# Data Processing Agreement (DPA) **This Data Processing Agreement ("DPA") is entered into as of January 24, 2026** **BETWEEN:** **Data Controller:** **[CONTROLLER_NAME]** ("Controller") [CONTROLLER_ADDRESS] [CONTROLLER_EMAIL] **AND:** **Data Processor:** **[PROCESSOR_NAME]** ("Processor") [PROCESSOR_ADDRESS] [PROCESSOR_EMAIL] **Collectively referred to as the "Parties."** --- ## 1. Background and Scope ### 1.1 Background The Controller engages the Processor to provide [DESCRIPTION_OF_SERVICES] (the "Services"), which involve the processing of personal data on behalf of the Controller. ### 1.2 Scope This DPA applies to the processing of Personal Data (as defined below) by the Processor on behalf of the Controller in connection with the Services. This DPA forms an integral part of the [MASTER_SERVICE_AGREEMENT] between the Parties (the "Agreement"). ### 1.3 GDPR Compliance This DPA is intended to satisfy the requirements of Article 28(3) of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and any national implementing laws, regulations, and secondary legislation. ## 2. Definitions **"Affiliate"** means any entity that controls, is controlled by, or is under common control with a Party. **"Data Subject"** means an identified or identifiable natural person to whom Personal Data relates. **"GDPR"** means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and any national implementing laws, regulations, and secondary legislation. **"Personal Data"** means any information relating to an identified or identifiable natural person ("Data Subject"). **"Personal Data Breach"** means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed. **"Processing"** means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means. ## 3. Processor's Obligations ### 3.1 Acting on Instructions The Processor shall process Personal Data only on documented instructions from the Controller, unless required to do so by European Union or Member State law to which the Processor is subject. In such case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. ### 3.2 Processing Details The Processor shall: - Process Personal Data only for the specific purpose(s) set out in the Agreement - Process Personal Data in accordance with Appendix A (Processing Activities) - Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk - Not process Personal Data for any purpose other than the performance of the Services ### 3.3 Confidentiality The Processor shall ensure that persons authorized to process Personal Data are committed to confidentiality or are under an appropriate statutory obligation of confidentiality. ### 3.4 Security Measures The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including: - **Pseudonymization and encryption** of Personal Data - **Ability to ensure confidentiality, integrity, availability, and resilience** of processing systems and services - **Ability to restore availability and access to Personal Data** in a timely manner in the event of a physical or technical incident - **Process for regularly testing, assessing, and evaluating** the effectiveness of technical and organizational measures - **Measures for user identification and authorization** - **Measures for protection of data during transmission** - **Measures for protection of data against unauthorized access** ### 3.5 Subprocessing #### 3.5.1 General Authorization The Controller generally authorizes the Processor to engage other processors (subprocessors) under the conditions set forth in this Clause 3.5. #### 3.5.2 Prior Subprocessors The Processor has obtained the Controller's prior authorization for the following subprocessors: | Subprocessor Name | Services | Location | | ----------------- | ------------------ | ---------- | | [CLOUD_PROVIDER] | Cloud hosting | [Location] | | Stripe | Payment processing | [Location] | | Plausible | Analytics services | [Location] | #### 3.5.3 New Subprocessors The Processor shall inform the Controller in advance of any intended changes concerning the addition or replacement of subprocessors, giving the Controller a reasonable opportunity to object to such changes. The Controller may object to the appointment or replacement of a subprocessor if such appointment or replacement would result in a substantial change to the Processor's ability to meet its obligations under this DPA. ### 3.6 Data Subject Rights Taking into account the nature of the processing, the Processor shall assist the Controller by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller's obligation to respond to requests for exercising the Data Subject's rights laid down in Chapter III of the GDPR. These rights include: - Right of access (Article 15) - Right to rectification (Article 16) - Right to erasure ("right to be forgotten") (Article 17) - Right to restriction of processing (Article 18) - Right to data portability (Article 20) - Right to object (Article 21) ### 3.7 Data Deletion or Return After the end of the provision of Services, the Processor shall, at the Controller's choice: - Delete all Personal Data processed on behalf of the Controller, or - Return all Personal Data to the Controller The Processor shall also delete existing copies unless European Union or Member State law requires storage of Personal Data. ## 4. Data Breach Notification ### 4.1 Notification to Controller The Processor shall notify the Controller without undue delay upon becoming aware of a Personal Data Breach. The notification shall at least: - Describe the nature of the Personal Data Breach - Provide the name and contact details of the contact point - Describe the likely consequences of the Personal Data Breach - Describe the measures taken or proposed to address the Personal Data Breach ### 4.2 Notification to Data Subjects In the event of a Personal Data Breach that is likely to result in a high risk to the rights and freedoms of Data Subjects, the Processor shall provide the Controller with sufficient information to allow the Controller to meet its obligation to notify the Data Subjects without undue delay. ### 4.3 Notification to Supervisory Authority The Processor shall cooperate with the Controller, to the extent possible, to enable the Controller to fulfill its obligation to notify the relevant supervisory authority of a Personal Data Breach without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach. ## 5. Data Protection Impact Assessment and Prior Consultation The Processor shall provide reasonable assistance to the Controller, to the extent possible, with: - Data protection impact assessments - Prior consultations with the supervisory authority as required by Articles 35 and 36 of the GDPR. ## 6. Controller's Responsibility The Controller shall: - Ensure that the processing instructions are lawful and comply with GDPR - Obtain any required consents from Data Subjects - Provide Data Subject privacy notices - Maintain records of processing activities (Article 30 GDPR) - Respond to Data Subject rights requests - Conduct Data Protection Impact Assessments when required - Notify supervisory authorities of Personal Data Breaches - Implement appropriate technical and organizational measures ## 7. Audit and Inspection Rights ### 7.1 Audit Rights The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits, including inspections, by the Controller or another auditor mandated by the Controller. ### 7.2 Inspection Notice The Controller shall provide reasonable notice (at least [NOTICE_PERIOD] days) before conducting an audit or inspection. ### 7.3 Confidential Information During any audit or inspection, the Processor may redact or withhold confidential or proprietary information to the extent permitted by applicable law. ## 8. International Data Transfers ### 8.1 Transfer to Third Countries The Processor shall not transfer Personal Data to a country outside the European Economic Area ("Third Country") unless: - The Controller has authorized the transfer in writing, and - Appropriate safeguards are in place in accordance with GDPR Chapter V ### 8.2 Standard Contractual Clauses Where Personal Data is transferred to a Third Country, the Parties agree to rely on Standard Contractual Clauses approved by the European Commission for the transfer of Personal Data. The Processor shall inform the Controller of any material change that affects the Standard Contractual Clauses. ### 8.3 US Data Transfers For transfers to the United States, the Parties agree to implement appropriate safeguards, which may include: - Standard Contractual Clauses (SCCs) - Binding Corporate Rules (BCRs) - GDPR Contractual Clauses - Certification mechanisms (where applicable) ## 9. Term and Termination ### 9.1 Term This DPA shall commence on the Effective Date and continue for the duration of the Agreement. ### 9.2 Termination Upon termination or expiration of the Agreement, the Processor shall, at the Controller's option: - Return all Personal Data to the Controller, or - Securely delete all Personal Data The Processor shall provide written certification of deletion within [TIMEFRAME] days after the effective date of termination. ### 9.3 Survival The provisions of this DPA that are intended to survive termination shall survive, including: - Confidentiality obligations (Clause 3.3) - Security measures (Clause 3.4) - Data deletion obligations (Clause 3.7 and Clause 9.2) - Audit rights (Clause 7) for [SURVIVAL_PERIOD] months - Governing law and dispute resolution (Clause 12) ## 10. Limitation of Liability ### 10.1 Cap on Liability The Processor's aggregate liability under this DPA shall be limited to [LIABILITY_CAP] or the fees paid under the Agreement in the [TIMEFRAME] months preceding the claim, whichever is greater. ### 10.2 Exclusions The liability cap shall not apply to: - Death or personal injury caused by Processor's negligence - Fraud or willful misconduct - Breach of confidentiality obligations - Data Protection Breaches caused by Processor's failure to implement appropriate security measures ## 11. Indemnification The Processor shall indemnify, defend, and hold harmless the Controller from and against any losses, damages, liabilities, and expenses arising from: - The Processor's breach of this DPA - The Processor's failure to implement appropriate security measures - The Processor's unauthorized disclosure of Personal Data - The Processor's violation of applicable data protection laws ## 12. Governing Law and Dispute Resolution ### 12.1 Governing Law This DPA shall be governed by the laws of [GOVERNING_JURISDICTION], without regard to conflict of law principles. ### 12.2 Dispute Resolution Any dispute arising from or relating to this DPA shall be resolved in accordance with the dispute resolution provisions of the Agreement. ## 13. Entire Agreement This DPA, together with the Agreement and any Appendices, constitutes the entire agreement between the Parties regarding the subject matter hereof and supersedes all prior discussions, agreements, and understandings. ## 14. Severability If any provision of this DPA is found to be unenforceable, the remaining provisions shall remain in full force and effect. ## 15. Amendments No amendment or modification of this DPA shall be valid unless in writing and signed by both Parties. ## 16. Notices All notices required or permitted under this DPA shall be in writing and shall be deemed delivered when: - Delivered personally - Sent by confirmed email with read receipt - Sent by registered or certified mail (return receipt requested) **Notices to Controller:** [CONTROLLER_NAME] Attn: [CONTACT_PERSON] [CONTROLLER_ADDRESS] Email: [CONTROLLER_EMAIL] **Notices to Processor:** [PROCESSOR_NAME] Attn: [CONTACT_PERSON] [PROCESSOR_ADDRESS] Email: [PROCESSOR_EMAIL] --- ## APPENDIX A: Processing Activities | Description of Processing | Nature and Purpose | Type of Data | Data Subjects | Retention Period | | ------------------------- | ------------------------------------------- | ----------------------------------- | ---------------- | ----------------------------- | | User account management | Authenticate users and manage accounts | Name, email, password hash | Service users | Account lifetime + 730 days | | Payment processing | Process subscription payments | Payment details, billing address | Customers | 730 years (legal requirement) | | Analytics | Analyze usage patterns and improve services | Usage data, IP address, device info | Website visitors | 730 months (anonymized) | | Customer support | Respond to user inquiries | Support messages, account details | Service users | 730 years | | Email communications | Send transactional and marketing emails | Email address, engagement data | Subscribers | Until opt-out/unsubscribe | ## APPENDIX B: Technical and Organizational Measures ### B.1 Access Control - Unique user credentials for all personnel - Role-based access controls (RBAC) - Multi-factor authentication for privileged access - Regular access reviews (quarterly) - Immediate access revocation upon personnel departure ### B.2 Data Encryption - Encryption in transit: TLS 1.3 for all data transfers - Encryption at rest: AES-256 for stored data - Key management policies and procedures - Secure key escrow and rotation ### B.3 Network Security - Firewalls and intrusion detection/prevention systems - Network segmentation and isolation - Regular security scanning and penetration testing - DDoS protection and mitigation ### B.4 Physical Security - Secure data centers with 24/7 monitoring - Access control and visitor logs - Environmental controls (fire suppression, climate control) - Backup power and redundancy ### B.5 Monitoring and Logging - Comprehensive audit logging of all system activities - Real-time security monitoring and alerting - Log retention for [LOG_RETENTION_PERIOD] months - Regular log analysis and review ### B.6 Incident Response - Documented incident response plan - Trained incident response team - 24/7 incident response capabilities - Regular incident response drills and testing --- **IN WITNESS WHEREOF**, the Parties have executed this Data Processing Agreement as of the Effective Date. **CONTROLLER:** [CONTROLLER_NAME] By: `_________________` Name: `_________________` Title: `_________________` **PROCESSOR:** [PROCESSOR_NAME] By: `_________________` Name: `_________________` Title: `_________________` --- **Data Processing Agreement Version:** 1.0 **Effective Date:** January 24, 2026 --- **Antigravity Test Co** is committed to protecting personal data and complying with the GDPR and other applicable data protection laws.