Data Processing Agreement

Between [TORVARA ENTITY] (processor) and [CLIENT LEGAL NAME] (controller) · Attached to and forming part of the Service Agreement dated [SERVICE AGREEMENT DATE] · Effective: [DPA EFFECTIVE DATE]

1. Parties, background, and definitions

This Data Processing Agreement ("DPA") is between [TORVARA ENTITY], [STATE OF FORMATION] [ENTITY TYPE], with offices at [TORVARA ADDRESS] ("Torvara" or "Processor"), and [CLIENT LEGAL NAME], with offices at [CLIENT ADDRESS] ("Client" or "Controller"). Torvara provides marketing services and operates a branded web application (the "Console") for Client under the Service Agreement. In doing so Torvara processes personal information about Client's customers, prospects, and staff on Client's behalf and, as Section 3.3A allows, for its own purposes. This DPA sets out each party's obligations for that processing. If this DPA conflicts with the Service Agreement or the Platform Terms of Service, this DPA controls with respect to personal information.

Definitions. "Personal Information" means any information that identifies, relates to, or could reasonably be linked with an individual or household, as defined under Applicable Privacy Law. "Applicable Privacy Law" means all U.S. federal and state laws that apply to the processing of Personal Information under this DPA, including, as applicable, the California Consumer Privacy Act as amended, the Florida Digital Bill of Rights, the Michigan Identity Theft Protection Act, the Florida Information Protection Act, the TCPA, CAN-SPAM, and COPPA. "Client Data" means all data Client or its customers enter into or submit through the Console, including Personal Information. "Subprocessor" means a third party Torvara engages to process Client Data. "Security Incident" means any confirmed unauthorized access to, or acquisition, disclosure, loss, or alteration of, Client Data in Torvara's or a Subprocessor's control. "Controller," "processor," "service provider," "contractor," "sell," and "share" have the meanings given in Applicable Privacy Law.

2. Scope and details of processing

3. Roles and instructions

3.1 Roles. Client is the controller (or "business") of Client Data. When it provides the services, Torvara is the processor (or "service provider"/"contractor") and processes Client Data on Client's documented instructions; Section 3.3A covers Torvara's own use.

3.2 Instructions. Client's instructions are: the Service Agreement, this DPA, the settings and approvals Client makes in the Console, and written instructions from Client's designated contact. Torvara will inform Client if it believes an instruction violates Applicable Privacy Law, and may pause the affected processing until the issue is resolved.

3.3 Torvara's commitments. To provide the services, Torvara processes Client Data on Client's instructions under Section 3.2 and complies with Applicable Privacy Law.

3.3A Torvara's own use of data. Client agrees that Torvara may also use, combine, and disclose Client Data and the lead and prospect data Torvara generates through the services, including by selling or sharing it with third parties, for Torvara's own business purposes, provided Torvara does so only as Applicable Privacy Law allows, including any notice, opt-out, consent, sensitive-data, minors, and data-broker registration requirements. Client will include in its own privacy notice the disclosures and choices the law requires for this, and will pass to Torvara any opt-out or deletion request that applies. For this use, Torvara acts as an independent business (a "third party" or controller under State Laws), not as Client's processor. [Counsel: confirm the structure. A contract that lets Torvara sell Client Data generally means Torvara is not a CCPA "service provider" for that data, and Client's disclosure of it to Torvara may itself be a sale or share that Client must disclose and offer an opt-out for.]

3.4 De-identified data. Torvara may create aggregated or de-identified data from Client Data (for example, message delivery rates across all clients) provided it cannot reasonably be used to identify an individual or Client, and Torvara commits to maintain it in de-identified form and not attempt re-identification.

3.5 Client's obligations. Client is responsible for: the lawful basis and consents for the Client Data it provides and the messages it directs; the accuracy of the data; providing its own privacy notice to its customers; ensuring its staff use seats appropriately; and responding to data subject requests as controller, with Torvara's assistance under Section 8.

4. Confidentiality and personnel

Torvara will ensure that every person it authorizes to process Client Data (currently its two founders and any contractor it engages) is bound by written confidentiality obligations, has access only to the Client Data needed for their role, and has received training on this DPA and the Acceptable Use and Security Policy.

5. Subprocessors

5.1 Authorization. Client authorizes Torvara to engage the Subprocessors listed in Annex 1 and any others Torvara adds under Section 5.2.

