This DPA has 2 parts: (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1.1, which is incorporated by reference. If there is any inconsistency between the parts of the DPA, the Cover Page will control over the DPA Standard Terms. Capitalized words have the meanings given on the Cover Page or the DPA Standard Terms. This Cover Page applies to customers whose Order Form incorporates this DPA by reference; if you have a separately negotiated DPA, that agreement governs instead.
- Approved Subprocessors
- Google Cloud Platform — United States — hosting, storage, logging, and monitoring
- Stripe — United States — payment processing
- Google Analytics — United States — website analytics
- Langfuse — United States — performance monitoring
- Security Policy
- As defined in the Agreement.
- DPA Covered Claim
- The Agreement includes an additional Provider Covered Claim for any action, proceeding, or claim arising out of or relating to (1) Provider’s breach or alleged breach of the DPA, or (2) Provider’s gross negligence or willful misconduct, in each case, that results in a Security Incident.
- DPA Liability Cap
- The Agreement includes an additional Increased Claim for DPA Covered Claims, with a separate Increased Cap Amount of the greater of $1,000.00 or 2 times the fees payable by Customer to Provider in the 12 month period immediately before the claim.
- Service Provider Relationship (CCPA)
- To the extent the California Consumer Privacy Act (CCPA) applies, the parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from Customer to provide the Service, which constitutes a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer under the Agreement, and will not retain, use, or disclose it except as necessary to provide the Service, as stated in the Agreement, or as permitted by Applicable Data Protection Laws. Provider will notify Customer if it can no longer meet its obligations under the CCPA.
- Restricted Transfers — Governing Member State
- EEA Transfers: Ireland
- Data Exporter
- Name: the Customer signing this DPA
Role: Controller - Data Importer
- Name: the Provider signing this DPA
Contact person: BrainBox Legal (legal@brainbox-ai.app)
Address: 2108 N St, Ste N, Sacramento, California 95816, USA
Role: Processor
Annex I(B) — Description of Transfer and Processing Activities
- Categories of Data Subjects
- Customer’s end users or customers
- Categories of Personal Data
- Name
- Contact information such as email, phone number, or address
- User activity and analysis such as device information or IP address
- Location information
- Special Category Data
- No special category data (as defined in Article 9 of the GDPR) is Processed.
- Frequency of Transfer
- Continuous
- Nature and Purpose of Processing
- Provider will Process Customer Personal Data as instructed in Section 2.3 of the DPA Standard Terms, including: receiving data (collection, access, retrieval, recording, entry); holding data (storage, organization, structuring); using data (analysis, consultation, testing, automated decision making, profiling); updating data (correcting, adaptation, alteration, alignment, combination); protecting data (restricting, encrypting, security testing); sharing data (disclosure, dissemination, allowing access, or otherwise making available); returning data to the data exporter or data subject; and erasing data (destruction and deletion).
- Duration of Processing
- Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)–(d) of the DPA Standard Terms, or (ii) by Applicable Laws.
Annex I(C)
- Competent Supervisory Authority
- The supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.
Annex II — Technical and Organizational Security Measures
See Security Policy, above.
Questions
For a fully executed copy of this DPA, or to request the current Report referenced in the DPA Standard Terms, contact legal@brainbox-ai.app.