EnRoute Growth Platform - Data Processing Agreement
Cross-reference: this document is a sister doc to the EnRoute Growth Platform Terms of Service V4.3 and is incorporated by reference under TOS Section 24.4.
1. Purpose & Scope
This Data Processing Agreement (DPA) governs EnRoute Growth Platform's (EGP's) Processing of Personal Data on behalf of Customer in connection with EGP's Services. It applies where, and only to the extent that, EGP Processes Personal Data subject to the General Data Protection Regulation (GDPR), the United Kingdom GDPR (UK-GDPR), the Swiss Federal Act on Data Protection (Swiss-FADP), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), or any equivalent law.
2. Acronyms
3. Definitions
- Controller - the entity that, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. Customer is the Controller.
- Processor - the entity that Processes Personal Data on behalf of the Controller. EGP is the Processor.
- Personal Data - any information relating to an identified or identifiable natural person Processed by EGP on behalf of Customer through the Services.
- Data Subject - the identified or identifiable natural person to whom Personal Data relates.
- Sub-Processor - any third party engaged by EGP to Process Personal Data on Customer's behalf, as more fully described in the EGP Sub-Processor List.
- Processing - any operation performed on Personal Data, including collection, storage, transmission, use, disclosure, erasure, or destruction.
- BAA distinction - this DPA is not a Business Associate Agreement (BAA) under the Health Insurance Portability and Accountability Act (HIPAA). Where Customer requires a BAA, a separate written BAA must be executed; absent such BAA, Customer must not transmit Protected Health Information (PHI) through the Services.
4. Scope of Processing
- Subject matter: EGP's provision of the Services to Customer.
- Duration: the term of the underlying Services agreement, plus any retention period required by law or Section 10.
- Nature and purpose: hosting, transmission, storage, automation, AI-assisted content generation, customer-relationship management (CRM), telephony, messaging, payments processing, analytics, and support, all as directed by Customer.
- Types of Personal Data: contact identifiers, business contact metadata, communication content provided by Customer or its end users, and any other Personal Data Customer chooses to input.
- Categories of Data Subjects: Customer's employees, contractors, prospects, customers, and end users.
- Customer instructions: EGP Processes Personal Data only on documented instructions from Customer, including with regard to transfers, unless required to do so by applicable law.
5. Security Measures
EGP implements and maintains reasonable and appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful Processing, accidental loss, destruction, damage, alteration, or disclosure. Measures include, at minimum:
- Encryption of Personal Data in transit using Transport Layer Security (TLS) 1.2 or higher.
- Encryption of Personal Data at rest where supported by the underlying sub-processor.
- Role-based access control with least-privilege defaults and individually attributed credentials.
- Multi-factor authentication (MFA) enforcement on all administrative interfaces.
- Centralized audit logging of administrative actions, with tamper-evident retention.
- Periodic vulnerability scanning and remediation of EGP-controlled surfaces.
- Incident-response procedures with documented escalation, containment, and Customer-notification steps.
- Background screening and confidentiality obligations for personnel with access to Personal Data.
6. Sub-Processor Flow-Down
Customer authorizes EGP to engage Sub-Processors as identified in the current sub-processor annex to this DPA. EGP imposes data-protection obligations on each Sub-Processor that are no less protective than those in this DPA, by written contract. The sub-processor annex is not published to EGP's public web properties; qualifying Customers (subject to GDPR, UK-GDPR, or Swiss-FADP) may request the current annex by emailing privacy@enroutegrowthplatform.io, and EGP will deliver it within five (5) business days of countersignature of a mutual non-disclosure agreement in EGP's standard form. Cross-reference: EGP Terms of Service (TOS) Section 20 (Sub-Processors - Conditional Disclosure) and the EGP Sub-Processor Disclosure holding page.
7. International Transfers
Where Personal Data is transferred from the European Economic Area (EEA), the United Kingdom, or Switzerland to a country not recognized as providing an adequate level of protection, the parties shall rely on the European Commission Standard Contractual Clauses (SCC) (Module Two: Controller-to-Processor) and, where applicable, the UK International Data Transfer Agreement (IDTA) or the Swiss-FADP equivalent, each of which is incorporated by reference and supplemented by any additional safeguards reasonably required.
8. Data Subject Rights Flow-Down
Taking into account the nature of the Processing, EGP shall, by appropriate technical and organizational measures, assist Customer in fulfilling its obligation to respond to requests for exercising Data Subject rights (access, rectification, erasure, restriction, portability, and objection). Customer is responsible for verifying Data Subject identity. EGP shall not respond directly to Data Subject requests unless legally required; EGP shall promptly forward any such request to Customer.
9. Audit Cooperation
EGP shall make available to Customer information reasonably necessary to demonstrate compliance with this DPA, in the form of: (a) EGP's then-current security documentation, (b) responses to a reasonable annual security questionnaire, and (c) where applicable, sub-processor System and Organization Controls 2 (SOC 2) Type II reports (under Non-Disclosure Agreement). On-site audits, where requested by Customer, shall be conducted no more than once per calendar year, on at least thirty (30) days' advance written notice, during business hours, with reasonable scope, and at Customer's expense.
10. Termination and Data Return / Destruction
Upon termination or expiration of the underlying Services agreement, EGP shall, at Customer's documented election: (a) return all Personal Data to Customer in a commercially reasonable format, or (b) delete all Personal Data, in each case within ninety (90) days unless retention is required by law. EGP shall certify deletion upon Customer's reasonable written request. Customer's right to elect return or deletion under this Section is in addition to the data-handoff rights set forth in the TOS.
11. Liability
The liability of each party under this DPA is subject to, and counts toward, the limitations and exclusions of liability set forth in EGP Terms of Service Section 13.2.
12. Contact
Data-protection questions, Data Subject requests, or breach notifications: privacy@enroutegrowthplatform.io with copy to legal@enroutegrowthplatform.io.
DPA acknowledged [ ]