Data Processing Agreement

Categories of Data Subjects:

• Customer's users and account holders
• Customer's employees accessing the Service
• Individuals whose data is stored within Customer's account

Types of Personal Data:

• Identity data: Name, email address, profile picture
• Authentication data: OAuth tokens, session identifiers
• Calendar data: Event titles, dates, times (via Google Calendar integration)
• Usage data: Feature usage, preferences, settings
• User-generated content: Journal entries, notes, watchlists

Purpose of Processing:

• Providing and maintaining the Heightss platform
• User authentication and account management
• Calendar integration and event scheduling
• AI-powered features and analysis
• Customer support and communication
• Service improvement and analytics

Heightss shall process Personal Data only:

• In accordance with the Controller's documented instructions
• As necessary to provide the Services
• As required by applicable law (with notice to Controller where permitted)

Heightss shall not:

• Process Personal Data for purposes other than those specified
• Sell, rent, or trade Personal Data to third parties
• Use Personal Data for advertising or marketing purposes without consent
• Transfer Personal Data without appropriate safeguards

Processing Records:

Heightss maintains records of processing activities as required by Article 30 of GDPR, including:

• Categories of processing performed
• Transfers to third countries
• Technical and organizational security measures

Confidentiality:

• Ensure personnel processing Personal Data are bound by confidentiality obligations
• Limit access to Personal Data to personnel who need it
• Maintain confidentiality obligations that survive termination of employment

Assistance:

• Assist Controller in responding to Data Subject requests
• Assist with data protection impact assessments when required
• Assist with prior consultation with supervisory authorities
• Provide information necessary to demonstrate compliance

Instructions:

• Process data only on documented instructions from Controller
• Inform Controller if an instruction infringes Data Protection Laws
• Maintain records of instructions received

Technical Measures:

• Encryption: TLS 1.3 in transit, AES-256 at rest
• Access control: Role-based access, MFA, session management
• Network security: Firewalls, IDS/IPS, DDoS protection
• Monitoring: 24/7 security monitoring, SIEM, audit logging
• Vulnerability management: Regular scanning, penetration testing

Organizational Measures:

• Security policies and procedures
• Employee security awareness training
• Background checks for employees with data access
• Incident response procedures
• Business continuity and disaster recovery plans

Certifications:

• SOC 2 Type II aligned controls
• Infrastructure hosted on certified cloud providers

Current Subprocessors:

Subprocessor Changes:

• Heightss will notify Controller of new subprocessors via email 30 days before engagement
• Controller may object to new subprocessors within 14 days
• If objection cannot be resolved, Controller may terminate affected services

If Heightss receives a request directly from a Data Subject:

• We will notify the Controller promptly (within 5 business days)
• We will not respond directly unless authorized by Controller
• We will provide reasonable assistance to fulfill the request

Notification Contents:

• Nature of the Security Incident
• Categories and approximate number of Data Subjects affected
• Categories and approximate number of records affected
• Likely consequences of the incident
• Measures taken or proposed to address the incident
• Contact point for further information

Assistance:

Heightss will:

• Take immediate steps to contain and mitigate the breach
• Investigate the root cause
• Preserve evidence for forensic analysis
• Assist Controller with regulatory notifications
• Provide post-incident report

Documentation Available Upon Request:

• SOC 2 Type II report (under NDA)
• Penetration test summary (under NDA)
• Security policies and procedures summary
• Completed security questionnaires
• Subprocessor list with DPA status

On-Site Audits:

• Available for Enterprise customers
• 30 days advance written notice required
• Maximum one audit per year
• Conducted during normal business hours
• Controller bears costs of third-party auditors
• Auditors must sign confidentiality agreements

Transfer Mechanisms:

• Standard Contractual Clauses (SCCs): EU-approved clauses for EU-to-third country transfers
• UK International Data Transfer Agreement: For UK data transfers
• Data Processing Agreements: With all subprocessors

Supplementary Measures:

• Encryption in transit and at rest
• Pseudonymization where feasible
• Access controls and audit logging
• Regular security assessments

Upon Termination:

• Controller may request data export within 30 days of termination
• Personal Data deleted within 30 days of termination (unless retention required by law)
• Backups purged within 90 days
• Certificate of deletion available upon request

Retention for Legal Compliance:

• Some data may be retained as required by applicable law
• Data retained for legal purposes is segregated and access-restricted
• Controller will be informed of any legal retention requirements

Survival:

The following provisions survive termination:

• Data retention and deletion obligations
• Confidentiality obligations
• Audit rights (for 1 year post-termination)
• Liability provisions

Effect of Termination:

• Processing ceases except for deletion activities
• Data export provided upon request
• All Personal Data deleted per Section 11