DATA PROCESSING AGREEMENT

This Data Processing Agreement (“DPA”) is entered into by and between:

The Data Processor: MediumAxis LLC. (or applicable affiliated entity) (“MediumAxis”, “we”, “us”, or “Processor”).

The Data Controller: [Customer Legal Name] (“Customer”, “you”, or “Controller”).

Effective Date: [Insert Date]

1. Background and Purpose

1.1. The Parties have entered into a Master Services Agreement, Terms of Service, or Order Form (collectively, the “Main Agreement“) under which MediumAxis provides B2B intelligence, lead generation, and/or SaaS services to the Customer.

1.2. In the course of providing these services, MediumAxis may process Personal Data on behalf of the Customer.

1.3. This DPA sets forth the Parties’ rights and obligations regarding the protection and processing of such Personal Data in compliance with applicable Data Protection Laws (including but not limited to the EU GDPR, UK GDPR, and CCPA/CPRA).

1.4. In the event of a conflict between this DPA and the Main Agreement regarding data protection, this DPA shall prevail.

2. Definitions

2.1. “Applicable Law” means all laws, regulations, and statutory requirements applicable to the processing of Personal Data under this DPA.

2.2. “Data Protection Laws” means the EU GDPR, UK GDPR, CCPA/CPRA, and any other applicable privacy legislation.

2.3. “Personal Data” means any information relating to an identified or identifiable natural person processed by MediumAxis on behalf of Customer under the Main Agreement.

2.4. “Processing” means any operation performed on Personal Data (e.g., collection, storage, use, transmission).

2.5. “Sub-processor” means any third party engaged by MediumAxis to process Personal Data on behalf of Customer.

2.6. “Security Incident” means any breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of Personal Data.

3. Roles of the Parties

3.1. Customer as Controller: Customer determines the purposes and means of the Processing of Personal Data. Customer warrants that it has all necessary consents and legal bases to transfer Personal Data to MediumAxis for Processing.

3.2. MediumAxis as Processor: MediumAxis shall process Personal Data only on documented instructions from Customer and solely for the purposes of providing the Services defined in the Main Agreement.

3.3. Independent Controller Data: Where MediumAxis provides proprietary intelligence data (e.g., lead lists, firmographic data) from its own databases, MediumAxis may act as an independent Data Controller for such data. This DPA does not limit MediumAxis’s rights as a Controller regarding its proprietary datasets, as governed by the Main Agreement.

4. Obligations of the Processor (MediumAxis)

4.1. Instructions: MediumAxis shall not process Personal Data except on documented instructions from Customer.

4.2. Confidentiality: MediumAxis ensures that personnel authorized to process Personal Data are committed to confidentiality or under appropriate statutory obligations of confidentiality.

4.3. Security: MediumAxis shall implement appropriate technical and organizational measures (TOMs) to ensure a level of security appropriate to the risk (see Annex B).

4.4. Sub-processors: (a) Customer acknowledges that MediumAxis may engage Sub-processors (e.g., cloud hosting, verification services). (b) MediumAxis shall maintain a list of authorized Sub-processors (see Annex C) and notify Customer of any changes. (c) MediumAxis shall impose data protection obligations on Sub-processors no less protective than those in this DPA.

4.5. Data Subject Rights: MediumAxis shall assist Customer in fulfilling its obligations to respond to requests from data subjects exercising their rights (e.g., access, deletion, opt-out).

4.6. Breach Notification: MediumAxis shall notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data.

4.7. Deletion/Return: Upon termination of the Main Agreement, MediumAxis shall delete or return all Personal Data to Customer, unless required by law to store it.

4.8. Audit: Customer (or its auditor) may audit MediumAxis’s compliance with this DPA once per year upon reasonable notice, subject to confidentiality constraints.

5. International Data Transfers

5.1. Cross-Border Transfer: Customer acknowledges that Personal Data may be transferred to and processed in countries other than the Customer’s location (including the United States).

5.2. Safeguards: Where required by law (e.g., GDPR), Parties agree to incorporate the applicable Standard Contractual Clauses (SCCs) approved by the European Commission or UK ICO by reference herein.

5.3. CCPA/CPRA: MediumAxis certifies that it understands the restrictions under CCPA/CPRA and will comply with them, specifically refraining from “selling” or “sharing” Personal Data for cross-context behavioral advertising.

6. Term and Termination

6.1. This DPA shall remain in effect for the duration of the Main Agreement.

6.2. Either Party may terminate this DPA if changes in Applicable Law make compliance impossible, provided such Party notifies the other in writing.

7. Contact Information

For privacy inquiries or Data Protection Officer (DPO) contact:
Email: [email protected]
Address: Thailand, Chiang Mai, San Sai, Mu Ban Siriporn 2, 199/61
Privacy policy: https://mediumaxis.com/privacy-policy/

Annex A: Processing Details

Subject Matter: Provision of B2B Intelligence, Lead Management, and SaaS Platform Services.
Duration: Co-terminous with the Main Agreement.
Nature of Processing: Collection, storage, enrichment, verification, and export of business contact data.
Purpose: To enable Customer to identify, contact, and manage B2B prospects and customers.
Categories of Data Subjects: Business contacts, employees of corporate entities, prospects.
Categories of Personal Data: Name, business email, business phone, job title, company information, professional social profiles.

Annex B: Security Measures

MediumAxis implements the following technical and organizational measures:
1. Encryption: Data encrypted in transit (TLS 1.2+) and at rest (AES-256).
2. Access Control: Role-based access control (RBAC), multi-factor authentication (MFA) for employees.
3. Network Security: Firewalls, intrusion detection systems, regular vulnerability scanning.
4. Infrastructure Security: Our infrastructure providers (Hetzner, OVH, Cloudflare) maintain ISO 27001 certification; we implement complementary controls including firewalls and intrusion detection
5. Incident Response: Documented incident response plan tested annually.
6. Data Minimization: Processing limited to data necessary for the specified purpose.
7. Employee Training: Regular privacy and security training for all staff.

Annex C: List of Authorized Sub-processors

MediumAxis maintains an up-to-date list of sub-processors at Section Below. As of [Date], key categories include:
1. Cloud Infrastructure: Hosting and storage (e.g., Hetzner, OVH) – Global
2. Customer Support: Ticketing and communication (e.g., JivoSite) – US/EU
3. Email Delivery: Transactional email services (e.g., NameCheap) – US
4. Data Verification: Email validity and syntax checking – Germany
5. Storage: Encrypted backup (e.g., Mega.io) – New Zealand
6. Analytics: Platform usage and performance monitoring (e.g., Microsoft Clarity) – US/EU
7. CDN: Content delivery and security (e.g., Cloudflare) – Global

MediumAxis shall provide at least 14 days’ notice prior to adding new Sub-processors that materially impact data security.

Signatures

For MediumAxis LLC.
Signature: __________________________
Name: _____________________________
Title: ______________________________
Date: ______________________________

For [Customer Legal Name]
Signature: __________________________
Name: _____________________________
Title: ______________________________
Date: ______________________________