This Data Processing Addendum (“DPA”) forms part of the Terms of Service (the “Agreement”) between Daros Systems, Inc., a Delaware corporation (“Daros,” “we,” or “Processor”), and the customer identified in the Agreement (“Customer” or “Controller”) for the provision of the Provendor lead-list and market-report service (the “Service”). It reflects the parties' obligations under Regulation (EU) 2016/679 (“GDPR”), the UK GDPR, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”) (collectively, “Data Protection Laws”). In the event of a conflict between this DPA and the Agreement, this DPA prevails with respect to Processing of Customer Personal Data.
Capitalized terms not defined here have the meaning given in the Agreement or Data Protection Laws.
In the standard operation of the Service, buyers do not upload personal data into a platform, and Daros acts as an independent Controller of the business-listing data it compiles from publicly available sources and sells, as described in our Privacy Policy. This DPA does not apply to that independent-controller Processing.
This DPA applies only in the limited cases where Daros Processes Personal Data on Customer's documented instructions (for example, a bespoke or custom-research request). In those cases, Customer is the Controller and Daros is the Processor of Customer Personal Data. Where Customer acts as a Processor for its own customer, Daros acts as Sub-processor and the parties agree that Module 3 of the SCCs applies where required. This DPA applies for the term of the Agreement and survives termination to the extent Daros continues to Process Customer Personal Data.
The subject matter of Processing is the provision of the Service to Customer. Where this DPA applies, the nature and purpose of Processing is to carry out the bespoke or custom request that Customer has documented — for example, compiling, researching, or delivering data to Customer's specification — as described in the Agreement.
Data Subjectsmay include: Customer's employees and contractors interacting with Daros; and individuals referenced in the data covered by Customer's documented instructions (e.g., business points of contact).
Categories of Personal Datamay include: name, business email address, business phone number, job title, employer name, IP address, device and usage data, and any other Personal Data covered by Customer's documented instructions. Customer must not instruct Daros to Process special categories of data (GDPR Art. 9), government identifiers, payment card data, or protected health information unless expressly agreed in writing.
Daros will Process Customer Personal Data only on Customer's documented instructions, including as necessary to (a) provide and support the Service, (b) comply with the Agreement, and (c) comply with applicable law. The Agreement and the Customer's use of Service configuration constitute Customer's complete and final documented instructions at the time of execution. Additional instructions require written agreement between the parties. Daros will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.
Daros ensures that personnel authorized to Process Customer Personal Data are bound by appropriate confidentiality obligations and have received training relevant to their role.
Daros implements and maintains the technical and organizational measures described in Annex II to ensure a level of security appropriate to the risk. Daros regularly reviews these measures and may update them provided the updates do not materially degrade the overall security of the Service.
Customer provides a general authorization for Daros to engage Sub-processors, subject to the safeguards in this Section. A current list of Sub-processors is maintained at provendor.io/sub-processors and summarized in Annex III.
Daros will (a) enter into a written agreement with each Sub-processor that imposes data protection obligations substantially similar to those in this DPA; (b) remain liable for each Sub-processor's acts and omissions as if they were its own; and (c) provide at least 30 days' advance notice of new Sub-processors by updating the public list (and, on request, notifying Customer by email). Customer may object in writing on reasonable data-protection grounds, in which case the parties will work in good faith to resolve the objection; if unresolved, Customer may terminate the affected portion of the Service for convenience.
Where Daros Processes Customer Personal Data originating in the European Economic Area, the United Kingdom, or Switzerland in a country that has not received an adequacy decision, the transfer is governed by the SCCs (and, for UK data, the UK IDTA), which are incorporated into this DPA by reference. For purposes of the SCCs:
For Customer Personal Data subject to Swiss FADP, references to the GDPR are deemed references to the FADP and the competent authority is the Swiss Federal Data Protection and Information Commissioner.
Taking into account the nature of Processing, Daros provides the Service features that enable Customer to access, correct, export, and delete Customer Personal Data. Where Daros receives a request directly from a Data Subject, Daros will, unless legally required to respond, promptly forward the request to Customer and will not respond except on Customer's instruction. Daros will provide reasonable assistance to enable Customer to respond to Data Subject requests.
Daros will notify Customer without undue delay and in any event within 72 hoursof becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe the nature of the incident, categories and approximate number of Data Subjects and records concerned, likely consequences, and measures taken or proposed to address the incident and mitigate its effects. Daros will provide updates as the investigation progresses and cooperate with Customer's reasonable efforts to meet any regulatory notification obligations.
Daros will provide reasonable assistance to Customer in carrying out data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of Processing and the information available to Daros.
Daros will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA. On Customer's written request no more than once per calendar year (and at any time following a Security Incident affecting Customer Personal Data), Daros will provide (a) a copy of its most recent third-party security audit report (e.g., SOC 2 Type II or equivalent) under NDA, and (b) written responses to a reasonable security questionnaire. Where the audit report is insufficient to demonstrate compliance and Data Protection Laws require an on-site audit, the parties will agree the scope, timing, and cost in advance, conducted during business hours by a mutually acceptable auditor subject to appropriate confidentiality obligations.
On termination or expiration of the Agreement, Daros will delete or return Customer Personal Data as provided in the Agreement and Privacy Policy. Customer may export its data through the Service for at least 30 days after termination. Thereafter, Daros will delete Customer Personal Data from active systems within 30 days and from backups within 90 days, except where applicable law requires continued retention or as necessary to defend legal claims.
Each party's liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitations of liability set forth in the Agreement. Where permitted by applicable law, this allocation applies to claims among the parties and does not limit the rights of Data Subjects under the SCCs.
This DPA is governed by the laws of the State of Delaware, USA, except that Clauses 17 and 18 of the SCCs are governed by Irish law and subject to the jurisdiction of the Irish courts, as required by the SCCs.
This DPA supersedes any prior data processing agreements between the parties with respect to the Service. If you require a countersigned copy for your records, email Legal@daros.ai from a verified customer account and we will execute the DPA.
Data Exporter (Controller): Customer, as identified in the Agreement. Contact point: the Customer administrator email on file.
Data Importer (Processor): Daros Systems, Inc., a Delaware corporation. Contact: Legal@daros.ai.
The supervisory authority of Ireland (Data Protection Commission) for EEA transfers; the UK ICO for UK transfers; the Swiss FDPIC for Swiss transfers.
Daros implements and maintains measures designed to protect Customer Personal Data against a Security Incident. These measures include:
The current list of Sub-processors is published at provendor.io/sub-processors and is incorporated by reference. Categories typically include payment processing, cloud hosting and database, AI/LLM inference, business-listing and search data providers, transactional email, and analytics. Daros provides at least 30 days' advance notice of new Sub-processors as described in Section 8.
Data protection, privacy & security inquiries: Legal@daros.ai.