Data Processing Agreement

Introduction

This Data Processing Agreement ("DPA") supplements our Terms and Conditions and Privacy Policy. It applies when Betajob AS (org. nr. 999 153 976), doing business as compliance.tf ("we," "us," "Processor"), processes personal data on behalf of the customer ("you," "Controller") in connection with the Service. This DPA is effective as of the date you agree to our Terms and Conditions.

Definitions

Controller

the entity that determines the purposes and means of processing personal data - in this context, you, the customer.

Processor

the entity that processes personal data on behalf of the Controller - in this context, Betajob AS.

Sub-processor

a third party engaged by the Processor to process personal data on behalf of the Controller.

Personal Data

any information relating to an identified or identifiable natural person.

Processing

any operation performed on personal data, including collection, storage, use, disclosure, and deletion.

SCCs

Standard Contractual Clauses adopted by the European Commission for international data transfers.

Scope and Roles

Betajob AS acts as a data processor when processing personal data on your behalf through the Service. You, the customer, act as the data controller and determine the purposes and means of processing. This DPA covers all personal data processed in connection with your use of compliance.tf.

Processing Details

The following table describes the personal data processing carried out under this agreement.

Your owners and administrators can export your organization's registry download records. Where you ask us to, we also record the IP address your organization's downloads through our registry API came from; we set this up during enterprise onboarding. Without that request we record no IP address for your downloads, and exports include no IP fields. Where we record it, the full address is kept for 90 days from the download, then deleted; removal normally completes within 7 days. The same applies to copies of the full address in our queues and logs. Download records keep only its network (the first three parts of an IPv4 address, or the first 48 bits of an IPv6 address). Backups of the download record store contain no full IP addresses. Exports include the full address for 90 days after the download, and the network for the life of the record; this is part of the processing we do on your behalf. You also allow us to use these addresses, within the same 90 days, to keep the Services secure and to investigate security incidents and abuse; for that use we act as a controller under our Privacy Notice. Exported copies are held by you under your own policies.

Customer Obligations

As the data controller, you're responsible for:

• Ensuring you have a lawful basis for processing personal data through the Service
• Practicing data minimization - only providing personal data that's necessary for the Service
• Informing data subjects about the processing, including by referencing this DPA and our Privacy Policy
• Promptly notifying us if any data subject's instructions conflict with applicable law
• Informing the people in your organization where download records concern them. These records can show which member, or which of your tokens, downloaded which module, when, and, where you asked us to record it, from which IP address and network. You are responsible for following the employment and monitoring rules that apply to you

Processor Obligations

We commit to:

• Processing personal data only on your documented instructions, unless required by law
• Ensuring that personnel authorized to process personal data are bound by confidentiality obligations
• Assisting you with data subject access requests (DSARs) and other rights requests
• Notifying you of any personal data breach without undue delay, and in any event within 72 hours
• Returning or deleting personal data at the end of the service relationship, at your choice
• Making available all information necessary to demonstrate compliance with this DPA

Sub-processors

We use the following sub-processors to deliver the Service. You authorize us to engage these sub-processors, and we remain responsible for their compliance with this DPA.

If we need to add or replace a sub-processor, we'll give you at least 30 days' notice. If you object to a new sub-processor, you may terminate the affected services by notifying us before the sub-processor begins processing. We'll work with you in good faith to find an alternative solution where possible.

Security Measures

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption in transit (TLS 1.2 or higher for all connections)
• Encryption at rest (AES-256 via AWS KMS for all stored data)
• Access controls (IAM policies with least-privilege principles)
• No shared credentials - individual access for all personnel
• Audit logging for all access to personal data
• Regular security reviews and vulnerability assessments

For more details on our security practices, see our Security page.

International Transfers

Personal data may be transferred outside the European Economic Area (EEA) and the United Kingdom (UK). For these transfers, we rely on:

• Standard Contractual Clauses (SCCs) - Module 2 (Controller to Processor) as adopted by the European Commission
• AWS's certification under the EU-US Data Privacy Framework

Data is primarily processed in AWS us-east-1 (US) and eu-west-1 (Ireland). We've assessed the data protection laws of these jurisdictions and have implemented appropriate supplementary measures, including encryption and access controls.

Data Subject Rights

We'll assist you in responding to data subject requests, including requests for access, correction, deletion, portability, and objection.

When we receive a request directly from a data subject, we'll redirect them to you unless you've instructed us otherwise.

We'll respond to your assistance requests within 30 days.

Breach Notification

In the event of a personal data breach, we'll notify you without undue delay, and in any event within 72 hours of becoming aware of it. Our notification will include:

• The nature of the breach, including the categories and approximate number of data subjects affected
• The name and contact details of our point of contact
• The likely consequences of the breach
• The measures we've taken or propose to take to address the breach and mitigate its effects

Data Return and Deletion

When the service agreement ends:

• You may request a copy of your personal data within 30 days of termination
• We'll delete all personal data within 90 days of termination, unless retention is required by law or your agreement instructs us to keep your registry download audit record for a set period. In that case we keep the download audit record, and no other personal data beyond what the law requires, until each record reaches the end of the period in your agreement, counted from its download, and then delete it
• We'll provide written certification of deletion upon request

Data in backups will be deleted according to our standard backup rotation schedule, and we'll isolate it from further processing in the meantime. The download record store can be restored to any point in the last 35 days, so a deleted record leaves its backups 35 days after deletion, including after termination.

Audit Rights

You have the right to audit our compliance with this DPA. We make our SOC 2 reports and other compliance documentation available through our Trust Center.

If you require additional audit measures beyond what's available through our Trust Center, we can arrange on-site or remote audits with reasonable advance notice and during business hours. You'll bear the costs of any such audit.

Liability

Each party's liability under this DPA is subject to the limitations set out in our Terms and Conditions.

Nothing in this DPA excludes or limits liability for breaches that can't be limited by law.

Term

This DPA is effective for the duration of your service agreement with us. Provisions relating to data return, deletion, and confidentiality survive termination.

If we're still processing personal data on your behalf after termination (for example, during the deletion period), the terms of this DPA continue to apply until processing is complete.