1. Purpose and Scope
This Data Processing Addendum ("DPA") forms part of the Terms of Service between Pawabase, Inc. ("Pawabase", "Processor") and the customer ("Controller") for the provision of Pawabase services. This DPA applies to the Processing of Personal Data by Pawabase on behalf of the Controller in the course of providing the Services.
2. Definitions
For the purposes of this DPA:
- GDPR: The General Data Protection Regulation (EU) 2016/679
- Personal Data: Any information relating to an identified or identifiable natural person
- Processing: Any operation performed on Personal Data
- Data Subject: The individual to whom Personal Data relates
- Sub-processor: Any third party engaged by Pawabase to process Personal Data
3. Processing Details
Pawabase will process Personal Data only in accordance with the Controller's documented instructions and for the purposes of providing the Services as described in the Terms of Service. The subject matter, duration, nature, purpose, and categories of Personal Data and Data Subjects are as agreed in the Terms of Service.
4. Pawabase Obligations as Processor
Pawabase shall:
- Process Personal Data only on documented instructions from the Controller
- Ensure persons authorized to process Personal Data are bound by confidentiality obligations
- Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk
- Not engage another processor without prior written authorization from the Controller
- Assist the Controller in responding to Data Subject requests
- Assist the Controller in ensuring compliance with security, breach notification, and impact assessment obligations
- Delete or return all Personal Data to the Controller at the end of the Services, unless required by law to retain it
- Make available to the Controller all information necessary to demonstrate compliance with this DPA
5. Sub-processors
The Controller authorizes Pawabase to engage sub-processors to process Personal Data. Pawabase maintains a list of current sub-processors and will notify the Controller of any intended changes, giving the Controller the opportunity to object. If the Controller reasonably objects, the parties will work together in good faith to find a solution.
6. Data Subject Rights
Taking into account the nature of Processing, Pawabase shall assist the Controller by appropriate technical and organizational measures, insofar as possible, for the fulfillment of the Controller's obligation to respond to requests for exercising the Data Subject's rights under the GDPR.
7. Personal Data Breach
Pawabase shall notify the Controller without undue delay after becoming aware of a Personal Data breach affecting Personal Data processed by Pawabase on behalf of the Controller. The notification shall include information to allow the Controller to meet its breach notification obligations.
8. Cross-Border Transfers
If Personal Data is transferred outside the European Economic Area, Pawabase shall ensure such transfers are conducted in compliance with applicable data protection laws, including by using appropriate transfer mechanisms such as Standard Contractual Clauses where required.
9. Audit Rights
The Controller may conduct audits or inspections of Pawabase's data processing activities to verify compliance with this DPA, at its own expense and with reasonable notice. Pawabase shall cooperate with such audits and provide reasonable assistance.
10. Liability
Each party's liability under this DPA shall be subject to the limitations of liability set forth in the Terms of Service, except where such limitations are not permitted by applicable law.
11. Term and Termination
This DPA shall remain in effect for as long as Pawabase processes Personal Data on behalf of the Controller. Upon termination of the Services, Pawabase shall comply with its obligations regarding deletion or return of Personal Data as set forth in Section 4.
12. Contact Us
For questions about this DPA, please contact us at hello@pawabase.com.