DRAFT – not in effect until the owner sets version 1.0 and an effective date.
Data Processing Addendum
This Data Processing Addendum (“DPA”) supplements the underlying services agreement between (“DataChimp Labs” or “Processor”) and the customer identified in the underlying agreement (“Customer” or “Controller”). This DPA governs the parties’ respective obligations with respect to Personal Data processed by Processor on behalf of Controller in connection with the Services.
1. Definitions
Terms used but not defined in this DPA have the meanings given in Regulation (EU) 2016/679 (the “GDPR”), the UK GDPR, or the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”) – collectively, the “Data Protection Laws” – as applicable.
- “Data Subject” has the meaning at GDPR Article 4(1).
- “Personal Data” has the meaning at GDPR Article 4(1).
- “Processing” has the meaning at GDPR Article 4(2).
- “Controller” has the meaning at GDPR Article 4(7).
- “Processor” has the meaning at GDPR Article 4(8).
- “Sub-processor” means any processor engaged by Processor to process Personal Data on behalf of Controller.
- “SCCs” means the Standard Contractual Clauses set out in Commission Implementing Decision (EU) 2021/914.
- “UK IDTA Addendum” means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner’s Office.
2. Roles & Instructions
Controller is the controller of the Personal Data. Processor is the processor of the Personal Data. Processor shall process Personal Data only on documented instructions from Controller – including the underlying agreement, this DPA, and any additional written instructions the parties may agree in writing – in accordance with GDPR Article 28(3)(a).
Processor shall promptly inform Controller if, in its opinion, an instruction infringes Data Protection Laws.
3. Confidentiality
Processor shall ensure that personnel authorized to process Personal Data are bound by a written or statutory obligation of confidentiality, in accordance with GDPR Article 28(3)(b). Processor shall limit access to Personal Data to personnel who require access to perform the Services.
4. Security
Processor shall implement appropriate technical and organizational
measures (“TOMs”) to ensure a level of security appropriate to the
risk, in accordance with GDPR Article 32. Current TOMs are described
in information-security-policy.md and its dependencies, including
encryption-at-rest-policy.md, encryption-in-transit-policy.md,
access-control-policy.md, and authentication-mfa-policy.md.
TOMs include, at minimum:
- (a) encryption of Personal Data at rest and in transit;
- (b) role-based access control with least privilege;
- (c) multi-factor authentication for privileged access;
- (d) logging and monitoring of access to Personal Data;
- (e) a documented incident response process;
- (f) regular testing, assessment, and evaluation of the effectiveness of the measures.
5. Sub-processors
Controller provides general written authorization for Processor to engage Sub-processors, subject to this Section 5. Processor shall:
- (a) publish the current list of Sub-processors in the
## Sub-processorssection below; - (b) notify Controller of any intended additions or replacements at least thirty (30) days before onboarding, giving Controller a reasonable opportunity to object;
- (c) impose data protection obligations on each Sub-processor substantially equivalent to those in this DPA;
- (d) remain fully liable to Controller for the performance of each Sub-processor’s obligations.
If Controller objects on reasonable grounds within the notice window, the parties shall work in good faith to resolve the objection. If no resolution is reached, Controller may terminate the affected Services without penalty, subject to a pro rata refund of prepaid fees.
6. Assistance
Taking into account the nature of the Processing and the information available to Processor, Processor shall assist Controller by appropriate technical and organizational measures with:
- (a) responding to requests from Data Subjects to exercise rights under Chapter III of the GDPR (GDPR Article 28(3)(e));
- (b) Controller’s obligations under GDPR Articles 32 through 36, including data protection impact assessments and prior consultation with supervisory authorities (GDPR Article 28(3)(f)).
7. Personal Data Breach Notification
Processor shall notify Controller without undue delay after becoming aware of a Personal Data Breach affecting Controller’s Personal Data. The notification shall, to the extent then known, include the content required by GDPR Article 33(3), and Processor shall provide further information as it becomes available.
