Data Processing Agreement

"Personal data", "processing", "controller", "processor", "data subject" and "supervisory authority" have the meanings given in the Data Protection Act 2017 (Mauritius). "Services" means the Priva compliance platform subscribed to by the Controller.

This DPA applies to all personal data processed by Priva on behalf of the Controller in connection with the Services. It remains in force for the duration of the subscription agreement and until all personal data has been returned or deleted.

Priva processes personal data solely to provide the Services contracted by the Controller. Processing activities include: storage and retrieval of compliance records, DSAR workflow management, breach register maintenance, and generation of compliance reports.

Priva shall: (a) process personal data only on documented instructions from the Controller; (b) ensure confidentiality obligations on authorised personnel; (c) implement appropriate technical and organisational security measures; (d) assist the Controller in fulfilling data subject rights requests; (e) notify the Controller of any data breaches without undue delay; (f) delete or return all personal data on termination of Services.

Priva engages the following sub-processors, each under a written agreement imposing data-protection obligations equivalent to this DPA (DPA 2017 ss.36-37): Vercel Inc. for application hosting, edge delivery and serverless execution of the platform, primarily in the United Kingdom (London region); Supabase Inc. for the managed database (Records of Processing Activities, DSAR case files, breach records, DPIAs and platform user accounts), authentication, encrypted file storage and automated encrypted backups, hosted in Ireland (EU); Stripe, Inc. for processing of Priva subscription payments, including the Controller's billing contact details and payment instrument data, in the United States; and Anthropic PBC for AI-assisted document and identity verification where the KYC feature is used, in the United States. The primary application and database infrastructure is deliberately located in the United Kingdom and the European Union (Ireland), jurisdictions recognised as offering an adequate level of protection. Personal data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256); access is role-based, least-privilege and audit-logged; and Standard Contractual Clauses apply to any US-based corporate access. The Controller provides prior authorisation for these sub-processors via this DPA at onboarding, and Priva will notify the Controller in advance of any proposed change to the sub-processor list.

Where data subjects exercise their rights directly with Priva, Priva will redirect such requests to the Controller within 5 working days. Priva will provide reasonable technical assistance to the Controller in responding to data subject rights requests.

Priva implements: AES-256 encryption at rest; TLS 1.2 or higher in transit; per-Controller data isolation through database row-level security; least-privilege access controls; salted and hashed password storage (bcrypt); automated encrypted daily backups; and a documented incident-response procedure. Multi-factor authentication, application-level rate limiting, and independent penetration testing are planned enhancements.

Priva shall notify the Controller of any personal data breach without undue delay, and in any event no later than 72 hours after becoming aware. Notifications will include: nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed. Priva will cooperate with the Controller in any notification the Controller must make to the Data Protection Office.

Upon termination of the Services, Priva will make all personal data available for export for 90 days. After this period, Priva will securely delete all personal data and provide a written confirmation of deletion on request.

This DPA is governed by the laws of the Republic of Mauritius. The Data Protection Act 2017 applies to all processing activities. Any disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts of Mauritius.