Data Processing Addendum

Last updated: 2026-04-18

This Data Processing Addendum ("DPA") forms part of the Terms of Service between the customer that accepted the Terms of Service ("Customer", Controller) and Express Loop LLC (d/b/a "Daba")("Company", Processor), collectively the "Parties".

1. Definitions

"Data Protection Laws" means all applicable data protection and privacy laws, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, and the California Consumer Privacy Act ("CCPA"/"CPRA"). Other terms ("Personal Data", "Processing", "Data Subject", "Sub-processor") have the meanings given in Data Protection Laws.

2. Subject Matter & Duration

Company processes Personal Data on behalf of Customer for the purpose of providing the DabaRank service. Processing lasts for the duration of the underlying agreement and any legally required retention period afterward.

3. Categories of Data & Data Subjects

Categories of Personal Data: business contact data (name, email, role), authentication identifiers, usage metadata, and any Personal Data Customer chooses to include in prompts or content.
Categories of Data Subjects:Customer's authorized users; any individuals Customer references in content submitted to the Service.

4. Company Obligations

Process Personal Data only on documented instructions from Customer.
Ensure personnel processing Personal Data are under confidentiality obligations.
Implement appropriate technical and organizational measures — encryption at rest and in transit, tenant isolation, access controls, audit logging, incident response.
Assist Customer in responding to Data Subject Requests and regulator inquiries.
Notify Customer without undue delay — and no later than 72 hours — after becoming aware of a Personal Data breach.
Return or delete Personal Data at the end of the agreement, subject to legal retention obligations.
Make available information necessary to demonstrate compliance.

5. Sub-processors

Customer authorizes Company to engage the sub-processors listed in the Privacy Policy. Company will:

Impose data-protection obligations on sub-processors equivalent to those in this DPA.
Notify Customer at least 30 days before adding or replacing a sub-processor; Customer may reasonably object in writing.

6. AI Processing Notice

The Service transmits content Customer configures to third-party AI providers. Customer is responsible for ensuring that content submitted to prompts does not include Personal Data, confidential information, or regulated data (e.g., PHI, payment data) beyond what is permitted by those providers' terms.

7. International Transfers

Where Personal Data is transferred outside the EEA, UK, or Switzerland, the parties rely on the EU Standard Contractual Clauses (Module 2 — Controller to Processor), the UK International Data Transfer Addendum, and equivalent safeguards, all of which are incorporated by reference. Execute the applicable SCCs/IDTA as Annex A.

8. Security Measures

Encryption in transit (TLS 1.2+) and at rest (AES-256).
Least-privilege IAM; MFA required for administrators.
Logical tenant isolation enforced in every database query; automated tests verify cross-tenant access returns 403/404.
Centralized audit logging of authentication, authorization, and data-mutation events.
Regular dependency scans, quarterly penetration testing, annual third-party security review.
Incident response plan with 72-hour notification commitment.
Encrypted backups with rotation and documented restore testing.

9. Liability

Liability under this DPA is subject to the limitations set forth in the Terms of Service.

10. Execution

This DPA is effective on signature by both parties. Contact [email protected] to request an executable copy or for negotiated redlines.