Data Processing Agreement

1. Definitions

For the purposes of this Data Processing Agreement (DPA):

• Controller: The entity that determines the purposes and means of processing personal data
• Processor: The entity that processes personal data on behalf of the Controller
• Personal Data: Any information relating to an identified or identifiable natural person
• Processing: Any operation performed on personal data
• Subprocessor: Any third party engaged by the Processor to process data

2. Subject Matter and Duration

This DPA applies to the processing of personal data by KillSwitch Guardian (Processor) on behalf of the Customer (Controller) in connection with the services provided under the Terms of Service.

The duration of processing corresponds to the duration of the service agreement between the parties.

3. Nature and Purpose of Processing

KillSwitch Guardian processes personal data for the following purposes:

• Providing software protection and entitlement control services
• Managing customer accounts and billing
• Providing customer support
• Ensuring security and preventing fraud
• Complying with legal obligations

4. Types of Personal Data

The categories of personal data processed may include:

• Contact information (name, email, address)
• Business information (company name, job title)
• Billing and payment information
• Technical information (IP addresses, device information)
• Usage data and service logs

5. Data Subject Categories

Data subjects include the Controller's customers, employees, and other individuals whose personal data is processed through the Service.

6. Processor Obligations

6.1 Processing Instructions

KillSwitch Guardian shall process personal data only on documented instructions from the Controller, unless required by law.

6.2 Confidentiality

All personnel processing personal data are subject to confidentiality obligations.

6.3 Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

6.4 Subprocessing

The Controller provides general authorization for KillSwitch Guardian to engage subprocessors. A current list of subprocessors is maintained and available upon request.

7. Controller Obligations

The Controller is responsible for:

• Ensuring lawful basis for processing
• Providing necessary privacy notices to data subjects
• Responding to data subject requests
• Ensuring accuracy of personal data provided

8. Data Subject Rights

KillSwitch Guardian shall assist the Controller in fulfilling data subject rights requests by:

• Providing technical capabilities to access, correct, or delete personal data
• Implementing appropriate organizational measures
• Responding to Controller requests in a timely manner

9. Security Incident Management

In the event of a personal data breach, KillSwitch Guardian shall:

• Notify the Controller without undue delay
• Provide necessary information to assist with breach notifications
• Take reasonable steps to mitigate the effects of the breach

10. Data Protection Impact Assessment

KillSwitch Guardian shall provide reasonable assistance to the Controller for data protection impact assessments and prior consultations with supervisory authorities.

11. Data Transfers

KillSwitch Guardian may transfer personal data outside the EU/EEA only with appropriate safeguards, such as:

• Adequacy decisions
• Standard Contractual Clauses
• Binding Corporate Rules
• Approved certification mechanisms

12. Deletion or Return of Data

Upon termination of services, KillSwitch Guardian shall, at the choice of the Controller, delete or return all personal data, and delete existing copies unless required by law to retain the data.

13. Audit Rights

The Controller has the right to conduct audits to verify compliance with this DPA. KillSwitch Guardian shall contribute to such audits by providing necessary information.

Audits shall be conducted with reasonable notice and shall not unreasonably disrupt KillSwitch Guardian's operations.