Data Processing Agreement

1. Parties and Background

This Data Processing Agreement ("DPA") forms part of the Terms of Service between DropFix ("Processor") and the customer ("Controller") (collectively, the "Parties"). This DPA governs the processing of personal data in connection with the DropFix SaaS platform and services.

2. Definitions

For the purposes of this DPA:

• "Personal Data" means any information relating to an identified or identifiable natural person
• "Processing" means any operation performed on Personal Data
• "Data Subject" means the individual whose Personal Data is processed
• "Sub-processor" means any third party engaged by Processor to process Personal Data
• "GDPR" means General Data Protection Regulation (EU) 2016/679
• "CCPA" means California Consumer Privacy Act
• "DPDP Act" means the Digital Personal Data Protection Act 2023 (India)

3. Scope and Purpose of Processing

4. Processor Obligations

Processor shall:

• Process Personal Data only on documented instructions from Controller
• Ensure personnel authorized to process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Not engage Sub-processors without prior written authorization
• Assist Controller in fulfilling data subject rights requests
• Notify Controller of any Personal Data breach within 72 hours
• Delete or return all Personal Data upon termination of services
• Make available all information necessary to demonstrate compliance

5. Controller Obligations

Controller shall:

• Provide accurate and complete information about data subjects
• Obtain all necessary consents and permissions for data processing
• Ensure processing is conducted in accordance with applicable laws
• Maintain records of processing activities
• Promptly notify Processor of any data subject complaints
• Provide timely instructions to Processor regarding data handling

6. Security Measures

Processor shall implement appropriate technical and organizational security measures to ensure a level of security appropriate to the risk, including:

• Encryption of Personal Data in transit using TLS/SSL
• Encryption of sensitive Personal Data at rest
• Access controls and authentication mechanisms
• Regular security assessments and penetration testing
• Incident response and breach notification procedures
• Employee security training and awareness programs
• Secure infrastructure hosted with Supabase
• Backup and disaster recovery procedures
• Monitoring and logging of access and activities

7. Sub-processors

8. Data Subject Rights

Processor shall, taking into account the nature of processing, assist Controller in fulfilling the following data subject rights:

• Right of Access: Provide information about Personal Data processing
• Right to Rectification: Correct inaccurate Personal Data
• Right to Erasure: Delete Personal Data upon request
• Right to Restrict Processing: Limit processing activities
• Right to Data Portability: Provide data in machine-readable format
• Right to Object: Stop processing based on legitimate interests
• Rights related to Automated Decision-Making: Not subject individuals to solely automated decisions

Requests should be directed to Controller. Processor will provide reasonable assistance within 30 days of request.

9. Data Breach Notification

10. Data Retention and Deletion

Processor shall retain Personal Data only for as long as necessary to provide the Service:

• Account data: Retained while account is active, deleted within 30 days of termination
• Usage data: Retained for 12 months for analytics purposes
• Logs: Retained for 90 days for security and debugging
• Backup copies: Deleted within 30 days of backup rotation

Upon termination of the Terms, Processor shall delete or anonymize all Personal Data within 30 days, except where retention is required by law.

11. Audit Rights

Controller may audit Processor's compliance with this DPA by:

• Requesting copies of sub-processor security certifications (e.g. Supabase SOC 2)
• Requesting summaries of security assessments and penetration tests
• Requesting information about data processing activities

Processor shall make available all necessary information for Controller to verify compliance. Audits shall be scheduled with reasonable advance notice and conducted during business hours.

12. International Data Transfers

Personal Data may be transferred to and processed in countries outside the European Economic Area (EEA). When transferring Personal Data internationally, Processor ensures:

• Adequacy decisions or appropriate safeguards are in place
• Standard Contractual Clauses (SCCs) are used where required
• Data subjects' rights are protected under applicable data protection laws
• Sub-processors in the US are certified under the Data Privacy Framework

13. Liability

Processor's liability for breaches of this DPA shall be subject to the limitations set out in the Terms of Service. In no event shall Processor's total liability exceed the fees paid by Controller in the twelve months preceding the claim.

14. Governing Law

This DPA shall be governed by and construed in accordance with the laws of the jurisdiction in which DropFix operates, consistent with the governing law provisions in the Terms of Service.

15. Contact

For questions about this DPA or to exercise data subject rights, please contact us: