Data Processing Addendum
Last updated: September 8, 2026
This Data Processing Addendum ("DPA") supplements our Terms of Service and applies automatically whenever DigVel processes personal data on a Client's behalf in the course of delivering the Services, in addition to any Statement of Work between the parties.
1. Purpose & Precedence
This DPA reflects the parties' agreement regarding the processing of personal data in connection with the Services described in the underlying Statement of Work ("SOW"). In the event of a conflict between this DPA and the SOW regarding data protection matters, this DPA controls.
2. Definitions
Terms such as "Controller", "Processor", "Personal Data", "Processing", and "Data Subject" have the meanings given to them under applicable data protection law, including the EU/UK GDPR and, where applicable, the California Consumer Privacy Act ("CCPA").
3. Scope & Roles
For personal data contained within software, files, or system information Client submits to DigVel for analysis ("Engagement Data"), Client acts as Controller and DigVel acts as Processor (or, where Client itself is a Processor for its own customers, DigVel acts as a Sub-processor). DigVel processes Engagement Data only to perform the Services described in the SOW.
4. Processing Instructions
DigVel will process Engagement Data only on Client's documented instructions, including those set out in this DPA and the SOW, unless required to do otherwise by law, in which case DigVel will inform Client of that legal requirement before processing (unless the law prohibits such notice).
5. Confidentiality of Personnel
DigVel ensures that personnel authorized to process Engagement Data are subject to confidentiality obligations, whether contractual or statutory.
6. Security Measures
DigVel implements technical and organizational measures designed to protect Engagement Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage, appropriate to the risk, including isolated sandbox environments for dynamic analysis, encryption of data at rest and in transit, role-based access controls, and activity logging.
7. Sub-processors
Client authorizes DigVel to engage the sub-processors listed on DigVel's Subprocessors page. DigVel will notify Client of any intended changes to that list, giving Client the opportunity to object on reasonable data-protection grounds within 14 days. DigVel remains responsible for its sub-processors' compliance with obligations equivalent to this DPA.
8. International Transfers
DigVel and its current clients are based in the United States, and Engagement Data is not currently transferred outside the country in which it was collected. If a future engagement requires an international transfer (for example, a client based in the EU or UK), the parties will attach an appropriate transfer mechanism, such as Standard Contractual Clauses, as an exhibit to this DPA before that transfer occurs.
9. Data Subject Request Assistance
DigVel will provide reasonable assistance to Client in responding to requests from data subjects to exercise their rights under applicable data protection law, to the extent DigVel's processing of Engagement Data is implicated.
10. Audit Rights
On reasonable prior written notice and no more than once per 12-month period, Client may request information reasonably necessary to demonstrate DigVel's compliance with this DPA, subject to DigVel's confidentiality obligations to its other clients.
11. Breach Notification
DigVel will notify Client without undue delay, and in any event within 48 hours of becoming aware, of any confirmed unauthorized access to or disclosure of Engagement Data, and will provide reasonably requested information to assist Client in meeting its own notification obligations.
12. Return or Deletion on Termination
As described in DigVel's Privacy Policy, Engagement Data is deleted upon completion of the engagement in the ordinary course, and is not retained beyond that point. If the applicable SOW terminates before completion, DigVel will delete any Engagement Data already received within 30 days of termination, except to the extent retention is required by law.
13. Liability & Term
This DPA remains in effect for as long as DigVel processes Engagement Data on Client's behalf. Liability under this DPA is subject to the limitation of liability set out in the underlying SOW and DigVel's Terms of Service. Questions about this DPA can be sent to [email protected].