Data Processing Agreement (DPA)

1. Definitions

2. Scope and Application

This DPA applies to all processing of Personal Data by SuprAgent AI on behalf of the Customer in connection with the Services. This DPA forms part of the Terms of Service and takes precedence over any conflicting terms regarding data processing.

By using our Services, the Customer (as Controller) appoints SuprAgent (as Processor) to process Personal Data in accordance with this DPA and applicable Data Protection Laws.

3. Roles and Responsibilities

3.1 Customer (Controller) Responsibilities

The Customer, as Controller, is responsible for:

• Determining the purposes and means of processing Personal Data
• Ensuring lawful basis for processing under applicable Data Protection Laws
• Obtaining necessary consents and providing required notices to data subjects
• Ensuring the accuracy and legality of Personal Data provided to SuprAgent
• Responding to data subject requests and exercising their rights
• Instructing SuprAgent on data processing activities

3.2 SuprAgent (Processor) Responsibilities

SuprAgent, as Processor, agrees to:

• Process Personal Data only on documented instructions from the Customer
• Ensure personnel authorized to process Personal Data are bound by confidentiality
• Implement appropriate technical and organizational security measures
• Assist the Customer in responding to data subject requests
• Assist the Customer with data protection impact assessments when required
• Notify the Customer of any Personal Data breaches without undue delay
• Delete or return Personal Data upon termination or request
• Make available information necessary to demonstrate compliance

4. Details of Processing

5. Security Measures

SuprAgent implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

5.1 Technical Measures

• Encryption: AES-256 encryption at rest, TLS 1.3 in transit
• Access Controls: Role-based access control (RBAC) and multi-factor authentication
• Network Security: Firewalls, intrusion detection, DDoS protection
• Monitoring: 24/7 security monitoring and logging
• Vulnerability Management: Regular security scanning and penetration testing
• Data Isolation: Logical separation of customer data

5.2 Organizational Measures

• Employee Training: Regular security and privacy training for all personnel
• Background Checks: Screening of personnel with access to Personal Data
• Confidentiality: Binding confidentiality obligations for all personnel
• Incident Response: Documented procedures for security incident response
• Business Continuity: Backup and disaster recovery procedures
• Compliance: SOC 2 Type II certification (in progress)

6. Sub-processors

6.1 Authorization

The Customer provides general authorization for SuprAgent to engage Sub-processors to process Personal Data. SuprAgent will maintain an up-to-date list of Sub-processors on our website.

6.2 Current Sub-processors

6.3 Sub-processor Obligations

SuprAgent ensures that:

• Sub-processors are bound by data protection obligations equivalent to this DPA
• Appropriate contracts are in place with all Sub-processors
• SuprAgent remains fully liable for Sub-processor performance

6.4 Changes to Sub-processors

SuprAgent will notify the Customer of any intended changes to Sub-processors at least 30 days in advance. If the Customer objects on reasonable data protection grounds, the parties will work together to find a resolution or the Customer may terminate the affected Services.

7. Data Subject Rights

SuprAgent will assist the Customer in fulfilling data subject requests, including:

• Access: Providing copies of Personal Data
• Rectification: Correcting inaccurate data
• Erasure: Deleting Personal Data (right to be forgotten)
• Restriction: Restricting processing in certain circumstances
• Portability: Exporting data in machine-readable format
• Objection: Objecting to certain processing activities

If SuprAgent receives a data subject request directly, we will promptly forward it to the Customer. The Customer is responsible for responding to data subject requests within the legally required timeframes.

8. Data Breach Notification

SuprAgent will:

• Notify the Customer without undue delay upon becoming aware of a Personal Data breach
• Provide sufficient information to enable the Customer to meet any obligations to report or notify the breach
• Include details about the nature of the breach, categories and numbers of data subjects affected, and measures taken
• Cooperate with the Customer and regulatory authorities in investigating and resolving the breach

Notification will be made to the Customer's designated contact email within 72 hours of SuprAgent becoming aware of the breach.

9. International Data Transfers

Personal Data may be transferred to and processed in countries outside the EEA. SuprAgent ensures appropriate safeguards are in place:

• Standard Contractual Clauses: We use EU-approved Standard Contractual Clauses for transfers outside the EEA
• Adequacy Decisions: We rely on EU adequacy decisions where applicable
• Data Residency: Enterprise customers can choose data storage locations
• Self-Hosting: Option to host entirely within Customer's jurisdiction

10. Data Retention and Deletion

10.1 Retention

SuprAgent retains Personal Data only for as long as necessary to provide the Services or as instructed by the Customer. Default retention periods:

• Conversation data: 30 days (configurable up to 2 years)
• Account data: Duration of Services plus 90 days
• Backup data: 30 days

10.2 Deletion

Upon termination or expiration of Services, or upon Customer request, SuprAgent will:

• Provide Customer 30 days to export their data
• Delete or return all Personal Data as instructed by Customer
• Certify deletion upon request
• Delete data from backups within standard backup retention period (30 days)

SuprAgent may retain data if required by applicable law, provided such data is kept confidential and processed only for legal compliance purposes.

11. Audits and Compliance

SuprAgent will:

• Make available information necessary to demonstrate compliance with this DPA
• Allow for and contribute to audits by the Customer or appointed auditor
• Provide audit reports (e.g., SOC 2) upon request
• Respond to Customer's reasonable information requests within 30 days

Audit rights may be exercised upon reasonable notice and during regular business hours, subject to confidentiality obligations and reasonable restrictions to protect SuprAgent's infrastructure and other customers' data.

12. Liability and Indemnification

Each party's liability under this DPA is subject to the limitation of liability provisions in the Terms of Service. SuprAgent is liable to the Customer for damages caused by failure to comply with this DPA, subject to such limitations.

SuprAgent will indemnify the Customer against fines imposed by supervisory authorities to the extent such fines result from SuprAgent's breach of its obligations under this DPA.

13. Term and Termination

This DPA remains in effect for as long as SuprAgent processes Personal Data on behalf of the Customer. Upon termination of the Services, the data deletion provisions in Section 10 apply.

14. Governing Law and Jurisdiction

This DPA is governed by the same laws as the Terms of Service. For EEA customers, this DPA is also governed by the data protection laws of the EEA, including GDPR.

15. Contact Information

For DPA-related questions or requests: