Scope
This addendum covers personal data in business records a customer provides to Aba Compute under a signed licensing agreement.
This Data Processing Addendum ("DPA") is between ZStack Capital LLC, operating as Aba Compute ("Aba Compute," "we"), and the company that signs a data licensing agreement with us ("Customer," "you"). It forms part of that agreement (the "Agreement"). If this DPA conflicts with the Agreement on the handling of Personal Data, this DPA wins.
It doesn't cover information people submit through our website, such as the assessment form and data intake. Our Privacy Policy covers that.
Definitions
- Customer Records are the business records you provide or make available to us under the Agreement.
- Personal Data is any information in Customer Records that relates to an identified or identifiable person and is protected by Data Protection Laws.
- Data Protection Laws are the privacy and data protection laws that apply to the processing, including the GDPR, UK GDPR, the California Consumer Privacy Act as amended (CCPA), and similar US state laws.
- De-identified Data is data prepared from Customer Records so that it can no longer reasonably identify a person or your company, as required by the Agreement and applicable law.
- Subprocessor is any third party we engage that processes Personal Data for us.
- Security Incident is a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.
"Controller," "processor," "process," "data subject" and "service provider" have the meanings given by Data Protection Laws.
Roles
You are the controller of Personal Data in Customer Records. Aba Compute processes it as your processor and, under the CCPA, as your service provider.
You're responsible for having a lawful basis and any notices or consents needed to provide Customer Records to us and to license De-identified Data as the Agreement describes. That includes checking your customer contracts and privacy notices.
Details of Processing
We process Personal Data only on your documented instructions. The Agreement and this DPA are those instructions. If we think an instruction breaks Data Protection Laws, we'll tell you.
- Subject matter and purpose: receiving the Customer Records within the agreed scope, removing or replacing identifying details, checking the result, and delivering De-identified Data to the controlled environment named in the Agreement.
- Duration: the term of the Agreement, plus the deletion period in Return and deletion.
- Data subjects: your employees and contractors, your customers and their staff, suppliers and other people who appear in the records.
- Types of Personal Data: names, contact details, job titles, account identifiers, message and ticket contents, and other details contained in the agreed records.
- Excluded data: passwords, credentials, payment card data, government identifiers and special category or sensitive data are out of scope unless the Agreement expressly includes them with extra safeguards.
Personnel
Only people who need Personal Data to perform the Agreement can access it. Each of them is bound by a written duty of confidentiality that continues after their work ends.
Subprocessors
You authorise us to use the Subprocessors on our Subprocessors page, plus the de-identification partner and controlled environment named in the Agreement.
We'll give you at least 30 days' notice by email before adding or replacing a Subprocessor that will process Customer Records. You can object on reasonable data protection grounds within that period. If we can't resolve the objection, you can end the affected part of the Agreement and receive a refund of any prepaid, unused fees for it.
Each Subprocessor is bound by a written contract with data protection terms at least as protective as this DPA. We remain responsible for their performance.
Security
We keep appropriate technical and organisational measures in place for the risk involved, including:
- Encryption of Customer Records in transit and at rest.
- Access limited to named personnel, with individual accounts and multi-factor authentication where available.
- No access to your live systems. Records are transferred only as the Agreement describes.
- Separate storage for each customer's records, with no mixing between customers.
- Review of de-identification output before anything is delivered to a buyer.
We won't materially reduce the overall level of security during the Agreement.
Security Incidents
We'll notify you without undue delay, and within 72 hours, after confirming a Security Incident affecting your Personal Data. We'll tell you what we know, keep you updated, take reasonable steps to contain it, and help you meet any notification duties you have. Notifying you isn't an admission of fault.
Requests and Assistance
If a data subject contacts us about Customer Records, we'll pass the request to you and won't respond ourselves unless you tell us to. We'll help you respond to data subject requests, carry out data protection impact assessments and consult regulators, to the extent the request relates to our processing.
De-identified Data
Once data has been de-identified as the Agreement requires, it is no longer Personal Data. The Agreement governs how it may be licensed and used.
We won't try to re-identify any person or your company from De-identified Data. The Agreement will require buyers to make the same commitment. You acknowledge that no de-identification method removes every risk, which is why the Agreement also limits buyers to agreed uses in a controlled environment.
Return and Deletion
Within 30 days after we deliver the De-identified Data, or after the Agreement ends if sooner, we'll delete the Customer Records and any copies we or our Subprocessors hold, unless the Agreement sets a different period or the law requires us to keep them. Before deletion, you can ask us to return them instead. On request, we'll confirm deletion in writing.
Copies in routine backups are deleted as those backups expire and aren't used in the meantime.
Audits
On request, we'll provide the information you reasonably need to show we comply with this DPA, such as answers to a security questionnaire. If that isn't enough, or a regulator requires it, you or an independent auditor bound by confidentiality may audit our compliance. You can do this once a year, with 30 days' notice, during business hours and at your own cost.
International Transfers
We process Customer Records in the United States unless the Agreement says otherwise. For Personal Data subject to the GDPR, the EU Standard Contractual Clauses (Commission Decision 2021/914, Module Two, controller to processor) are incorporated by reference. You are the data exporter and we are the data importer.
For Personal Data subject to UK data protection law, the UK International Data Transfer Addendum applies alongside those clauses. The Agreement's details complete the annexes. If those clauses conflict with this DPA, the clauses win.
US State Privacy Laws
As your service provider under the CCPA and similar laws, we won't:
- Sell or share Personal Data, as those laws define the terms.
- Keep, use or disclose it for any purpose other than performing the Agreement, or outside our direct business relationship with you.
- Combine it with personal data we get from other sources, except as those laws allow.
We'll tell you if we can no longer meet these obligations. You may take reasonable steps to stop and fix unauthorised use.
Liability
Each party's liability under this DPA is subject to the limits and exclusions in the Agreement.
Contact
Privacy and security questions: [email protected].
ZStack Capital LLC, operating as Aba Compute.