Data processing addendum

1. Scope and roles

This Data Processing Addendum (“DPA”) forms part of the agreement between Entatan LLC (“Entatan”) and the partner named in the statement of work (“Partner”). It applies where Entatan processes personal data on Partner's behalf. For that data, Partner is the controller (or a processor acting for its own controller) and Entatan is the processor.

This DPA does not apply to personal data Entatan processes for its own purposes, such as partner contact details, which are covered by our Privacy Policy.

2. Definitions

“Personal data”, “processing”, “controller”, “processor”, “data subject”, and “supervisory authority” have the meanings given in applicable data protection law, including the GDPR, the UK GDPR, and US state privacy laws. “Subprocessor” means a third party engaged by Entatan to process Partner personal data. “Security incident” means a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Partner personal data.

3. Details of processing

Unless the SOW says otherwise:

• Subject matter: the services described in the SOW (software engineering, agent deployment, creative, marketing).
• Duration: the term of the SOW plus the deletion period below.
• Nature and purpose: hosting, building, testing, migrating, analyzing, and operating systems and campaigns for Partner.
• Categories of data subjects: Partner's customers, prospects, users, employees, and contractors.
• Categories of personal data: contact details, account and usage data, transaction data, support content, and any other data Partner directs us to process. Special-category data only where the SOW says so.

4. Processing instructions

Entatan processes Partner personal data only on Partner's documented instructions, which include the SOW, client portal messages, and this DPA, unless required by law. In that case we will tell Partner before processing where legally permitted. We will tell Partner if an instruction appears to violate data protection law. Partner is responsible for the lawfulness of the data it provides and the instructions it gives.

5. Confidentiality and personnel

Entatan limits access to Partner personal data to personnel and contractors who need it for the engagement and who are bound by written confidentiality obligations. Personnel receive data protection and security training appropriate to their role.

6. Security measures

Entatan implements technical and organizational measures appropriate to the risk, including encryption in transit and at rest; least-privilege, role-based access with multi-factor authentication; separate environments per partner engagement; secret management and scanning; logging and monitoring; secure development practices with code review; and tested backup and recovery. Details are on the security page. Partner is responsible for security in systems it controls, including the credentials it issues to us.

7. Subprocessors

Partner authorizes Entatan to use the subprocessors listed on our subprocessor page. We will give at least 15 days' notice of a new subprocessor by updating that page and notifying client portal users. Partner may object on reasonable data protection grounds within that window. If we cannot resolve the objection we will either avoid the subprocessor for Partner's data or allow Partner to terminate the affected SOW without penalty. Entatan remains responsible for its subprocessors' performance.

8. Assistance and data subject requests

Taking into account the nature of the processing, Entatan will assist Partner in responding to data subject requests, conducting data protection impact assessments, and consulting supervisory authorities. If a data subject contacts us directly about Partner data we will refer them to Partner and not respond substantively unless Partner instructs us to. Assistance beyond what is reasonable may be charged at our standard rates.

9. Security incidents

Entatan will notify Partner without undue delay, and in any event within 72 hours, after confirming a security incident affecting Partner personal data. The notice will describe what we know: the nature of the incident, the categories and approximate numbers of data subjects and records, likely consequences, and measures taken or proposed. Entatan will cooperate with Partner's investigation and any required notifications. Notification is not an admission of fault.

10. Transfers, audits, deletion, and liability

Entatan processes data in the United States. For data originating in the EEA, UK, or Switzerland, the parties rely on the standard contractual clauses (module two or three, as applicable) and the UK addendum, which are incorporated by reference, with Partner as data exporter and Entatan as data importer.

Entatan will make available the information necessary to demonstrate compliance and will allow audits, at most once per year unless required by a regulator or following a security incident, with reasonable notice and under confidentiality.

Within 30 days after the SOW ends, Entatan will delete or return Partner personal data at Partner's choice, except where the law requires retention or data is held in backups that expire on their normal schedule. Liability under this DPA is subject to the limits in the Partner Terms.