Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between the Organisation subscribing to an ArmiHQ organisational plan ("Controller") and ArmiHQ, operated by its owner ("Processor") and governs the processing of personal data by the Processor on behalf of the Controller.

This DPA is incorporated into and forms part of the ArmiHQ Terms of Service. By accepting the Terms of Service, the Controller accepts this DPA.

• ▸"Personal Data" means any data processed by the Processor on behalf of the Controller under this DPA;
• ▸"Processing" has the meaning given in Article 4(2) GDPR;
• ▸"Sub-processor" means any third party engaged by the Processor to process Personal Data on the Controller's behalf;
• ▸"Standard Contractual Clauses" means the standard data protection clauses for international transfers adopted by the European Commission.

The Controller warrants and undertakes that:

• ▸It has a valid legal basis for all processing it instructs the Processor to carry out;
• ▸It has provided all required notices and obtained all required consents from data subjects;
• ▸Its instructions to the Processor are lawful and comply with applicable data protection law;
• ▸It will maintain its own records of processing activities as required by Article 30 GDPR.

The Processor shall:

• ▸Process Personal Data only on documented instructions from the Controller;
• ▸Ensure authorised persons are subject to appropriate confidentiality obligations;
• ▸Implement appropriate technical and organisational security measures;
• ▸Assist the Controller in fulfilling data subject rights requests within GDPR timeframes;
• ▸Assist the Controller with breach notification, DPIAs, and prior consultation obligations;
• ▸At the choice of the Controller, delete or return all Personal Data at the end of the term;
• ▸Immediately inform the Controller if an instruction infringes applicable data protection law.

The Controller grants general authorisation for the Processor to engage Sub-processors. Current Sub-processors:

The Processor shall notify the Controller of any intended Sub-processor changes with 30 days notice. The Controller may object within 15 days.

• ▸AES-256 encryption of all personal data at rest;
• ▸TLS 1.3 encryption of all personal data in transit;
• ▸Row Level Security policies enforcing data isolation between Controllers at database level;
• ▸Access controls limiting database access to authorised personnel;
• ▸Signed URL access control for all private file storage;
• ▸Audit logging of all data access and modifications;
• ▸Regular backups with point-in-time recovery.

• ▸Notify the Controller without undue delay and within 48 hours of becoming aware of the breach;
• ▸Provide sufficient information for the Controller to meet its 72-hour notification obligation under Article 33 GDPR;
• ▸Cooperate fully in investigating the breach and mitigating its effects.

• ▸The Controller has 30 days post-termination to export all Personal Data;
• ▸After 30 days, the Processor will permanently delete all Controller Personal Data from live systems;
• ▸Backup copies will be purged within 90 days;
• ▸Written confirmation of deletion provided upon request;
• ▸Data required by law will be held in isolated archive for compliance purposes only.

This DPA is governed by the laws of Malta. Acceptance of the ArmiHQ Terms of Service constitutes acceptance of this DPA. No physical signature is required.