Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") is between the customer organization that accepts the DPP Shield terms of service ("Customer") and PRIME NEXUS INTERNATIONAL LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States ("Processor"). It applies to personal data that the Processor processes on the Customer's behalf when providing the DPP Shield service ("Customer Personal Data"), and forms part of the terms of service.

The Customer is the controller of Customer Personal Data. The Processor is the controller only of data it processes for its own purposes (account administration, billing, security of the service and its website), which is covered by the privacy notice instead.

2. Processing on documented instructions

The Processor processes Customer Personal Data only on the Customer's documented instructions. The terms of service, this DPA and the Customer's use and configuration of the service are the Customer's complete instructions. The Processor informs the Customer if, in its opinion, an instruction infringes data protection law.

Annex I describes the subject matter, nature, purpose and duration of the processing, and the categories of personal data and data subjects.

3. Confidentiality

The Processor ensures that everyone it authorizes to process Customer Personal Data is bound by confidentiality.

4. Security of processing

The Processor implements the technical and organizational measures in Annex II, taking into account the state of the art, the costs of implementation and the risks to data subjects. It may update them provided the overall level of protection is not reduced.

5. Sub-processors

The Customer gives general authorization for the Processor to engage the sub-processors listed in Annex III. The Processor informs the Customer of any intended addition or replacement at least 30 days in advance by e-mail to the organization's owners or by notice in the service. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected service.

The Processor imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains liable to the Customer for its sub-processors.

6. Assistance with data subject requests

Taking into account the nature of the processing, the Processor assists the Customer with appropriate measures to respond to requests from data subjects. The service provides export and erasure tools for this purpose. The Processor forwards to the Customer any request it receives directly that concerns Customer Personal Data.

7. Personal data breaches

The Processor notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. The Processor provides further information as it becomes available.

8. Impact assessments and consultation

The Processor provides reasonable assistance with data protection impact assessments and prior consultation of supervisory authorities, to the extent they concern the Processor's processing and the information is not otherwise available to the Customer.

9. Deletion and return

The Customer can export its data at any time while the service is active. After the end of the service, the Processor deletes Customer Personal Data within 30 days, unless law requires it to keep it. Copies in encrypted backups are deleted as the backups expire, within 30 days of their creation.

10. Information and audits

The Processor makes available the information necessary to demonstrate compliance with this DPA, including the security description in Annex II. Where that is not sufficient, the Customer may carry out, or have an independent auditor bound by confidentiality carry out, an audit once per year with at least 30 days' notice, at the Customer's cost, in a way that does not disrupt the service or compromise other customers' data.

11. International transfers

The Processor is established in Wyoming, United States, outside the European Economic Area. Customer Personal Data at rest is hosted in the EU (Annex III). To the extent the Processor's or a sub-processor's processing involves a transfer of personal data out of the EEA, the transfer is governed by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module Two, controller to processor, between the Customer and the Processor; Module Three, processor to processor, between the Processor and its sub-processors), which are incorporated by reference, or by another valid transfer mechanism such as the EU-U.S. Data Privacy Framework where the recipient is certified.

For the Standard Contractual Clauses: the optional docking clause (clause 7) applies; under clause 9(a), option 2 (general written authorisation) applies with the notice period in section 5; the optional wording in clause 11(a) does not apply; under clauses 17 and 18 the Clauses are governed by the law of France and disputes are resolved by the courts of France; the competent supervisory authority under clause 13 is the one responsible for the Customer as data exporter; and Annexes I to III of this DPA complete the Annexes to the Clauses.

12. Liability, term and precedence

Liability under this DPA is subject to the limitations in the terms of service, except where law does not allow them. This DPA applies for as long as the Processor processes Customer Personal Data. If this DPA conflicts with the terms of service, this DPA prevails for the processing of Customer Personal Data; the Standard Contractual Clauses, where they apply, prevail over both.

Annex I: Details of the processing

Annex II: Technical and organizational measures

• Encryption in transit (TLS with HSTS) for all traffic; AES-256-GCM encryption of integration secrets and MFA seeds in the database; scrypt password hashing; API keys stored as hashes.
• Tenant isolation checked on every request; role-based access; optional mandatory MFA; SSO (OIDC/SAML) and SCIM provisioning; scoped and expiring API keys; session lifetime and idle limits; step-up authentication for sensitive actions.
• Append-only, hash-chained audit log of changes.
• Upload type verification and malware scanning; strict Content Security Policy; outbound requests restricted to public networks; rate limiting.
• Key-only administrative access, firewall, intrusion prevention (fail2ban) and automatic security updates on servers.
• Nightly encrypted offsite backups retained for 30 days, with monthly restore tests.
• Monitoring every 15 minutes with alerting; published service status.
• Personnel with access are bound by confidentiality; access is limited to what each person needs.

Annex III: Authorized sub-processors

Contact

Questions about this DPA or data protection: contact@dppshield.com.