5.2 Notice of changes. Torvara will notify Client by email at least 15 days before adding or replacing a Subprocessor that will process Client Data, describing the Subprocessor and the processing. Client may object in writing within that period on reasonable grounds relating to data protection. If the parties cannot resolve the objection within 15 days, Client may terminate the affected services on notice and receive a pro-rata refund of prepaid fees.

5.3 Flow-down. Torvara will impose on each Subprocessor, by written contract, data-protection obligations no less protective than this DPA, to the extent applicable to the service the Subprocessor provides, and remains responsible to Client for each Subprocessor's performance. Client acknowledges that large platform providers (Anthropic, Railway, Twilio, Meta, Google, Higgsfield) contract on their own standard terms, which Torvara has reviewed for consistency with this DPA.

6. Security measures

Torvara will maintain administrative, technical, and physical safeguards appropriate to the nature of the Client Data and the risks of processing, at minimum:

• encrypted transport (TLS) for every hosted page, API, and provider connection;
• per-seat access with individual credentials or access codes [Counsel: representation to be softened or scheduled until the spine ships — today's sign-in is a seat button with no credential]; removal of access within one business day of Client's request; founder administrative access limited to service delivery and incident response and logged where the platform supports it;
• encrypted backups (AES-GCM, passphrase-protected) and, once the back end is live, encryption at rest for stored data and database backups;
• output escaping of all user-entered content before display, no dynamic code execution, and no third-party scripts in the Console;
• a rule, enforced by design and in the back end when live, that no automated process spends money, publishes content, or sends bulk messages without a human approving it;
• server-side session management (HttpOnly, Secure, SameSite cookies), rate limiting, server-side authorization checks, and an audit log of administrative actions, once the back end is live;
• vulnerability handling, dependency updates, and the incident response procedures in the Acceptable Use and Security Policy;
• multi-factor authentication on every founder account at every Subprocessor that supports it.

Torvara's Security Hardening Plan describes which measures are currently in place and which are planned; Torvara will provide the current version on request and will not reduce the overall level of protection during the term.

7. Security Incident notification

7.1 Notice to Client. Torvara will notify Client's designated contact without undue delay and in any event within 72 hours after confirming a Security Incident affecting Client Data. Initial notice may be by phone or email and will include what Torvara then knows: the nature of the incident, the categories and approximate number of individuals and records affected, the likely consequences, the measures taken or proposed, and a contact for more information. Torvara will update the notice as it learns more.

7.2 Cooperation. Torvara will take reasonable steps to contain and remediate the incident, preserve evidence, and cooperate with Client's investigation and any notification Client must make.

7.3 Statutory notices. The parties acknowledge that state breach-notification laws impose duties on the owner or licensor of the data (generally Client) and on the entity that maintains it (Torvara), including under the Michigan Identity Theft Protection Act (notice to affected Michigan residents without unreasonable delay) and the Florida Information Protection Act (notice to affected Florida residents within 30 days of determination of a breach, and to the Florida Attorney General when more than 500 Florida residents are affected; a third-party agent that maintains data must notify the data owner within 10 days). Unless the parties agree otherwise in writing for a specific incident, Client will make notices to individuals and regulators as data owner, and Torvara will give Client the information needed to do so within the timelines above. Torvara will not notify individuals or regulators on Client's behalf, or describe the incident publicly, without Client's written consent, except where Torvara is itself legally required to do so, in which case it will tell Client first where the law allows.

7.4 Not an admission. Notification of a Security Incident is not an admission of fault or liability.

8. Assistance with individual rights requests

If Torvara receives a request from an individual to access, correct, delete, or port their Personal Information, or to opt out of texts or emails, in connection with Client Data, Torvara will (a) honor STOP and unsubscribe requests immediately as processor, since these are standing instructions; (b) forward any other request to Client within 5 business days; and (c) assist Client in responding, using the Console's export, correction, and deletion functions, within 10 business days of Client's instruction or sooner where the law's deadline requires. Torvara will also provide reasonable assistance with Client's data protection assessments, and with inquiries from regulators, at Torvara's then-current hourly rate where the assistance exceeds [ASSISTANCE HOURS INCLUDED, e.g. 4] hours in a calendar quarter.

