Data Processing Agreement

Process Personal Data only on documented instructions from the Customer, including transfers to third countries.

Ensure that persons authorized to process Personal Data have committed themselves to confidentiality.

Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

Assist the Customer in ensuring compliance with obligations pursuant to GDPR Articles 32-36.

Actualize shall maintain an up-to-date list of Sub-processors and provide prior notice of any intended changes.

Customers may object to new Sub-processors within 10 business days of notification.

Actualize shall impose data protection terms on Sub-processors that are no less protective than this DPA.

Actualize remains fully liable for the performance of its Sub-processors' obligations.

Encryption of Personal Data in transit and at rest.

Ability to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems.

Process for regularly testing, assessing, and evaluating security measures.

Identity and access management with multi-factor authentication.

Regular security assessments and penetration testing.

Implements the EU Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreement (IDTA) as applicable.

Conducts transfer impact assessments to evaluate the level of protection in the destination country.

Implements additional safeguards as necessary to ensure adequate protection.

Notify the Customer without undue delay after becoming aware of a Personal Data Breach.

Provide sufficient information to allow the Customer to meet any obligations to report the breach to supervisory authorities or Data Subjects.

Take reasonable steps to contain, mitigate, and remediate the breach.

Access to Personal Data

Rectification of inaccurate Personal Data

Erasure of Personal Data

Restriction of Processing

Data Portability

Objection to Processing

Upon termination, Actualize shall delete or return all Personal Data to the Customer, unless required by law to retain certain data.

Any obligation to delete Personal Data shall include taking commercially reasonable and technically feasible measures to delete such Personal Data.