Data Processing Agreement

Capitalized terms not defined here have the meanings given in the GDPR. 'Customer' means the entity contracting with IGENPAXY for services. 'Personal Data' means any information relating to an identified or identifiable natural person.

Customer is the Controller and IGENPAXY is the Processor with respect to Personal Data processed under the services agreement. Each party will comply with applicable data protection laws.

IGENPAXY will process Personal Data only on documented instructions from Customer, including with regard to international transfers, unless required by law.

IGENPAXY ensures personnel authorized to process Personal Data are bound by confidentiality obligations and trained on data protection.

IGENPAXY implements appropriate technical and organizational measures to protect Personal Data, including encryption in transit and at rest, access controls, secure software development practices, and incident response procedures.

Customer authorizes IGENPAXY to engage sub-processors as necessary to provide the services. A current list is maintained at igenpaxy.com/legal/dpa#subprocessors. IGENPAXY will provide notice of new sub-processors and an opportunity to object.

IGENPAXY will provide reasonable assistance to Customer in responding to data subject requests, taking into account the nature of processing and the information available.

IGENPAXY will notify Customer without undue delay after becoming aware of a Personal Data breach and provide information reasonably required to comply with notification obligations.

Where Personal Data is transferred outside the EEA, UK, or Switzerland, the parties agree to rely on Standard Contractual Clauses or other adequate transfer mechanisms.

IGENPAXY will make available information necessary to demonstrate compliance with this DPA and allow for audits, including inspections, conducted by Customer or its mandated auditor, subject to reasonable notice and confidentiality obligations.

Upon termination of services, IGENPAXY will delete or return Personal Data to Customer, subject to legal retention requirements.

Questions about this DPA: privacy@igenpaxy.com.