Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Master Software License and Services Agreement ("Agreement") between Absorb.dev LLC ("Absorb") and Customer. It applies only when Absorb processes Customer Personal Data, which in practice means personal data Customer sends Absorb for support. The self-hosted Software does not send Customer Data to Absorb.

1. Definitions

1. Data Protection Laws: the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, the CCPA as amended by the CPRA, and other laws on personal data that apply to the processing.
2. Customer Personal Data: personal data Absorb processes on Customer's behalf under the Agreement.
3. Controller, processor, data subject, personal data breach, and processing have the meanings in the GDPR. "Business", "service provider", "sell", and "share" have the meanings in the CCPA.
4. Subprocessor: a third party Absorb engages to process Customer Personal Data.

2. Roles and instructions

Customer is the controller, or a processor acting for its own controller, and Absorb is the processor. Absorb will process Customer Personal Data only on Customer's documented instructions, which are the Agreement, this DPA, and Customer's support requests. Absorb will inform Customer if it believes an instruction breaches Data Protection Laws.

3. Details of processing

4. Customer obligations

Customer will send only the personal data needed to resolve a support request, and will redact or pseudonymize it where practical. Customer confirms it has a lawful basis and has given any notices needed to share that data with Absorb.

5. Confidentiality

Absorb will ensure that people authorized to process Customer Personal Data are bound by confidentiality obligations and access it only as needed for Support.

6. Security

Absorb will implement the technical and organizational measures in Annex 1 and keep them at least as protective during the Subscription Term.

7. Subprocessors

1. Customer authorizes Absorb to use the Subprocessors listed on its Subprocessors page.
2. Absorb will give at least 30 days' notice before adding or replacing a Subprocessor, by updating that page and emailing customers who subscribe to updates.
3. Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected Order Form and receive a refund of prepaid fees for the remaining Subscription Term.
4. Absorb will impose data protection terms on each Subprocessor at least as protective as this DPA and remains liable for its Subprocessors.

8. Assistance

Absorb will promptly forward any data subject request it receives about Customer Personal Data and will not respond to it without Customer's instruction, except to redirect the requester. Absorb will provide reasonable help with data subject requests, data protection impact assessments, and consultations with authorities, to the extent they concern Absorb's processing.

9. Personal data breaches

Absorb will notify Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the breach, the data and people affected, the likely consequences, and the measures taken, with further information as it becomes available.

10. Return and deletion

Absorb will delete Customer Personal Data within 90 days after the related support request closes, and in any case within 90 days after the Agreement ends, unless law requires longer retention. Customer may request earlier deletion by emailing [email protected].

11. Audits

Absorb will make available the information reasonably needed to show compliance with this DPA, including completed security questionnaires and, once available, third-party audit reports. If that information is not sufficient or a regulator requires it, Customer may audit Absorb once per year, with 30 days' notice, during business hours, at Customer's cost, and under confidentiality terms.

12. International transfers

Where Customer Personal Data is transferred from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses (Commission Decision 2021/914), Module 2 or Module 3 as applicable, incorporated by reference. Clause 7 does not apply. In Clause 9, Option 2 applies with the notice period in Section 7. In Clause 11, the optional language does not apply. In Clauses 17 and 18, the law and courts of Ireland apply. Annex I is Section 3 of this DPA, and Annex II is Annex 1. For UK transfers, the UK International Data Transfer Addendum applies, and for Swiss transfers, references to the GDPR mean the FADP.

13. U.S. state privacy laws

Absorb acts as a service provider. It will not sell or share Customer Personal Data, retain, use, or disclose it outside the direct business relationship or for any purpose other than the business purposes in Section 3, or combine it with personal data from other sources except as the CCPA permits. Absorb will notify Customer if it can no longer meet its CCPA obligations.

14. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Agreement. If this DPA conflicts with the Agreement, this DPA controls for the processing of Customer Personal Data. If the Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses control.

Annex 1: Technical and organizational measures