Data Processing Addendum

1.1 Scope. This DPA applies to the processing of Personal Data (or Personal Information) submitted by Customer to the Service under the Agreement.

1.2 Roles. For CCPA and CPRA purposes, Company acts as a Service Provider. For GDPR and UK GDPR purposes, Customer acts as Controller (or Processor) and Company acts as Processor (or Subprocessor).

2.1 Compliance with Instructions. Processor shall process Personal Data solely on documented instructions from Controller, including for performance of the Service as described in the Agreement.

2.2 CCPA Restrictions. Processor shall not: (a) “sell” or “share” Personal Information; (b) retain, use, or disclose Personal Information for any purpose other than the business purposes specified in the Agreement; or (c) combine Personal Information with data received from other sources except as expressly permitted under CPRA regulations.

2.3 Confidentiality. Processor shall ensure that personnel authorized to process Personal Data are bound by enforceable statutory or contractual confidentiality obligations.

2.4 Notification and Monitoring. Processor shall notify Controller without undue delay if it determines that it can no longer meet its obligations under the CCPA or CPRA, and shall permit Controller to take reasonable and appropriate steps to monitor Processor’s compliance with this DPA, including by way of the documentation and responses described in Section 6.2.

3.1 Technical and Organizational Measures. Processor implements technical and organizational measures appropriate to the risk, which presently comprise:

• Separation of customers in the schema. Every customer-owned table carries the tenant identifier as the leading column of its primary key or as a NOT NULL foreign key, and every cross-table foreign key is composite on that identifier, so the database refuses a row that references another customer’s record even where application code is wrong. Each request is additionally scoped to the acting customer and authorized per customer.
• Encryption in transit. Connections are served over TLS; the application’s database connection negotiates TLS 1.3 and verifies the server certificate against a pinned certificate authority, and refuses to start rather than falling back to an unverified connection.
• Encryption at rest. Database backups are encrypted with AES-256-GCM using a key held by the operator and not stored with the backup. Storage-level encryption at rest is provided by the hosting platform.
• Least privilege and deny by default. Database privileges are granted to the application role only; the hosting platform’s general-purpose roles hold no privilege on application tables, and row-level security is enabled on every application table with no permissive policy, so those roles are denied by default. Row-level security is a backstop against platform roles and is not the mechanism by which customers are separated from one another.
• Audit logging. Access decisions and state transitions are written to an append-only audit log naming the acting user, with sensitive values redacted before they reach a log or an operator diagnostic.

3.2 Incident Response. Processor will notify Controller without undue delay, and within forty-eight (48) hours of becoming aware of a confirmed Personal Data Breach affecting Customer’s data, providing the information reasonably available to it at that time and supplementing it as the investigation proceeds. Where an incident involves PHI, the notification obligations of the Business Associate Agreement apply in addition to this Section.

3.3 Changes to Measures. Processor may update the measures described in Section 3.1 provided that no update materially reduces the overall level of protection afforded to Personal Data.

4.1 Authorization and Notice. Controller grants general authorization for Processor to engage Subprocessors, including hosting and cloud infrastructure providers. A current list of Subprocessors is available on written request to privacy@tallyvant.com. Processor will give Controller notice before a new Subprocessor begins processing Personal Data, and Controller may object on reasonable data protection grounds within fourteen (14) days of that notice. Where an objection cannot be resolved, Controller may terminate the affected part of the Service without penalty.

4.2 Flow-Down Requirements. Processor shall execute written agreements with Subprocessors imposing data protection obligations no less protective than those herein, and remains responsible for a Subprocessor’s performance of those obligations.

To the extent processing involves transfers of Personal Data outside the European Economic Area, the United Kingdom, or Switzerland to countries not recognized as providing adequate protection, the parties hereby incorporate the EU Standard Contractual Clauses (Module 2 Controller-to-Processor, or Module 3 Processor-to-Processor as applicable) and the UK International Data Transfer Addendum, which shall control over any conflicting provisions of this DPA.

6.1 Data Return and Deletion. Upon account closure, Customer Data is exportable for thirty (30) days, after which Processor shall permanently delete or de-identify Personal Data within sixty (60) days, in alignment with Section 6.5 of the Terms of Use and Section 4 of the Privacy Notice.

6.2 Audits and Documentation. Processor shall make available to Controller the information necessary to demonstrate compliance with Article 28 of the GDPR. That information presently comprises Processor’s published security documentation, the description of measures in Section 3.1, and written responses to Controller’s reasonable security questionnaires. Processor holds no SOC 2 report, HIPAA attestation, or independent third-party security audit, and makes no representation that it does; where Processor obtains such a report, it will make the report or its summary available to Controller on request, subject to confidentiality. Where the documentation available is insufficient for Controller to demonstrate compliance, Controller may request an audit no more than once in any twelve-month period, on thirty (30) days’ notice, at Controller’s cost and subject to confidentiality.

7.1 Incorporation. This DPA supplements and is incorporated into the Agreement. Section 17 of the Terms of Use (Governing Law and Dispute Resolution) applies to this DPA, save that nothing in it displaces a mandatory provision of the Standard Contractual Clauses.

7.2 Order of Precedence. In the event of conflict, the following order applies: the Standard Contractual Clauses, then this DPA, then the Terms of Use. As to PHI, the Business Associate Agreement controls over this DPA.