EU Data Processing Agreement

This Data Processing Agreement ("DPA") is incorporated into and forms part of the GuardArra Terms of Service. It applies where GuardArra processes personal data on behalf of EU/EEA customers acting as data controllers.

1. Definitions

"Controller" means the GuardArra customer. "Processor" means GuardArra, LLC. "Personal Data," "Processing," "Data Subject," and related terms have the meanings given in the GDPR.

2. Scope and Purpose

GuardArra processes personal data submitted by the Controller for the purpose of providing the GuardArra workforce management platform. The subject matter, nature, purpose, and duration of processing is as described in the Sub-Processor List and EU Privacy Notice.

3. Processor Obligations

GuardArra shall:

• Process personal data only on documented instructions from the Controller
• Ensure persons authorized to process data are bound by confidentiality
• Implement appropriate technical and organizational security measures (Art. 32)
• Assist the Controller with data subject rights requests
• Delete or return all personal data at the end of the service
• Provide all information necessary to demonstrate compliance
• Notify the Controller of any personal data breach without undue delay

4. Sub-Processors

GuardArra maintains a list of approved sub-processors at sub-processors.html. GuardArra will notify Controllers of intended sub-processor changes with at least 30 days notice, providing opportunity to object.

5. International Transfers

Transfers of personal data from the EEA to the US are governed by the EU Standard Contractual Clauses (Module 2: Controller to Processor) adopted by Commission Decision 2021/914. By accepting these terms, the Controller executes the SCCs with GuardArra, LLC as the data importer.

6. Security Measures

GuardArra implements: AES-256-GCM encryption at rest; TLS 1.3 in transit; role-based access control; TOTP 2FA; full audit logging; regular security assessments; and daily encrypted backups to redundant destinations.

7. Signed DPA

Customers requiring a wet-signature DPA for procurement or compliance purposes should contact legal@guardarra.com. We will issue a signed copy within 5 business days.