Respona Data Processing Addendum

Last updated: 12/09/2025

01. Introduction

This Data Processing Addendum (this “Addendum” or “DPA”) is supplementary to and forms part of the terms of service available at https://respona.com/terms-of-use/ or such other URL as Respona may designate from time to time (the “Agreement”) between:

• Respona, LLC, a Delaware limited liability company doing business as Respona (“Respona”), and
• the entity or person(s) identified as customer in the relevant customer account or order form referencing this Addendum (as applicable) (“Customer”).
  This Addendum applies where and to the extent that Respona is acting as a Processor or service provider (as applicable) of Personal Data on behalf of Customer under the Agreement. In the event of any conflict between this Addendum and the Agreement, this Addendum shall prevail to the extent of such conflict.

02. Definitions and Interpretation

In this Addendum, the following terms shall have the meanings set out below:

• Affiliate means, with respect to a party, any entity that directly or indirectly controls, is controlled by, or is under common control with that party.

• Applicable Privacy Laws means all worldwide data protection and privacy laws and regulations applicable to the Personal Data in question including, where applicable:

  1. European Privacy Laws;
  2. the Australian Privacy Act 1988 (Cth);
  3. the New Zealand Privacy Act 2020;
  4. the Philippines Republic Act No. 10173;
  5. the Brazilian Data Protection Law (Brazil) No. 13,709/2018;
  6. the California Consumer Privacy Act of 2018;
  7. the Virginia Consumer Data Protection Act of 2021;
  8. any similar United States state privacy laws to the extent applicable.

• Data Subject means an identified or identifiable natural person whose Personal Data is processed.

• Personal Data means any information relating to an identified or identifiable individual or any other information defined as “personal data” or “personal information” under Applicable Privacy Laws.

03. Processing of Personal Data

3.1 Relationship of the parties
Customer is a Controller or Business (as applicable) of the Personal Data that it provides or otherwise makes available to Respona under the Agreement (the “Data”). Respona shall process the Data solely as a Processor or Service Provider (as applicable) on behalf of Customer. Respona and Customer shall each comply with their respective obligations under Applicable Privacy Laws with respect to such processing.

3.2 Purpose limitation
Respona shall process the Data as necessary to perform its obligations under the Agreement strictly in accordance with the documented instructions of Customer (the “Permitted Purpose”). Respona shall not:

• (a) retain, use, disclose, or otherwise process the Data for any purpose other than the Permitted Purpose;
• (b) sell or share the Data.

04. International Transfers and Standard Contractual Clauses

4.1 International transfers
To the extent that Respona transfers the Data to a country other than the country in which the Data was first collected, Respona shall take such measures as are necessary to ensure that the transfer is made in compliance with Applicable Privacy Laws.

4.2 Standard Contractual Clauses (EEA)
To the extent that the transfer of Data involves a Restricted Transfer, the SCCs shall be incorporated by reference and form an integral part of this Addendum.

05. Confidentiality of Processing

Respona shall ensure that any person it authorizes to process the Data is subject to a strict duty of confidentiality.

06. Security

Respona shall implement appropriate technical and organizational measures to protect the Data from accidental or unlawful destruction.

07. Subprocessing

Customer authorizes Respona to engage third party Processors to process the Data for the Permitted Purpose.

08. Cooperation and Data Subject Rights

Respona shall provide all reasonable assistance to Customer, at Customer’s cost, to enable Customer to respond to any request from a Data Subject to exercise its rights under Applicable Privacy Laws.

09. Data Protection Impact Assessments

Respona shall provide Customer with all reasonable assistance, at Customer’s cost, as Customer may require in order to conduct data protection impact assessments.

10. Security Incidents

Upon becoming aware of a Security Incident affecting the Data, Respona shall inform Customer without undue delay.

11. Deletion or Return of Data

Upon termination or expiry of the Agreement, Respona shall, at Customer’s written election, either:

• (a) delete all Data in its possession or control; or
• (b) return to Customer all Data in its possession or control and then delete existing copies.

12. Audit Rights

Customer shall have the right, at its own expense, to verify Respona’s compliance with the obligations set forth in this Addendum.

13. Prohibited Data Types

Customer is solely responsible for determining whether the Data it provides to Respona is appropriate for the Services.

14. Processing Duration

Respona shall process the Data only for the duration of the Agreement and solely for the Permitted Purpose.

15. Modifications to this DPA

Respona may modify this Addendum to reflect changes in Applicable Privacy Laws.

16. ANNEX I – DESCRIPTION OF PROCESSING ACTIVITIES

This Annex describes the subject matter, nature, purpose, and duration of Respona’s processing of Personal Data on behalf of Customer.

1. Categories of Data Subjects Respona processes Personal Data relating to individuals whose information Customer elects to upload.
2. Categories of Personal Data The Personal Data processed by Respona may include identifiers such as names and email addresses.
3. Nature and Purpose of the Processing Respona processes Personal Data solely for the purpose of providing the Services.
4. Subject Matter and Duration of Processing The subject matter of the processing is the Personal Data that Customer submits to or makes available within the Services.

17. ANNEX II – TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

This Annex describes technical and organizational measures implemented by Respona to protect Personal Data.

1. Governance and Information Security Program Respona maintains a formal information security program overseen by senior management.
2. Risk Assessment and Risk Management Respona conducts periodic risk assessments of threats to Personal Data.
3. Encryption and Cryptographic Protections Personal Data is encrypted during transmission over public networks.
4. Access Controls and Identity Management Respona maintains a rigorous access control framework.
5. Physical and Environmental Safeguards Respona relies on reputable cloud hosting providers with robust physical protections.
6. Network Security and System Hardening Respona’s systems are protected by network segmentation and firewall rules.
7. Secure Development and Change Management Respona follows secure development lifecycle practices.
8. Monitoring, Logging, and Audit Trails Respona maintains system and application logs of relevant security events.
9. Personnel Security and Training All personnel authorized to process Personal Data are subject to confidentiality obligations.
10. Incident Detection, Response, and Mitigation Respona maintains a written incident response plan.
11. Business Continuity and Disaster Recovery Respona maintains and periodically updates business continuity procedures.
12. Subprocessor Security Oversight Respona conducts security reviews before engaging a Subprocessor.
13. Data Minimization and Segregation Respona designs its systems to limit access to Personal Data.
14. Ongoing Evaluation and Continuous Improvement Respona conducts periodic reviews of its security practices.