1. Definitions

• Personal Data: Information relating to an identified or identifiable natural person.
• Processing: Any operation performed on Personal Data (e.g., collection, storage, use, disclosure, deletion).
• Controller: Entity that determines purposes and means of processing (Customer).
• Processor: Entity that processes Personal Data on behalf of the Controller (Screenvault).
• Sub-Processor: Third party engaged by Screenvault to process Personal Data for Customer.

2. Scope & Roles

Customer acts as Controller and Screenvault acts as Processor. Screenvault processes Personal Data only as necessary to provide the Service and in accordance with Customer’s documented instructions.

3. Customer Responsibilities

• Obtain and maintain all notices, consents, and legal bases required to provide Personal Data to Screenvault.
• Avoid using the Service to process Special Categories of Personal Data unless permitted by law and explicitly agreed with Screenvault.

4. Screenvault Responsibilities

• Process Personal Data only on documented instructions from Customer.
• Ensure personnel authorized to process Personal Data are subject to confidentiality obligations.
• Maintain appropriate technical and organizational measures to protect Personal Data.
• Notify Customer without undue delay upon becoming aware of a Personal Data Breach affecting Customer Personal Data.

5. Sub-Processors

Customer authorizes Screenvault to use Sub-Processors to provide the Service. A current list of Sub-Processors is maintained at [Insert URL]. Screenvault will impose data protection obligations on Sub-Processors equivalent to those in this DPA.

6. International Transfers

Personal Data may be transferred and processed outside the EEA/UK/California, including in the United States. Where required, Screenvault implements appropriate safeguards such as the EU Standard Contractual Clauses (SCCs).

7. Data Subject Rights

Taking into account the nature of processing, Screenvault will assist Customer, where reasonably possible, in responding to data subject requests (e.g., access, correction, deletion, portability) under GDPR/CCPA. Screenvault will not respond directly without Customer authorization unless legally required.

8. Security & Breach Notification

Screenvault maintains administrative, technical, and physical safeguards appropriate to the risk. In the event of a confirmed Personal Data Breach, Screenvault will notify Customer promptly with information sufficient for Customer to meet legal obligations.

9. Return or Deletion of Data

Upon termination or expiration of the Agreement, Screenvault will, at Customer’s choice, return or delete Personal Data, unless retention is required by law.

10. Audits

Screenvault will make available documentation necessary to demonstrate compliance with this DPA. Customer may request audits subject to reasonable notice, frequency limits, and confidentiality obligations.

11. Liability

Each party’s liability under this DPA is subject to the limitations of liability in the main Agreement (Terms of Service).

12. Governing Law

This DPA is governed by the laws of the State of Delaware, consistent with the Agreement.