Data Processing Addendum

Overview

This Data Processing Addendum (“DPA”) forms part of the service agreement between SoftDAB (“Processor”) and you (“Controller”) for the provision of software development services. This DPA governs the processing of Personal Data (as defined in the GDPR) in connection with our services.

1. Definitions

• "Controller" means the entity that determines the purposes and means of processing Personal Data.
• "Processor" means SoftDAB, which processes Personal Data on behalf of the Controller.
• "Personal Data" has the meaning set forth in the GDPR.
• "Processing" has the meaning set forth in the GDPR.
• "Data Subject" has the meaning set forth in the GDPR.
• "GDPR" means the General Data Protection Regulation (EU) 2016/679.

2. Processing Details

Subject Matter

The processing relates to the provision of software development services including custom application development, dedicated team services, and related technical services.

Duration

Processing will occur for the duration of the service agreement and may continue as necessary for legal compliance or legitimate business purposes.

Nature and Purpose

Processing is necessary to:

• Provide software development services
• Manage project communications and deliverables
• Ensure system security and functionality
• Comply with legal and contractual obligations

Categories of Data

• Contact information (names, email addresses, phone numbers)
• Professional information (job titles, company details)
• Project-related communications and documents
• Technical data necessary for service provision
• Usage and analytics data

Categories of Data Subjects

• Client employees and representatives
• End users of developed applications
• Website visitors

3. Processor Obligations

SoftDAB agrees to:

• Process Personal Data only as instructed by the Controller
• Ensure personnel processing data are bound by confidentiality
• Implement appropriate technical and organizational security measures
• Assist with data subject rights requests
• Notify of personal data breaches without undue delay
• Delete or return data upon termination of services
• Maintain records of processing activities
• Cooperate with supervisory authority investigations

4. Security Measures

We implement appropriate technical and organizational measures including:

Technical Measures

• Encryption of data in transit and at rest
• Access controls and authentication
• Regular security monitoring and logging
• Secure development practices
• Regular security updates and patches

Organizational Measures

• Staff security training and awareness
• Confidentiality agreements for all personnel
• Incident response procedures
• Regular security assessments
• Data protection impact assessments when required

5. Sub-processors

We may engage sub-processors to assist in providing services. Current sub-processors include:

• Cloud Hosting Providers: AWS, Microsoft Azure (for infrastructure)
• Communication Tools: Slack, Microsoft Teams (for project communication)
• Development Tools: GitHub, Jira (for code and project management)

We will notify you of any changes to sub-processors and ensure they are bound by equivalent data protection obligations.

6. Data Transfers

Personal Data may be transferred outside the EEA to countries that do not provide adequate protection. In such cases, we implement appropriate safeguards such as Standard Contractual Clauses or rely on adequacy decisions by the European Commission.

7. Data Subject Rights

We will assist you in responding to data subject requests including:

• Access to personal data
• Rectification of inaccurate data
• Erasure of personal data
• Restriction of processing
• Data portability
• Objection to processing

8. Data Breach Notification

In case of a personal data breach, we will notify you without undue delay and no later than 72 hours after becoming aware of the breach. We will provide all information necessary for you to assess the breach and comply with notification requirements.

9. Audits and Inspections

We will provide reasonable cooperation for audits and inspections by you or an independent auditor to verify compliance with this DPA. Audit costs are borne by the requesting party unless non-compliance is found.

10. Liability and Indemnification

Each party's liability is limited as set forth in the main service agreement. We will indemnify you against claims arising from our non-compliance with this DPA, subject to the limitations in the main agreement.

11. Contact Information

For DPA-related questions or to exercise data subject rights: