Data Processing Agreement

Definitions

• Personal Data — any information relating to an identified or identifiable natural person.
• Processing — any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
• Data Subject — the individual to whom personal data relates.

Scope of Processing

The Processor shall process personal data only:

• On documented instructions from Biciid Center
• For the purposes specified in the underlying service agreement
• In compliance with applicable data protection laws

Nature and Purpose

Processing may include:

• Hosting services
• Analytics support
• Technical infrastructure
• AI system operation
• Communication services

Categories of Data

The categories of data processed may include:

• Name
• Email address
• Account identifiers
• Usage data
• Event participation data
• AI interaction metadata

Obligations of the Processor

The Processor shall:

• Implement appropriate technical and organizational security measures
• Ensure confidentiality of personnel
• Not disclose personal data without authorization
• Assist Biciid Center in responding to data subject rights requests
• Notify Biciid Center of any data breach without undue delay

Sub-Processors

The Processor shall not engage sub-processors without:

• Prior written authorization
• Contractual safeguards equivalent to this DPA

Data Transfers

International data transfers must include appropriate safeguards, such as contractual protections or legally recognized transfer mechanisms.

Data Retention and Deletion

Upon termination of services, the Processor shall:

• Delete or return all personal data
• Certify deletion in writing if requested

Audit Rights

Biciid Center reserves the right to audit compliance with this DPA.

Liability

Each party remains liable according to the underlying service agreement and applicable law.