8. Deletion or Return
Upon termination of the Services, Processor shall, at Controller’s
choice, return or delete all Personal Data, unless applicable law
requires continued storage. This Section 8 does not apply to data
that has been irreversibly de-identified. Backup copies are deleted
in accordance with data-retention-and-disposal-policy.md.
9. Audit
Processor shall make available to Controller all information reasonably necessary to demonstrate compliance with this DPA and shall contribute to audits, including inspections, conducted by Controller or a mutually agreed auditor, in accordance with GDPR Article 28(3)(h). Audits are subject to reasonable notice, occur no more than once per twelve (12) months (except in the event of a Personal Data Breach), during normal business hours, and are conducted so as to minimize disruption to Processor’s operations.
Processor may satisfy this obligation by providing SOC 2 reports, industry-standard certifications, or similar third-party attestations where available.
10. International Transfers
Where Personal Data is transferred from the European Economic Area, Switzerland, or the United Kingdom to a country that has not been recognized as providing an adequate level of protection, the transfer is governed by:
- (a) the SCCs, Module 2 (Controller to Processor) or Module 3 (Processor to Processor), incorporated by reference and completed as set forth in Annex to this DPA;
- (b) the UK IDTA Addendum, for transfers subject to UK GDPR; and
- (c) supplementary technical and organizational measures as contemplated by the Schrems II decision (Case C-311/18), including the TOMs in Section 4.
Where the parties execute updated transfer instruments as required by regulatory change, those instruments supersede this Section 10 to the extent inconsistent.
11. General
In the event of conflict on GDPR-specific issues, the order of precedence is: this DPA > the underlying agreement > the SCCs. The governing law of this DPA follows the underlying agreement, except that the SCCs are governed as set out therein. This DPA is severable; if any provision is held unenforceable, the remaining provisions remain in effect.
12. Signatures
Executed as of the effective date of the underlying agreement.
Controller: ______________
Name: __________ Title: ________
Signature: ________ Date: _________
Processor:
Name: __________ Title: ________
Signature: ________ Date: _________
Sub-processors
The table below lists each Sub-processor engaged by Processor to
process Personal Data on behalf of Controller. Rows are derived from
repository evidence: AWS resource types declared in
services/*/serverless.yml and vendored SDK dependencies in
services/*/package.json (see PR body “Sub-processors derivation”
section for the exact grep commands and output snippets).
| Sub-processor | Purpose | Location | SCCs Applicable |
|---|---|---|---|
| Amazon Web Services, Inc. (AWS Lambda) | Serverless compute for API request handling | us-east-1 (US) | Yes – SCCs via AWS DPA |
| Amazon Web Services, Inc. (AWS DynamoDB) | Primary customer data store | us-east-1 (US) | Yes – SCCs via AWS DPA |
| Amazon Web Services, Inc. (AWS S3) | Object storage for customer files and artifacts | us-east-1 (US) | Yes – SCCs via AWS DPA |
| Amazon Web Services, Inc. (AWS Cognito) | Authentication and identity | us-east-1 (US) | Yes – SCCs via AWS DPA |
| Amazon Web Services, Inc. (AWS Bedrock) | Foundation model inference | us-east-1 (US) | Yes – SCCs via AWS DPA |
| Amazon Web Services, Inc. (AWS SES) | Transactional email delivery | us-east-1 (US) | Yes – SCCs via AWS DPA |
| Amazon Web Services, Inc. (AWS CloudFront / Amplify) | CDN and web-app hosting | Global edge, US origin | Yes – SCCs via AWS DPA |
| Amazon Web Services, Inc. (AWS KMS) | Key management for at-rest encryption | us-east-1 (US) | Yes – SCCs via AWS DPA |
| Stripe, Inc. | Payment processing | US (multiple regions) | Yes – SCCs via Stripe DPA |
| GitHub, Inc. (subsidiary of Microsoft) | Source code hosting (code only, no customer data) | US | Yes – SCCs via GitHub / Microsoft DPA |
Processor will notify Controller of additions or replacements in accordance with Section 5 above.