Data Processing Agreement

1. Parties and status of this DPA

This Data Processing Agreement ("DPA") is between the customer ("Client," "you") and Bitscaled LLC ("Bitscaled," "we," "us," or "our"), a Florida limited liability company operating from Tampa, United States. It is intended to meet GDPR Article 28 (and equivalent UK GDPR) processor terms when those laws apply to the Client's processing of Client Data.

2. Definitions

• "Client Data" means personal data in the Client's systems, tenants, or Workspace-hosted client content that Bitscaled processes to deliver managed services or hosted client content on the Client's instructions.
• "Website Data" means information Bitscaled collects as a controller from visitors, leads, and Bitscaled account users, as described in the Privacy Policy.
• "Processing" and "personal data" have the meanings in the GDPR where it applies, and analogous meanings under other privacy laws that apply to the same activity.
• "Subprocessor" means a third party engaged by Bitscaled to process Client Data in connection with the processor services.

3. Roles and what this DPA does not cover

For Client Data, the Client is the controller (or a processor for its own customer) and Bitscaled is the processor. That includes managed IT, cybersecurity, cloud, backup, and related professional services, and client content Bitscaled hosts in Workspace on the Client's instructions.

Website visitor, marketing, and Bitscaled-account data are not processed under this DPA. Bitscaled is the controller for Website Data. See the Privacy Policy.

4. Documented instructions

Bitscaled will process Client Data only on documented instructions from the Client, including the MSA, SOW, order, configured product settings, and reasonable written requests, unless EU, UK, or United States law requires otherwise. If we believe an instruction infringes applicable data-protection law, we will inform the Client when legally permitted.

The Client is responsible for the lawfulness of its instructions, for notices and consents owed to data subjects, and for not instructing Bitscaled to process data outside the contracted scope (including PHI without a signed BAA).

5. Confidentiality

Bitscaled will ensure that persons authorized to process Client Data are bound by confidentiality duties (contract or statute) and will access Client Data only as needed to perform the services or comply with law.

6. Technical and organizational measures

Taking into account the state of the art, cost, nature, scope, context, and purposes of processing, and the risks to individuals, Bitscaled implements the following measures for processor services. This list is what we actually operate. Bitscaled does not claim SOC 2, ISO 27001, PCI DSS, independent pentest, or 24/7 Bitscaled-operated secure data center certification on this page.

• Encryption in transit using TLS for Bitscaled portals and for remote access we control over public networks.
• Encrypted Bitscaled portal sessions (encrypted HTTP-only session cookies).
• Access controls and least-privilege assignment for Bitscaled staff tools.
• Multi-factor authentication on Bitscaled accounts used to deliver the services.
• Operational logging of access and relevant system events.
• Written contracts with vendors that process Client Data, including confidentiality and data-protection terms appropriate to their role.

7. Subprocessors

The Client authorizes Bitscaled to engage the vendors listed at /legal/subprocessors to process Client Data as needed for the processor services. Optional or environment-gated vendors are used only when the relevant feature, integration, or contract is enabled.

For processor services, the Client may object to a material new subprocessor by emailing legal@bitscaled.tech. We will work in good faith on a commercially reasonable alternative. If we cannot agree, either party may terminate the affected processor services as provided in the MSA or SOW.

8. Assistance with data subject requests

Taking into account the nature of the processing, Bitscaled will assist the Client by appropriate technical and organizational measures, insofar as possible, for the Client to respond to requests from individuals to access, correct, delete, restrict, or port Client Data, or to object to processing (DSAR and similar requests).

If a request is sent to Bitscaled and clearly identifies the Client, we will notify the Client. We will not respond as controller of Client Data unless required by law or expressly instructed by the Client.

9. Personal data breaches

Bitscaled will notify the Client without undue delay after becoming aware of a personal data breach affecting Client Data we process under this DPA, and will provide information reasonably available to us to help the Client meet its own notification duties.

10. International transfers

Bitscaled processes Client Data primarily in the United States. Where a restricted transfer of Client Data from the EEA, UK, or Switzerland requires a transfer tool, the parties will rely on the applicable Standard Contractual Clauses (SCCs) and/or the UK International Data Transfer Agreement or Addendum (IDTA), including any module appropriate to processor-to-subprocessor chains.

Execution of this website DPA constitutes the Client's instruction to make such transfers as needed to provide the contracted services, subject to those clauses where required by law.

11. California (CCPA/CPRA)

For Client Data subject to the California Consumer Privacy Act as amended by the CPRA, Bitscaled is a service provider and contractor. Bitscaled will not sell or share Client Data, retain it for any purpose other than the business purpose of performing the services, or combine it with other personal information except as permitted for service providers/contractors.

12. HIPAA and protected health information

This DPA does not cover protected health information (PHI) under HIPAA. Bitscaled is not authorized to create, receive, maintain, or transmit PHI for the Client until a Business Associate Agreement is signed. Do not place PHI in Workspace, tickets, email to Bitscaled, or tools unless that BAA is in place and the SOW includes the work.

13. Description of processing

The following describes the processing of Client Data under this DPA unless a signed SOW or DPA states a narrower or different scope:

14. Audits

Bitscaled will make available information reasonably necessary to demonstrate compliance with this DPA. The Client may audit Bitscaled's relevant processor controls on reasonable written notice, during normal business hours, not more than once in any twelve-month period unless a confirmed personal data breach or competent authority requires an additional review.

Audits must avoid unreasonable disruption, protect other customers' confidential information, and may be satisfied in whole or in part by written responses, vendor reports the Client is entitled to receive, or a mutually agreed auditor. The Client bears its own audit costs unless the audit reveals a material breach of this DPA by Bitscaled.

15. Return and deletion

When processor services end, Bitscaled will delete or return Client Data at the Client's choice, except that copies may remain in backups, logs, or archives until they cycle out in the ordinary course, and except where United States or other applicable law requires retention (including legal holds). Residual copies remain subject to this DPA until deleted.

16. Term and conflict

This DPA lasts for the term of the processor services. If a signed MSA, SOW, BAA, or DPA conflicts with this website DPA, the signed document controls for that conflict. Liability for processor services remains subject to the limitations in the Terms of Service or the signed MSA, whichever applies.

17. Governing law

This DPA is governed by the laws of the State of Florida, excluding conflict-of-law rules, unless the MSA specifies a different governing law. Venue follows the MSA, or if none, the courts in Hillsborough County, Florida.

18. Contact

Privacy and processor questions go to privacy@bitscaled.tech and legal@bitscaled.tech. Use those mailboxes; we have not appointed a statutory DPO and do not use a dpo@ alias.