Data Processing Agreement

In this DPA, the following terms have the meanings below:

• "Controller" means the Customer, who determines the purposes and means of processing personal data.
• "Processor" means us, Digital Search Group Limited, who processes personal data on behalf of the Customer.
• "Personal data" means any information relating to an identified or identifiable natural person.
• "Subprocessor" means a third party engaged by us to assist in processing personal data.

The Customer is the Controller (or Processor acting on behalf of its own Controller). We are the Processor. We process personal data only on the Customer's documented instructions — namely, to run the assessment and verification service as described in the Terms of Service.

The Customer warrants that it has the right to submit website URLs for assessment and that doing so does not breach any applicable law or third-party rights.

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit (TLS) and at rest (database-level encryption).
• Row-level security policies restricting data access to authorised users.
• Role-based access control for administrative functions.
• Regular security scanning and dependency monitoring.
• Authentication using hashed credentials with rate limiting.

We engage the subprocessors listed at /subprocessors. We remain liable for the acts and omissions of our subprocessors to the same extent as our own.

We will give the Customer at least 30 days' notice before adding or replacing a subprocessor. The Customer may object and, if we cannot resolve the objection, terminate the service without penalty.

We will assist the Customer in responding to data subject requests to the extent they relate to data processed through the service. We will forward any request we receive directly to the Customer unless we are legally prohibited from doing so.

If we become aware of a personal data breach, we will notify the Customer without undue delay and provide the information the Customer needs to meet its own breach notification obligations.

On termination of the service, we will delete the Customer's personal data in accordance with the retention periods set out in our Privacy Notice at /privacy, unless applicable law requires longer retention.

The Customer may audit our compliance with this DPA once per calendar year with at least 30 days' notice, subject to confidentiality obligations.

To execute this DPA or ask a question, contact privacy@carbonverified.org.