Subject Matter:

Provision of Afilo enterprise software platform and related services as described in the Terms of Service.

Duration of Processing:

From the date of account activation until 90 days after subscription termination, at which point all Customer data is permanently deleted unless otherwise required by law.

Nature and Purpose of Processing:

• Provide platform functionality and features to Customer
• Store and manage Customer account data and user information
• Process transactions and billing
• Provide customer support and troubleshooting
• Ensure security, prevent fraud, and maintain service integrity
• Comply with legal obligations and regulatory requirements

Types of Personal Data Processed:

• Account Information: Name, email, company name, job title, phone number
• Authentication Data: Hashed passwords, OAuth tokens, session identifiers
• Usage Data: IP addresses, device information, activity logs, API calls
• Billing Data: Payment information (processed by Stripe), billing address, tax ID
• Support Data: Support tickets, chat logs, email communications
• PHI (if applicable): Health information for HIPAA-covered customers with executed BAA

Categories of Data Subjects:

• Customer's employees, contractors, and authorized users
• Customer's clients and end users (if applicable)
• Customer's patients or healthcare recipients (if HIPAA BAA in effect)

Customer authorizes Afilo to engage the following Sub-Processors for processing Personal Data:

Sub-Processor Changes:

Afilo will provide 30 days' prior notice before engaging new Sub-Processors or replacing existing ones. Customer may object to new Sub-Processors within 14 days of notification. If Customer objects, Customer may terminate the subscription without penalty.

To receive Sub-Processor change notifications, subscribe at: dpo@techsci.io

Afilo will provide reasonable assistance to Customer in responding to requests from Data Subjects exercising their rights under applicable data protection laws.

Data Subject Rights Include:

• Right of Access: Obtain confirmation of data processing and access to Personal Data
• Right to Rectification: Correct inaccurate or incomplete Personal Data
• Right to Erasure ("Right to be Forgotten"): Request deletion of Personal Data (subject to legal retention requirements)
• Right to Restrict Processing: Limit processing under certain circumstances
• Right to Data Portability: Receive Personal Data in structured, commonly used, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing

Afilo's Assistance:

Upon Customer request, Afilo will within 10 business days:

• Provide export of Customer data in JSON or CSV format
• Assist in correcting, deleting, or restricting data
• Provide audit logs related to data subject's Personal Data
• Cooperate with Customer's legal obligations under applicable privacy laws

Important: Customer is responsible for verifying data subject identity and determining the validity of requests. Afilo will not respond directly to data subject requests unless legally required.

Retention Period:

Afilo retains Customer Personal Data for the duration of the subscription plus 90 days after termination.

Deletion Process:

Upon subscription termination or Customer request, Afilo will:

1. Immediate: Revoke Customer access to the platform
2. Within 7 days: Provide option to export all Customer data (JSON/CSV format)
3. Within 90 days: Permanently delete all Customer data from production systems
4. Within 120 days: Delete all data from backups and archives (as backups expire)
5. Certification: Provide written confirmation of deletion upon request

Upon termination or expiration of the subscription, Customer may choose to:

Option 1: Data Export

• Format: JSON, CSV, or API export
• Timeline: Available for 90 days after cancellation
• Process: Self-service export from dashboard or request via support@techsci.io
• Cost: No additional charge for standard exports (large data sets may incur fees)

Option 2: Immediate Deletion

• Request: Email dpo@techsci.io with deletion request
• Timeline: Deletion within 30 days of request
• Certification: Written confirmation of deletion provided upon request
• Irreversible: Once deleted, data cannot be recovered

Deletion Exclusions:

The following data may be retained beyond deletion request for legal compliance:

• Billing records and invoices (7 years for tax compliance)
• Security logs (1 year for incident investigation)
• Aggregated/anonymized analytics (no Personal Data)
• Data required by court order, subpoena, or legal hold

Limitation of Liability:

To the maximum extent permitted by law, Afilo's total liability arising out of or related to this DPA (whether in contract, tort, or otherwise) shall not exceed the fees paid by Customer in the 12 months prior to the event giving rise to liability.

Indemnification by Afilo:

Afilo will indemnify, defend, and hold harmless Customer from third-party claims arising from:

• Afilo's breach of this DPA
• Afilo's violation of applicable data protection laws
• Unauthorized disclosure of Customer data by Afilo
• Afilo's gross negligence or willful misconduct

Indemnification by Customer:

Customer will indemnify Afilo from third-party claims arising from:

• Customer's breach of this DPA or Terms of Service
• Customer's violation of applicable laws (including privacy laws)
• Customer's unauthorized instructions to process data
• Customer content or data that violates third-party rights

This DPA is governed by the laws of the State of Delaware, United States, without regard to conflict of law principles.

Any disputes arising from this DPA will be resolved in accordance with the dispute resolution procedures outlined in our Dispute Resolution Policy, including mandatory arbitration under the American Arbitration Association (AAA) rules.

Amendments:

Afilo may update this DPA from time to time to reflect changes in law, regulations, or business practices. Material changes will be communicated to Customer via email at least 30 days before taking effect.

Continued use of Afilo services after the effective date of changes constitutes acceptance of the updated DPA. If Customer does not agree to changes, Customer may terminate the subscription without penalty by providing written notice within 30 days of notification.

Termination:

This DPA remains in effect for the duration of the subscription and automatically terminates upon subscription cancellation, subject to data retention periods outlined in Section 8.

Survival:

The following provisions survive termination: Section 6 (Data Breach Notification), Section 8 (Data Retention and Deletion), Section 10 (Return and Deletion of Data), Section 11 (Liability and Indemnification).