LEGAL / DATA PROCESSING AGREEMENT
Data duties.
Written down.
Reference version dated September 20, 2026
How this document takes effect. This Data Processing Agreement (“DPA”) is a public reference form. It becomes binding only when a signed proposal, order, statement of work or master services agreement (the “Order”) identifies the customer and service provider, completes the processing details and incorporates this DPA. It does not create a customer relationship by itself.
1. Scope and priority
This DPA applies only to Customer Personal Data that the service provider identified in the Order (“SoFloAI”) processes on the customer’s behalf to provide the services in that Order. The Order and this DPA form the “Agreement.” If they conflict about processing Customer Personal Data, this DPA controls; the Order controls the commercial scope. A business associate agreement or legally required transfer addendum controls for its specific subject.
2. Definitions and roles
“Customer Personal Data” means personal data, personal information or a similar protected category submitted to or collected through the services for the customer. “Data Protection Law” means privacy and data-protection law that applies to that processing. “Personal Data Breach” means a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Personal Data.
The customer is the controller or business for Customer Personal Data. SoFloAI is the processor or service provider only to the extent it processes that data on the customer’s behalf. If the customer acts as a processor, it confirms that the relevant controller authorized the customer’s instructions and SoFloAI’s appointment.
3. Processing details and instructions
SoFloAI will process Customer Personal Data only to provide, secure and support the agreed services; follow the customer’s documented lawful instructions; comply with law; and perform the processing described in Annex A and the Order. The Agreement, configuration choices and written support requests are documented instructions.
If SoFloAI believes an instruction violates Data Protection Law, it may pause the affected processing and inform the customer unless law prohibits notice. Any material expansion in purpose, data or data subjects must be documented before the expanded processing begins.
4. Customer responsibilities
The customer determines whether and how to use the services and is responsible for providing lawful instructions, notices and choices; establishing a lawful basis; collecting only data needed for the stated purpose; keeping data accurate; configuring access; and responding to individuals and regulators as controller. The customer must not provide sensitive or regulated data unless the Order expressly permits it and identifies the additional safeguards and agreements.
5. Confidentiality
SoFloAI will limit access to people who need Customer Personal Data to perform the services and who are bound by an appropriate duty of confidentiality. The customer will limit access to its own authorized users and protect its credentials.
6. Security
Taking account of the processing, available technology, implementation cost and risks to people, SoFloAI will maintain reasonable administrative, technical and organizational measures designed to protect Customer Personal Data. The controls actually applicable to a custom service must be recorded in the Order or a Security Schedule and should address access, authentication, transmission, storage, logging, recovery, change control, deletion and incident response. This public DPA does not claim that every custom system uses the same controls or holds a certification.
7. Personal Data Breaches
SoFloAI will notify the customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. As information becomes available, the notice will describe the nature of the incident, affected data, likely consequences, containment or remediation and a contact for follow-up. SoFloAI will take reasonable steps to contain and investigate the incident and will assist with notices the customer is legally required to make. The customer decides whether it must notify individuals or authorities unless law assigns that duty to SoFloAI.
8. Individual requests and compliance assistance
Taking account of the nature of the processing and information available, SoFloAI will provide reasonable assistance with verified requests to access, correct, delete, restrict, object to or obtain Customer Personal Data; security obligations; data-protection assessments; and consultations with regulators. If SoFloAI receives a request directly about Customer Personal Data, it will direct the requester to the customer unless law requires a different response.
9. Subprocessors
The customer gives general authorization for the subprocessors listed in the Order or the service-specific subprocessor schedule supplied before processing begins. SoFloAI will use a written agreement requiring each subprocessor to protect Customer Personal Data in a manner appropriate to its role and will remain responsible for its processing obligations under this DPA.
If a new subprocessor will materially change the agreed processing, SoFloAI will provide advance notice through the method stated in the Order and allow a reasonable, documented objection based on data-protection grounds. The parties will work in good faith on a practical alternative; if none is reasonably available, the Order governs termination of the affected service.
10. Government and legal requests
If legally permitted, SoFloAI will notify the customer of a binding request for Customer Personal Data and will limit disclosure to what the request lawfully requires. SoFloAI may challenge a request when there are reasonable grounds and the Agreement assigns that work.
11. Return and deletion
At the customer’s choice after the relevant service ends, SoFloAI will return or delete Customer Personal Data within its control, except data that law requires it to keep. Data in backups may remain until overwritten through the documented backup cycle and remains protected while retained. The Order must identify the export method, exit assistance, deletion timing and any records that must be preserved.
12. Information and assessments
Upon reasonable written request, SoFloAI will make available information in its possession needed to demonstrate compliance with this DPA. Where required by applicable law, it will cooperate with a reasonable assessment by the customer or a qualified independent assessor. Reviews must protect other customers, confidential information and system security, avoid unnecessary disruption and use existing reports before custom testing where those reports reasonably answer the request. Any cost allocation belongs in the Order.
13. International transfers
The Order must identify expected hosting or access locations. If Data Protection Law requires a transfer mechanism, the parties will complete the applicable standard contractual clauses or other approved mechanism before the restricted transfer. This DPA does not by itself authorize a transfer that would otherwise be unlawful.
14. U.S. state privacy terms
Where applicable U.S. state privacy law treats SoFloAI as a processor, service provider or contractor, SoFloAI will process Customer Personal Data only for the limited purposes in the Agreement; will not sell or share it for cross-context behavioral advertising; will not retain, use or disclose it outside the agreed business purpose except as law permits; will provide the level of protection required of that role; and will notify the customer if SoFloAI determines it can no longer meet those obligations. The customer may take reasonable steps to verify, stop and remediate unauthorized use.
15. Health and payment data
This DPA is not a HIPAA business associate agreement and does not authorize protected health information. It also does not authorize SoFloAI to store full payment-card numbers, card security codes or authentication data. Those data may be processed only under a separately approved architecture and any contract required for the specific service.
16. Term
This DPA lasts while SoFloAI processes Customer Personal Data under the Order. Duties that by their nature continue after processing ends, including confidentiality, security while data is retained and return or deletion, continue until satisfied. Liability, governing law and dispute terms are those in the Order.
Annex A — Processing details
The Order must complete each item before Customer Personal Data is processed:
- Parties and roles: customer, service provider, contacts, controller/processor roles.
- Subject matter and service: the specific application, workflow, production or support service.
- Duration and frequency: project dates and whether processing is one-time, periodic or continuous.
- Nature and purpose: the operations performed and the business purpose they support.
- People: categories of data subjects.
- Data: categories of personal data and any expressly approved sensitive data.
- Locations and transfers: expected hosting/access locations and any transfer mechanism.
- Retention and exit: export, return, deletion, backup cycle and legally required records.
Annex B — Security Schedule
The Order or attached Security Schedule must record the measures that actually apply to the service. Review access control and unique identities; privileged access and authentication; encryption in transit and, where applicable, at rest; secrets management; logging and review; tenant or project separation; backups and restore testing; secure development and change control; vulnerability and dependency management; incident response; vendor access; retention; deletion; and workforce confidentiality.
Annex C — Subprocessors
Before processing begins, the service-specific schedule must identify each subprocessor’s legal name, service, processing purpose, data categories and primary processing location. Website providers named in the Data Privacy Policy are not automatically the subprocessors for every customer project.
Contact and signed copy
To request a service-specific processing schedule or a DPA ready for signature, contact Support@sofloai.solutions.