Seros, LLCData Processing Addendum
Effective date: [[EFFECTIVE_DATE]]
This Data Processing Addendum (the "DPA") forms part of the Terms of Service or other written agreement (the "Agreement") between Seros, LLC ("Processor", "we") and the customer identified in the Agreement ("Controller", "you"). It applies where we process personal data on your behalf in providing the Service.
If the Agreement and this DPA conflict on the processing of personal data, this DPA wins.
1. Definitions
Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR. "Data Protection Laws" means all laws applicable to the processing under this DPA, including the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and other US state privacy laws as they apply.
"Customer Personal Data" means personal data contained in Customer Data. "SCCs" means the Standard Contractual Clauses annexed to European Commission Implementing Decision (EU) 2021/914. "UK Addendum" means the UK Information Commissioner's International Data Transfer Addendum to the SCCs, version B1.0. "Subprocessor" means a processor we engage to process Customer Personal Data.
2. Roles of the parties
2.1 For Customer Personal Data, you are the controller (or a processor acting for another controller) and we are the processor (or subprocessor). If you are acting as a processor for a third-party controller, you confirm you have authority to give the instructions in this DPA on that controller's behalf.
2.2 For our own account, billing, security and telemetry data about you and your users, we are a controller and our Privacy Policy applies.
2.3 Under the CCPA/CPRA we are a "service provider". We will not sell or share Customer Personal Data, will not retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, will not use it outside the direct business relationship between us, and will not combine it with personal information from other sources except as permitted for a service provider. We certify that we understand and will comply with these restrictions.
3. Processing instructions
3.1 We will process Customer Personal Data only on your documented instructions. The Agreement, this DPA, your configuration of the Service, and the connections you authorise are your complete instructions.
3.2 We will tell you if, in our opinion, an instruction infringes Data Protection Laws. We may suspend processing of an instruction we reasonably believe is unlawful until it is resolved.
3.3 If a law requires us to process beyond your instructions, we will inform you before processing unless that law prohibits it on important grounds of public interest.
3.4 You are responsible for the lawfulness of the personal data you submit, for having a legal basis, for giving required notices to data subjects, and for the accuracy of the data.
4. Confidentiality
We will ensure that personnel authorised to process Customer Personal Data are bound by written confidentiality obligations or an appropriate statutory duty, are trained on data protection, and have access limited to what their role requires.
5. Security
5.1 We will implement and maintain the technical and organisational measures described in Annex II, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risk to individuals.
5.2 We may update the measures over time. We will not materially reduce the overall level of protection during a paid subscription term.
5.3 We do not hold SOC 2, ISO 27001 or any other security certification and this DPA should not be read as claiming one.
6. Subprocessors
6.1 You give general written authorisation for us to engage Subprocessors. The current list is at SUBPROCESSORS.md, which also explains how to subscribe to change notifications.
6.2 We will impose data protection obligations on each Subprocessor that are no less protective than those in this DPA, and we remain fully liable to you for a Subprocessor's performance.
6.3 Change notice. We will give at least 30 days' notice before a new Subprocessor starts processing Customer Personal Data, by email to subscribers of the list. You may object on reasonable data protection grounds within 15 days. If you object, we will work in good faith to offer a change in configuration or an alternative. If we cannot within a reasonable time, you may terminate the affected subscription and receive a pro-rata refund of prepaid, unused fees, as your sole remedy.
6.4 Where a change is needed urgently to protect security or continuity, we may appoint a Subprocessor first and notify promptly afterwards, with the same objection right applying from the date of notice.
7. Assistance with data subject requests
7.1 The Service gives you controls to access, correct, export and delete Customer Personal Data yourself. You should use them first.
7.2 If a data subject contacts us directly about Customer Personal Data, we will not respond substantively; we will forward the request to you promptly, unless legally prohibited.
7.3 Taking into account the nature of the processing, we will help you respond to requests under Data Protection Laws by appropriate technical and organisational measures, insofar as this is possible. Assistance beyond the Service's own features may be charged at $150 per hour where the request is repetitive or unreasonably burdensome.
8. Assistance with DPIAs, consultations and security
Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with your data protection impact assessments and any prior consultation with a supervisory authority under GDPR Articles 35 and 36, and with your obligations under Articles 32 to 34. Reasonable assistance normally means completing a security questionnaire, providing our documentation, and answering specific questions.
9. Personal data breach
9.1 We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. A recommended value is 48 hours, which sits inside your own 72-hour GDPR clock; confirm with counsel.
9.2 The notice will describe, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for more information. We will supplement the notice as the investigation develops.
9.3 We will take reasonable steps to contain and mitigate the breach and will cooperate with your investigation and your notifications to supervisory authorities and data subjects.