9. Audits and information

Torvara will make available to Client the information reasonably necessary to demonstrate compliance with this DPA, including a completed security questionnaire, the current Security Hardening Plan, and summaries of any third-party assessments. Not more than once per 12 months (or following a Security Incident), Client or an independent auditor bound by confidentiality may conduct a reasonable audit of Torvara's relevant processing on 30 days' written notice, during business hours, without disrupting Torvara's operations, and at Client's expense. Torvara may take reasonable and appropriate steps to stop and remediate any unauthorized use of Client Data that an audit reveals. Client may, on reasonable notice, take reasonable and appropriate steps to ensure Torvara uses Client Data consistently with Client's obligations under Applicable Privacy Law.

10. Return and deletion

On termination or expiration of the Service Agreement, or on Client's earlier written request, Torvara will, at Client's choice, return Client Data in a common machine-readable format (JSON or CSV, with media files) and then delete it, or simply delete it, from all systems Torvara controls within 60 days, and will instruct Subprocessors to do the same. Torvara will confirm deletion in writing on request. Exceptions: (a) consent and opt-out records, which Torvara may retain in a form that no longer identifies the individual beyond a hashed phone number or email so that opt-outs continue to be honored; (b) records Torvara must retain by law; (c) data in encrypted backups, which will be overwritten on the normal backup rotation of not more than [BACKUP RETENTION] and remain protected by this DPA until then; and (d) data Torvara keeps for its own use under Section 3.3A, which survives termination. Encrypted backups stored on Client's own devices are Client's responsibility.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Service Agreement and Platform Terms of Service, which apply in aggregate across those documents and this DPA. Nothing in this DPA limits liability that cannot be limited by law. Torvara will be liable to Client for the acts and omissions of its Subprocessors as if they were its own. Client will indemnify Torvara for claims arising from Client Data that Client had no right to provide, instructions that violate Applicable Privacy Law, and messages Client directed to people who had not consented or had opted out, in each case as set out in the Platform Terms of Service.

12. Term and general

This DPA lasts as long as Torvara processes Client Data. It is governed by the law and dispute-resolution terms of the Service Agreement. If any provision is unenforceable, the rest remains in effect and the parties will replace it with a valid provision that achieves its purpose. This DPA may be signed in counterparts and electronically.

Annex 1: Subprocessors

Annex 2: U.S. State Privacy Law Addendum

A2.1 Application. This Annex applies to the extent Client is subject to a U.S. state comprehensive privacy law (a "State Law") with respect to Client Data, and supplements the DPA.

A2.2 California. Where the CCPA applies, Torvara acts as a "service provider" and "contractor" when it processes Client Data to provide the services, and as a third party when it uses data under Section 3.3A. For the services, Torvara will notify Client within 5 business days if it determines it can no longer meet its obligations under the CCPA; grants Client the rights in Section 9 to take reasonable steps to ensure compliant use and to stop and remediate unauthorized use; and will comply with the CCPA and provide the same level of privacy protection as the CCPA requires of businesses.

A2.3 Florida, Virginia, Colorado, Connecticut, Texas, Oregon, and other State Laws. Where a State Law applies, this DPA is the contract between controller and processor required by that law. Torvara will, for the services: process Client Data on Client's instructions (Section 3.3A covers Torvara's own use); ensure each person processing it is subject to a duty of confidentiality; engage Subprocessors only under a written contract meeting the requirements of the State Law and after the notice-and-objection process in Section 5; delete or return Client Data at the end of the services as provided in Section 10; make available all information necessary to demonstrate compliance; and allow and cooperate with reasonable assessments as provided in Section 9, or arrange an independent assessment and provide the report.

A2.4 Consumer-facing duties. Where a State Law grants consumers rights, Torvara will assist Client as provided in Section 8, using appropriate technical and organizational measures, and will honor any universal opt-out signal that Client instructs Torvara to recognize on Client's Portals (and, where data is sold or shared under Section 3.3A, the opt-out signals the State Law requires).

A2.5 Children. Neither party will knowingly process Personal Information of children under 13 through the Console. For minors under 18, Client will collect and enter only information provided by a parent or guardian, and Torvara will not send texts or emails to a number or address Client has flagged as belonging to a minor.

A2.6 Regulated clients. If Client is subject to the Gramm-Leach-Bliley Act (for example, a mortgage lender), Client confirms that no nonpublic personal information subject to that Act will be entered into the Console except contact information for marketing communications with appropriate consent, and Torvara will treat all Client Data as confidential under this DPA.