Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Controller") and Newempo LLC, 30 N Gould St #40045, Sheridan, WY 82801, USA ("Processor") and applies to the extent the Processor processes Personal Data on the Controller's behalf under the GDPR, the UK GDPR, and comparable data protection laws.

1. Definitions

"Personal Data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings given in the GDPR. "Customer Data" means the data the Controller submits to the Service.

2. Roles and scope

The Controller determines the purposes and means of processing Customer Data. The Processor processes Personal Data only to provide the Service and solely on the Controller's documented instructions, including as set out in the Terms, this DPA, and the Controller's use of the Service. The Processor will inform the Controller if, in its opinion, an instruction infringes applicable data protection law.

3. Subject matter, duration, nature and purpose

Subject matter: provision of the ExpirySuite service for tracking, collecting, reviewing, and renewing documents. Duration: for the term of the Terms. Nature and purpose: storage and organization of records and documents; expiry and renewal tracking; evaluation of the requirements the Controller defines and display of the resulting operational statuses and reports; sending reminder and document request emails; collection of documents from recipients through request links and their review by the Controller; automated reading of uploaded documents to suggest document types and dates; and related processing. Types of Personal Data: identity and contact details, document types and dates, the contents of uploaded files (which may include identity, immigration, licensing, or health documents), and the email addresses of document request recipients together with the status of their requests. Categories of data subjects: the Controller's employees, contractors, and other individuals whose documents the Controller tracks, including people from whom the Controller requests documents, who may not have an account.

4. Confidentiality

The Processor ensures that persons authorized to process Personal Data are bound by confidentiality obligations and process the data only as instructed.

5. Security measures

The Processor implements appropriate technical and organizational measures, including: encryption of uploaded files at rest; access to files only via short-lived signed links; logical isolation of each organization's data; least-privilege access controls and authentication; audit logging of document changes and reminders; and regular review of these measures. The Controller is responsible for the security of its own credentials and endpoints.

6. Sub-processors

The Controller authorizes the Processor to engage sub-processors to provide the Service, currently including EU cloud hosting/database, object storage (Cloudflare R2), transactional email (Resend), SMS and WhatsApp messaging (Twilio, and Meta Platforms for WhatsApp; only for users who opt in to SMS or WhatsApp reminders; messages contain the person or asset name, document name and expiry date), web push notifications (the browser vendor's push service, only for devices where a user turns them on; content is encrypted end to end), payment processing (Stripe), and an AI provider used only to suggest document types and dates from uploaded documents (including documents uploaded through document requests) and to turn a dictated sentence into form fields. The Processor imposes data protection obligations on sub-processors substantially similar to those in this DPA and will give the Controller reasonable notice of intended changes, allowing the Controller to object on reasonable data-protection grounds.

7. Data subject requests

Taking into account the nature of the processing, the Processor will assist the Controller by appropriate technical and organizational measures, insofar as possible, to respond to requests from data subjects exercising their rights. If the Processor receives such a request directly, it will refer the data subject to the Controller.

8. Personal data breaches

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Data, and will provide information reasonably available to assist the Controller in meeting its notification obligations.

9. Assistance

The Processor will provide the Controller with reasonable assistance for data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of processing and information available to the Processor.

10. International transfers

Where the Processor transfers Personal Data outside the EEA/UK, it does so under the European Commission's Standard Contractual Clauses (module Controller-to-Processor) and the UK International Data Transfer Addendum where applicable, together with appropriate supplementary measures.

11. Return and deletion

On termination of the Service, or on the Controller's request, the Processor will delete or return Customer Data and delete existing copies within 30 days, unless retention is required by law.

12. Audits

The Processor will make available information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Controller or a mandated auditor, on reasonable prior notice, subject to confidentiality and no more than once per year absent a specific concern or legal requirement.

13. Liability and precedence

Each party's liability under this DPA is subject to the limitations set out in the Terms. In case of conflict between this DPA and the Terms regarding the processing of Personal Data, this DPA prevails.