9.4 Notifying you is not an admission of fault or liability.
10. Deletion and return
10.1 During the subscription you may export Customer Personal Data through the Service.
10.2 On termination, and at your choice, we will delete or return Customer Personal Data. Absent an instruction, we will make it available for export for 30 days after termination, then delete or irreversibly anonymise it within 30 days.
10.3 Copies in encrypted backups are deleted on the backup cycle, up to 35 days, and remain protected by this DPA until they are.
10.4 We may retain Customer Personal Data where a law requires it, and only for as long and for the purpose that law requires.
10.5 We will certify deletion in writing on request.
11. Audits
11.1 On request, and no more than once in any twelve-month period unless a supervisory authority requires more or a personal data breach has occurred, we will make available information necessary to demonstrate compliance with this DPA. In the first instance this means our written security documentation and a completed security questionnaire.
11.2 If that is not sufficient for your obligations under GDPR Article 28(3)(h), you may carry out an audit or mandate an independent auditor who is not our competitor and who signs a confidentiality agreement. Audits require at least 30 days' notice, must occur during business hours, must not unreasonably disrupt our operations, and must respect the confidentiality and security of other customers' data. You bear your own costs and reimburse our reasonable costs at $150 per hour beyond the first audit in a period.
11.3 We are not obliged to give access to systems, premises or data where doing so would breach a duty to another customer or to a third party.
12. International transfers
12.1 We process Customer Personal Data in the United States and may use Subprocessors in the locations listed in SUBPROCESSORS.md.
12.2 EEA transfers. Where you transfer Customer Personal Data subject to the GDPR to us in a country without an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows: - Module Two (controller to processor) where you are a controller. - Module Three (processor to processor) where you are a processor for another controller. - Clause 7 (docking clause): applies. - Clause 9: Option 2, general written authorisation, with the notice period in Section 6.3. - Clause 11: the optional independent dispute resolution body language does not apply. - Clause 17: governed by the law of [[SCC_GOVERNING_LAW_MEMBER_STATE]] (for example Ireland). Confirm with counsel. - Clause 18(b): disputes resolved before the courts of the same member state. - Annex I and Annex II of the SCCs are the Annex I and Annex II of this DPA. - Annex III (list of subprocessors) is SUBPROCESSORS.md.
12.3 UK transfers. The UK Addendum is incorporated and applies to transfers subject to the UK GDPR. Table 1 is completed by Annex I; Tables 2 and 3 by Section 12.2 and the Annexes; in Table 4, the party that may end the Addendum is the importer.
12.4 Swiss transfers. The SCCs apply with these changes: references to the GDPR are read as references to the Swiss FADP; the competent authority is the Federal Data Protection and Information Commissioner; and "member state" is read so as not to deprive data subjects in Switzerland of the right to sue in their place of habitual residence.
12.5 We do not currently claim certification under the EU-US Data Privacy Framework or its UK Extension. Do not rely on the DPF for these transfers unless and until this DPA says otherwise.
12.6 We will notify you if we become subject to a legally binding request from a public authority for Customer Personal Data, unless prohibited, and will challenge requests that appear unlawful.
13. Liability
Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement, except where Data Protection Laws prevent that. See the open point [[DPA_LIABILITY_DECISION]] in the Terms — enterprise customers often ask for a higher or uncapped liability for data protection breaches, and that is a commercial decision.
14. Term
This DPA takes effect when the Agreement does and continues until we no longer hold Customer Personal Data. Sections 4, 5, 9, 10, 12 and 13 survive as relevant.
