Data Processing Agreement

This Data Processing Agreement ("DPA") is an addendum to the Terms of Service between AriseCX ("Processor") and the client ("Controller"). This DPA outlines the terms and conditions concerning the processing of personal data by AriseCX on behalf of the client.

1. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person processed by AriseCX on behalf of the Controller.

"Processing" means any operation or set of operations performed upon Personal Data, whether or not by automated means.

"Subprocessor" means any third party engaged by AriseCX to process Personal Data on behalf of the Controller.

2. Processing of Personal Data

AriseCX shall only process Personal Data on documented instructions from the Controller, unless required to do so by applicable law. AriseCX will immediately inform the Controller if, in its opinion, an instruction infringes applicable data protection laws.

3. Subprocessors

The Controller agrees that AriseCX may engage Subprocessors to process Personal Data. AriseCX shall ensure that any Subprocessor is bound by written obligations that provide at least the same level of protection for Personal Data as those set out in this DPA.

4. Security Measures

AriseCX shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing.

5. Data Subject Rights

AriseCX shall, to the extent legally permitted, promptly notify the Controller if it receives a request from a Data Subject to exercise their rights under applicable data protection laws. AriseCX will assist the Controller in fulfilling its obligation to respond to such requests.

6. Personal Data Breaches

In the event of a Personal Data breach, AriseCX shall notify the Controller without undue delay after becoming aware of the breach. AriseCX will provide reasonable assistance to the Controller in investigating and mitigating the breach.

7. Term and Termination

This DPA shall remain in effect for as long as AriseCX processes Personal Data on behalf of the Controller. Upon termination of the services, AriseCX will, at the choice of the Controller, delete or return all Personal Data, unless applicable law requires storage of the data.