Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Whylidate ("Processor") and you ("Controller") for the provision of email verification services.

2. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person, including email addresses submitted for verification.

"Processing" means any operation performed on Personal Data, including verification, storage, and deletion.

3. Scope of Processing

The Processor will process Personal Data only:

• To provide email verification services as described in the Terms of Service
• In accordance with documented instructions from the Controller
• In compliance with applicable data protection laws

4. Data Security

The Processor implements appropriate technical and organizational measures including:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Access controls and authentication mechanisms
• Regular security assessments and penetration testing
• Incident response and breach notification procedures

5. Sub-processors

The Processor may engage sub-processors to assist in providing the services. Current sub-processors include cloud infrastructure providers located within the EU. The Controller will be notified of any changes to sub-processors.

6. Data Subject Rights

The Processor will assist the Controller in responding to data subject requests for access, rectification, erasure, or portability of Personal Data.

7. Data Retention

Personal Data processed for verification purposes is retained for 30 days, after which it is automatically deleted. The Controller may request earlier deletion.

8. Audit Rights

The Controller may request information necessary to demonstrate compliance with this DPA. The Processor will make available relevant audit reports upon request.

9. Termination

Upon termination of services, the Processor will delete all Personal Data within 30 days unless retention is required by law.