Annex I
A. List of parties
| Field | Data exporter | Data importer |
|---|---|---|
| Name | [[CUSTOMER_LEGAL_NAME]] | Seros, LLC |
| Address | [[CUSTOMER_ADDRESS]] | [[ENTITY_ADDRESS]] |
| Contact name, position, email | [[CUSTOMER_DP_CONTACT]] | Not appointed, privacy@seros.dev |
| Activities relevant to the transfer | Use of the Service to draft, route, assign and track tasks | Provision of the Service |
| Signature and date | On execution of the Agreement | On execution of the Agreement |
| Role | Controller, or processor for another controller | Processor |
B. Description of transfer
| Item | Detail |
|---|---|
| Categories of data subjects | The exporter's employees, contractors and other Authorised Users; the exporter's customers, clients and prospects; the exporter's suppliers; and any other individual whose personal data appears in messages, documents, tickets, calendar entries or tasks the exporter submits or connects |
| Categories of personal data | Identification and contact data (name, work email, job title, phone, user identifiers); employment and organisational data (team, manager, role, workload, availability); communications content (messages, comments, documents, tickets, meeting entries); task and workflow data (assignments, due dates, status, priority, notes); technical data (IP address, device and browser data, log and usage records); and any other personal data the exporter chooses to submit |
| Sensitive data | None expected. The Acceptable Use Policy prohibits submitting special category data, PHI and payment card data without a separate written agreement. If the exporter will submit special category data, describe it here and record the additional safeguards: [[SPECIAL_CATEGORY_DETAIL]] |
| Frequency of transfer | Continuous, for the duration of the subscription |
| Nature of the processing | Collection, recording, organisation, structuring, storage, retrieval, consultation, use, transmission to AI model providers for generation, alignment, combination, restriction, erasure and destruction |
| Purpose of the processing | Providing, securing, supporting and maintaining the Service, including generating task drafts, routing and assignment suggestions, summaries and reports |
| Retention period | For the duration of the subscription, plus the export window of 30 days and deletion within 30 days, subject to backup cycles of up to 35 days |
| Transfers to subprocessors | See SUBPROCESSORS.md for each subprocessor, its purpose, location and retention |
C. Competent supervisory authority
The supervisory authority of the member state in which the exporter is established, or, for exporters not established in the EEA, the authority of the member state where the exporter's Article 27 representative is established, or where the data subjects are located: [[COMPETENT_SUPERVISORY_AUTHORITY]].
Annex II — Technical and organisational measures
Fill each "Current state" cell with what is actually in place. Do not claim a control that is not implemented. An empty or honest cell is better than a false one.
| Area | Measure | Current state |
|---|---|---|
| Pseudonymisation and encryption | Encryption in transit (TLS 1.2 or higher) for all external connections | [[TOM_TLS]] |
| Encryption at rest for databases, object storage and backups | [[TOM_ENCRYPTION_AT_REST]] | |
| Key management and rotation | [[TOM_KEY_MANAGEMENT]] | |
| Confidentiality | Role-based access control and least privilege for staff | [[TOM_RBAC]] |
| Multi-factor authentication on production and administrative systems | [[TOM_MFA]] | |
| Background checks and confidentiality agreements for personnel | [[TOM_PERSONNEL]] | |
| Security awareness training | [[TOM_TRAINING]] | |
| Integrity | Logical tenant separation in a multi-tenant architecture | [[TOM_TENANT_ISOLATION]] |
| Change management, code review and separation of duties | [[TOM_CHANGE_MANAGEMENT]] | |
| Input validation and secure development practices | [[TOM_SECURE_SDLC]] | |
| Availability and resilience | Backups, tested restore procedure, recovery objectives | [[TOM_BACKUP_RPO_RTO]] |
| Redundancy and failover in the hosting environment | [[TOM_REDUNDANCY]] | |
| Business continuity and disaster recovery plan | [[TOM_BCDR]] | |
| Testing and evaluation | Vulnerability scanning and dependency monitoring | [[TOM_VULN_SCANNING]] |
| Penetration testing cadence | [[TOM_PENTEST]] | |
| Logging, alerting and monitoring | [[TOM_LOGGING]] | |
| User access control | Customer-side SSO, provisioning and role management | [[TOM_CUSTOMER_SSO]] |
| Session management and credential storage (hashing algorithm) | [[TOM_CREDENTIALS]] | |
| Data minimisation | Only the data needed for a feature is sent to model providers | [[TOM_MINIMISATION]] |
| Retention and deletion automation | [[TOM_RETENTION_AUTOMATION]] | |
| Incident response | Documented process, roles, and customer notification path | [[TOM_INCIDENT_RESPONSE]] |
| Subprocessor governance | Due diligence, contracts, periodic review | [[TOM_VENDOR_MANAGEMENT]] |
| Physical security | Inherited from the hosting provider's data centres | [[TOM_PHYSICAL]] |
| Deletion | Secure deletion and media sanitisation | [[TOM_SECURE_DELETION]] |
Measures a subprocessor is responsible for, rather than us, should be marked as inherited and the provider named.
Annex III — Subprocessors
See SUBPROCESSORS.md. That list, as updated in accordance with Section 6, is Annex III for the purposes of the SCCs.
Signature
| Customer | Seros, LLC | |
|---|---|---|
| Signature | ||
| Name | [[CUSTOMER_SIGNATORY]] | Jackson Durham |
| Title | Managing Member | |
| Date |
This DPA is a draft and is not executed.
What I need from you
- The breach notification window you are willing to commit to (72). 48 hours is common; 24 hours is aggressive for a small team.
- Subprocessor notice and objection windows.
- The SCC governing member state.
- Whether liability for data protection breaches is capped at the general cap.
- Every [[TOM_*]] cell in Annex II filled with what is genuinely in place.
- Whether an Article 27 EU or UK representative is needed.