulator Cooperation: Processor provides necessary technical documentation and cooperation for Controller's Data Protection Impact Assessments (DPIAs) and communications with supervisory authorities (e.g., EDPB, ICO).

8. Personal Data Breach Notification

Processor shall notify Controller without undue delay, and in any case within 24 hours, after becoming aware of a confirmed Personal Data Breach impacting Controller's data. Notification shall include details regarding the nature of the breach, affected data categories, estimated impact, and corrective mitigation steps taken.

9. Return or Delete Election Upon Termination

Upon termination of the Master Agreement, Controller may elect within 30 days to either:

• Option A (Structured Export): Receive a complete export of account data and scan analytics in machine-readable format (JSON/CSV); or
• Option B (Certified Erasure): Instruct Processor to perform certified cryptographic erasure of all stored Controller data and dynamic link redirect maps across production databases and backups within 30 days, providing written confirmation upon request.

10. International Transfers & Data Residency

For data transfers from the European Economic Area (EEA), Switzerland, or the United Kingdom to countries without an adequacy decision, the parties agree that the EU Standard Contractual Clauses (SCCs - Module 2 Controller-to-Processor) are hereby incorporated into this DPA by reference. Enterprise plans also offer EU regional data residency options upon request.

11. Audit Rights & Confidentiality Provisions

Upon reasonable written notice (minimum 30 days), Processor shall allow Controller (or its designated independent auditor) to conduct audits and inspections of Processor's data protection practices to verify compliance with this DPA, up to once per calendar year. All audit findings shall be treated as strict Confidential Information.

12. Governing Law and Contact Information

This DPA is governed by the laws of the State of New Mexico, USA, without regard to conflict of law principles.