Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer") and AbuseZero ("Processor") and applies when we process personal data on your behalf in providing the Service. Capitalized terms not defined here have the meaning in the Terms.

For Customer Data, you are the controller (or processor for your own customers) and we are the processor. For account, billing, and website data, we are an independent controller as described in our Privacy Policy.

• Subject matter: providing abuse and eligibility evaluations through the Service.
• Duration: the term of the Terms, plus any period needed to return or delete data.
• Nature and purpose: receiving, analyzing, storing, and returning decisions on identifiers and context you submit, and providing support and security for the Service.
• Types of personal data: email addresses, IP addresses, device and network signals, benefit and claim history, and other identifiers you choose to submit.
• Data subjects: your end users, prospective users, and personnel.

We will:

• Process Customer Data only on your documented instructions, which include the Terms, this DPA, and your use of the Service’s features. We will tell you if we believe an instruction violates the law.
• Ensure that personnel with access to Customer Data are bound by confidentiality.
• Implement the security measures described below.
• Provide reasonable assistance with data subject requests, data protection impact assessments, and consultations with regulators.
• Not sell Customer Data, or use it for purposes other than providing the Service to you.

You confirm that you have a lawful basis and have given any required notices to submit Customer Data, and that your instructions comply with applicable data protection laws.

• Encryption of Customer Data in transit and at rest.
• Access controls based on least privilege, with authentication and logging.
• Network and application security controls, and monitoring for unauthorized access.
• Separation of customer environments, including separate test and live data.
• Backup and recovery procedures, and vulnerability management.
• Security training for personnel with access to Customer Data.

We may update these measures as long as the overall level of protection is not materially reduced.

You authorize us to use subprocessors to deliver the Service, such as cloud hosting, database, and email providers. We will impose data protection obligations on each subprocessor that are no less protective than those in this DPA, and we remain responsible for their performance.

A current list of subprocessors is available on request. We will give notice of new subprocessors at least 30 days before they process Customer Data. You may object on reasonable data protection grounds within that period, and we will work with you in good faith to resolve the objection.

Where the processing of Customer Data involves a transfer out of the EEA, UK, or Switzerland to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses (and the UK Addendum or Swiss amendments where relevant) apply and are incorporated by reference. You are the exporter and we are the importer, using Module Two (controller to processor) or Module Three (processor to processor) as applicable.

We will notify you without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will include the information we then have to help you meet your own notification duties, and we will keep you updated as we learn more.

If we receive a request directly from one of your data subjects about Customer Data, we will refer it to you unless the law requires otherwise. Taking into account the nature of the processing, we will help you respond through the Service’s features or by reasonable additional assistance.

On request, we will provide information reasonably necessary to show compliance with this DPA, such as security documentation or summaries of independent assessments. If that is not enough to satisfy a legal requirement, you may audit us, no more than once a year and with reasonable notice, during business hours, under confidentiality terms, and without disrupting our operations or the data of others.

After the Terms end, we will delete or return Customer Data within a reasonable period, not exceeding 90 days, unless the law requires us to keep it. Backups are deleted on their normal cycle.

The limits of liability in the Terms apply to this DPA. If there is a conflict between this DPA and the Terms about processing of personal data, this DPA applies. If there is a conflict with the Standard Contractual Clauses, the Clauses apply.

This DPA applies automatically when you accept the Terms. If you need a countersigned copy or have questions, use the contact page linked below.