Data Processing Agreement

1. Scope and parties

This Data Processing Agreement ("DPA") forms part of the Terms of Service between LimberOps LLC ("LimberOps") and the customer using the Service ("Customer"). It applies when LimberOps processes Customer Personal Data: personal data in Customer Data, including data read from Client Tenants. Terms not defined here have the meaning given in the Terms. If this DPA conflicts with the Terms, this DPA wins for personal data.

No signature is needed; the DPA applies automatically. If you need a countersigned copy, email hello@limberops.com.

2. Roles

Customer is the controller of Customer Personal Data, or, where Customer is an MSP acting for its own clients, a processor acting on its clients' behalf. LimberOps is Customer's processor (or subprocessor). Customer is responsible for having a lawful basis and any notices and consents needed for the processing, and for passing on its clients' instructions.

3. Processing on instructions

LimberOps processes Customer Personal Data only to provide the Service and on Customer's documented instructions. The Terms, this DPA and Customer's use of the Service, including the Plans its Authorized Users approve, are those instructions. LimberOps will tell Customer if it believes an instruction breaks data protection law, and is not required to follow it.

LimberOps does not sell Customer Personal Data, share it for cross-context behavioral advertising, use it to train AI models, or combine it with other data except as needed to provide the Service. LimberOps acts as a "service provider" under the California Consumer Privacy Act: it will not retain, use or disclose Customer Personal Data outside its direct business relationship with Customer, certifies that it understands these restrictions, and will tell Customer if it can no longer meet them.

4. Details of the processing

• Subject matter and duration: providing the Service for the term of the Terms, plus the deletion period in section 11.
• Nature and purpose: reading, storing, comparing and, when approved, changing configuration of Client Tenants; simulating sign-ins; running runbooks; keeping audit records; AI-assisted drafting and explanation.
• Data subjects: users, administrators, guests and service accounts in Client Tenants. Personal data about Customer's own Authorized Users (their LimberOps accounts and activity) is processed by LimberOps as a controller under its Privacy Policy, not under this DPA.
• Categories of data: names, usernames and email addresses; identifiers; job titles and departments; group, role and license assignments; device names and compliance state; sign-in and audit log metadata such as time, application, IP address and location; configuration that refers to people.
• Special categories: none intended. Customer should not place special category data in configuration managed through the Service.
• Frequency: continuous while Client Tenants are connected.

5. Confidentiality of personnel

LimberOps ensures that anyone authorized to process Customer Personal Data is bound by confidentiality obligations and accesses it only as needed to provide or support the Service.

6. Security measures

LimberOps maintains the technical and organizational measures in Annex A (section 14) and may update them, provided the overall level of protection does not decrease.

7. Subprocessors

Customer authorizes LimberOps to use the subprocessors listed on our Subprocessors page. LimberOps imposes data protection terms on each subprocessor that protect Customer Personal Data at least as well as this DPA, and remains responsible for their performance.

LimberOps will give at least 30 days' notice before adding or replacing a subprocessor, by updating that page and emailing customers who have asked to be notified. Customer may object on reasonable data protection grounds within that period. The parties will try in good faith to resolve the objection; if they cannot, Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the period after termination.

8. Data subject requests and assistance

LimberOps will promptly forward to Customer any request from a data subject about Customer Personal Data and will not answer it except on Customer's instructions. Taking into account the nature of the processing, LimberOps will help Customer respond to such requests and with data protection impact assessments and consultations with regulators, to the extent Customer cannot do so itself using the Service.

9. Personal data breaches

LimberOps will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the breach, the data and data subjects likely affected, the likely consequences, and the measures taken or proposed, with further information as it becomes available. LimberOps will take reasonable steps to contain and remedy the breach. Notice is not an admission of fault.

10. International transfers

LimberOps processes Customer Personal Data in the United States. Where Customer Personal Data originating in the European Economic Area is transferred to LimberOps, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs"), which are incorporated by reference: Module Two where Customer is a controller and Module Three where Customer is a processor, with LimberOps as data importer. For the SCCs: clause 7 (docking) applies; clause 9 option 2 (general authorization, 30 days' notice) applies; the optional clause 11 language does not apply; clauses 17 and 18 select the law and courts of Ireland; for clause 13 and Annex I.C, the competent supervisory authority is that of the EU member state where Customer is established or, if Customer is not established in the EU, where its Article 27 representative is established, and otherwise the Irish Data Protection Commission; Annex I.A lists Customer as data exporter and LimberOps as data importer, with the contact details in their account and on this page, and acceptance of the Terms counts as signature; Annex I.B is section 4 of this DPA; Annex II is Annex A; Annex III is the Subprocessors page.

For transfers from the United Kingdom, the UK International Data Transfer Addendum to the SCCs applies. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection.

11. Requests from authorities

If a public authority asks LimberOps for Customer Personal Data, LimberOps will refer it to Customer where possible, notify Customer before disclosing anything unless the law forbids it, disclose only the minimum required, and challenge requests it reasonably considers unlawful.

12. Return and deletion

During the subscription, Customer can export its configuration code and data at any time. After the Terms end, Customer has 30 days to export; LimberOps then deletes Customer Personal Data within a further 30 days, and it expires from backups within a further 35 days, unless the law requires it to keep the data. Customer's configuration repositories are already in a format Customer can keep and use without LimberOps.

13. Audits

On written request, LimberOps will provide information reasonably necessary to show compliance with this DPA, such as answers to security questionnaires and, when available, third-party audit reports. If that is not enough, or a regulator requires it, Customer may audit LimberOps once a year, with 30 days' notice, during business hours, at Customer's cost, under confidentiality, and without access to other customers' data.

14. Liability

Each party's liability under this DPA is subject to the limitations in the Terms, except where data protection law or the SCCs do not allow them.

15. Annex A: technical and organizational measures

• Encryption: TLS for data in transit; encryption at rest for databases, storage and backups.
• Isolation: each customer's data, configuration state and repositories kept separate; per-customer credentials for Client Tenants.
• Least privilege: Client Tenants connected read-only first; write permissions granted per tenant by Customer; staff access limited to what is needed.
• Change control: every change to a Client Tenant is previewed and checked, and applies only under a Plan, schedule or rule approved by Customer; restore points kept for rollback.
• Secrets: credentials stored in a managed secrets vault, never in source code.
• Authentication: sign-in through our identity provider, with multi-factor authentication available to every user.
• Logging and monitoring: audit trail of requests, approvals and applied changes; security logging of the platform.
• Resilience: managed cloud infrastructure with automated daily database backups.
• Vendor management: data protection terms with every subprocessor.