Data Processing Agreement

This Data Processing Agreement ('DPA') forms part of the Terms of Service between the customer ('Controller') and Walrus Technology LLC ('Processor'). It applies where Walrus Technology LLC processes personal data on the Controller's behalf in providing the Service, and reflects the parties' obligations under the GDPR and similar laws.

'Personal Data', 'Processing', 'Controller', 'Processor', 'Data Subject' and 'Supervisory Authority' have the meanings given in the GDPR. 'Applicable Data Protection Law' means the data-protection laws applicable to the Processing, including the EU GDPR and the UK GDPR.

The Controller determines the purposes and means of the Processing. Walrus Technology LLC acts as Processor and processes personal data only on documented instructions from the Controller, including as set out in the Service configuration and these terms, unless required to act otherwise by law.

Subject matter: provision of the Service. Duration: the term of the Agreement. Nature and purpose: processing API requests and related data to deliver location, currency, timezone and validation results. Categories of data: identifiers and request data submitted by the Controller. Data subjects: the Controller's end users.

Walrus Technology LLC will process personal data only on the Controller's instructions, ensure that persons authorized to process are bound by confidentiality, and assist the Controller — taking into account the nature of the processing — in meeting its own obligations under Applicable Data Protection Law.

Walrus Technology LLC treats personal data as confidential and limits access to personnel who need it to provide the Service, all of whom are subject to binding confidentiality obligations.

Walrus Technology LLC implements appropriate technical and organizational measures to protect personal data, including encryption in transit and at rest, access controls, logging, network security and regular testing, appropriate to the risk.

The Controller authorizes Walrus Technology LLC to engage the sub-processors listed on our Sub-processors page. Walrus Technology LLC imposes data-protection terms on each sub-processor no less protective than this DPA and remains responsible for their performance. We will give notice of new sub-processors and allow a reasonable period to object.

Taking into account the nature of the processing, Walrus Technology LLC will assist the Controller by appropriate technical and organizational measures, insofar as possible, to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law.

Walrus Technology LLC will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and will provide information reasonably necessary for the Controller to meet its own notification obligations.

Where Walrus Technology LLC transfers personal data outside the EEA, UK or Switzerland, it does so under an appropriate transfer mechanism such as the EU Standard Contractual Clauses, which are incorporated by reference where required.

Walrus Technology LLC will make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, by the Controller or an auditor it mandates, subject to reasonable confidentiality, notice and frequency limits.

On termination of the Service, Walrus Technology LLC will, at the Controller's choice, delete or return the personal data it processes on the Controller's behalf, and delete existing copies unless retention is required by law.

Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service. This DPA is governed by the law of the State of Wyoming, United States, except where Applicable Data Protection Law requires otherwise.

Data-protection enquiries may be sent to Walrus Technology LLC at [email protected] or 30 North Gould Street, Suite N, Sheridan, WY 82801, USA.