Data Processing Agreement

Data processing relationship

This Data Processing Agreement (“DPA”) is entered into between Browserherd, Inc. (“Browserherd”) and the customer identified in the agreement governing the Services (“Customer”). It forms part of the Terms of Service, order form, or other agreement between the parties (the “Agreement”).

This DPA applies only to the extent Browserherd processes Customer Personal Data on Customer's behalf in providing the Services. It does not apply when Browserherd acts independently as a controller, which is addressed in the Privacy Policy.

Definitions

Customer Personal Data

Personal Data contained in Customer Data and processed by Browserherd on Customer's behalf.

Data Protection Laws

Privacy and data protection laws applicable to processing under the Agreement, including the GDPR, UK GDPR, CCPA/CPRA, and similar laws.

GDPR

EU Regulation 2016/679; references to the UK GDPR mean the GDPR as incorporated into UK law.

Personal Data

Information relating to an identified or identifiable person, including equivalent terms under applicable Data Protection Laws.

Security Incident

A confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.

Subprocessor

A third party engaged by Browserherd to process Customer Personal Data in providing the Services.

“Controller,” “processor,” “business,” “service provider,” “sell,” “share,” and “processing” have the meanings given by applicable Data Protection Laws.

Roles and documented instructions

Customer is the controller or business and Browserherd is the processor or service provider for Customer Personal Data, except where Customer acts as a processor for another controller, in which case Browserherd is Customer's subprocessor. Customer instructs Browserherd to process Customer Personal Data to provide, secure, support, and maintain the Services; comply with Customer's documented configuration and requests; and perform the Agreement.

Browserherd will process Customer Personal Data only on documented instructions, including those in the Agreement and Customer's use of the Services, unless law requires otherwise. If legally permitted, Browserherd will notify Customer before processing required by law. Browserherd will inform Customer if, in its reasonable opinion, an instruction violates applicable Data Protection Laws.

Customer responsibilities

Customer is responsible for the lawfulness, fairness, accuracy, and scope of Customer Personal Data and processing instructions. Customer will:

• Provide all legally required notices and obtain all necessary rights, consents, and authorizations.
• Use the Services in compliance with Data Protection Laws and the Acceptable Use Policy.
• Configure retention, recording, access, profiles, credentials, and regions appropriately.
• Not instruct Browserherd to process prohibited data or perform unlawful processing.
• Respond to data subjects and regulators as controller, with Browserherd's assistance as described below.

Confidentiality and safeguards

Browserherd will ensure personnel authorized to process Customer Personal Data are bound by confidentiality obligations and receive appropriate privacy and security guidance. Browserherd will maintain risk-based technical and organizational measures designed to protect Customer Personal Data, as summarized in Annex II.

Customer acknowledges that security is a shared responsibility. Customer must protect credentials and API keys, manage Authorized Users, use least privilege, and avoid placing unnecessary sensitive data into sessions.

Subprocessors

Customer generally authorizes Browserherd to use Subprocessors to provide the Services. Browserherd will impose data protection obligations that are no less protective in material respects than those in this DPA and remains responsible for each Subprocessor's performance to the extent required by law.

A current list of Subprocessors, including purpose and processing location, is available upon request from [email protected]. Browserherd will provide advance notice of a new Subprocessor where required. Customer may object on reasonable data protection grounds within 15 days. The parties will work in good faith on a commercially reasonable alternative; if none is available, Customer may terminate the affected Service.

Data subject requests and compliance

Taking into account the nature of processing, Browserherd will provide reasonable assistance for Customer to respond to requests to exercise data subject rights. If Browserherd receives a request relating to Customer Personal Data, it will direct the requester to Customer where feasible and will not independently respond except on Customer's instruction or as required by law.

Browserherd will provide reasonable assistance with data protection impact assessments, consultations with regulators, and information needed to demonstrate Customer's compliance, taking into account the nature of processing and information available to Browserherd. Additional work beyond standard functionality may be charged at agreed rates.

Security incident notification

Browserherd will notify Customer without undue delay after becoming aware of a Security Incident involving Customer Personal Data. Notice will include, as information becomes available, the nature of the incident, likely consequences, categories of affected data and data subjects, mitigation taken or proposed, and a contact for follow-up.

Browserherd will take reasonable steps to contain, investigate, and mitigate the Security Incident and will reasonably cooperate with Customer. Notification is not an admission of fault or liability. Unsuccessful attempts, blocked activity, and events that do not compromise Customer Personal Data are not Security Incidents.

Return and deletion

During the term, Customer may access and export Customer Personal Data using available Service functionality. At termination or on Customer's documented request, Browserherd will delete or return Customer Personal Data within a commercially reasonable period, unless law requires retention. Data in backups will be isolated from ordinary use and deleted according to backup lifecycle. Browserherd may retain de-identified information that cannot reasonably identify Customer or an individual.

Audit information

Upon reasonable written request, Browserherd will provide information necessary to demonstrate compliance with this DPA, such as relevant security summaries, certifications, or independent audit reports when available. If that information is insufficient, Customer may request an audit no more than once annually, or following a qualifying Security Incident or regulator request.

Audits must be scoped, scheduled in advance, conducted during normal business hours by an independent auditor under confidentiality, and avoid disruption or access to other customers' data. Customer bears its audit costs and Browserherd may charge reasonable costs for support beyond standard materials.

Restricted transfers

For Customer Personal Data transferred from the EEA to a country without an adequacy decision, the European Commission Standard Contractual Clauses adopted by Decision 2021/914 are incorporated by reference. Module Two applies where Customer is a controller and Browserherd is a processor; Module Three applies where both act as processors. The optional docking clause applies; the supervisory authority and governing law are determined by the Customer's EEA establishment or representative, and the competent courts are those of that Member State.

For transfers from the United Kingdom, the UK International Data Transfer Addendum to the EU SCCs is incorporated by reference. For Switzerland, the SCCs apply with modifications necessary under the Swiss Federal Act on Data Protection. Browserherd will implement supplementary measures where reasonably necessary. If a transfer mechanism becomes invalid, the parties will cooperate to implement a lawful alternative.

United States service provider terms

For Customer Personal Data subject to the CCPA/CPRA, Browserherd acts as a service provider or contractor. Browserherd will not sell or share Customer Personal Data; retain, use, or disclose it outside the direct business relationship with Customer or for a commercial purpose other than providing the Services; or combine it with personal information received from another source except as permitted by law. Browserherd certifies that it understands and will comply with these restrictions.

Customer may take reasonable and appropriate steps to verify compliant use and to stop and remediate unauthorized use. Browserherd will notify Customer if it determines it can no longer meet applicable obligations.

Subject matter and scope

Technical and organizational measures

General terms

If this DPA conflicts with the Agreement regarding processing of Customer Personal Data, this DPA controls. The Agreement's liability limits apply to this DPA to the fullest extent permitted by law. This DPA ends when Browserherd no longer processes Customer Personal Data, except provisions that must survive to protect data.