Data Processing Agreement

Roles and scope#

This Data Processing Agreement applies when DEFROST LLC processes personal data for a customer under an accepted service agreement. The customer is the controller and Defrost is the processor for customer-directed business outreach data.

Each party remains responsible for any processing it performs as an independent controller. This preview does not become an executed DPA and does not replace an effective agreement while counsel review is pending.

Processing details#

Processing may include receiving, organizing, verifying, analyzing, generating, storing, retrieving, disclosing on customer instruction, and deleting data needed for an authorized outreach workflow.

Data subjects may include customer users and professional business contacts. Data may include account identifiers, professional contact details, public business context, customer inputs, message content, verification results, and campaign events. The approved order and customer configuration determine the purpose, frequency, and duration.

Customer instructions#

Defrost processes personal data on documented customer instructions, including instructions expressed through authorized product settings. The customer is responsible for the lawfulness, accuracy, and scope of those instructions and for providing required notices.

If an instruction appears to violate applicable data protection law, Defrost may pause the affected processing and request clarification. Any additional processing requires a lawful basis and documented authority.

Confidentiality and security#

Personnel authorized to process customer data must be subject to confidentiality obligations and access limited to their duties. Defrost uses tenant-scoped access controls and encrypts supported credentials at rest.

Additional technical and organizational measures must be validated against the production environment before they are incorporated into an executed annex. No statement in this preview is a certification or warranty.

Rights assistance and incidents#

Taking into account the nature of processing and information available, Defrost will provide the assistance stated in the accepted agreement for data-subject requests, impact assessments, regulator inquiries, and security incidents involving customer personal data.

The launch incident owner, notice channel, investigation process, and any contractual timing remain subject to operator evidence and counsel approval. This preview does not create a fixed notification deadline.

Sub-processors and transfers#

Defrost may use service providers to support hosting, storage, product operations, verification, communications, and support. The final annex will disclose them by category rather than by name until operator evidence supports a reviewed named vendor schedule.

The current named list is not approved for publication or available on request for compliance review. Appointment, flow-down terms, change notice, objection procedure, processing locations, and restricted-transfer mechanisms must be confirmed in the executed DPA and vendor annex.

Return and deletion#

At the end of the applicable service, Defrost will return or delete customer personal data as required by the accepted agreement, customer instruction, and applicable law. Legal retention, security records, and backup operation may limit immediate deletion.

The complete production deletion schedule and export procedure require validation before this revision may be executed.

Audit and recovery evidence#

Defrost maintains internal recovery documentation in docs/runbooks/RUNBOOK-dr-restore-drill.md. Its documented targets are a Recovery Point Objective (RPO) of ≤ 15 minutes and a Recovery Time Objective (RTO) of ≤ 2 hours using point-in-time recovery (PITR). The current documented PITR window is seven (7) days.

The runbook describes a production deletion and backup rollover horizon of thirty-seven (37) days at the latest for the covered workflow. These are internal targets pending production drill validation, evidence review, and counsel approval. They are not a service-level warranty or certification.

The form, scope, frequency, confidentiality, and cost allocation for customer audit evidence must be defined in the accepted agreement.

Term, liability, and contact#

An executed DPA remains in effect for the processing it covers. Survival, liability, precedence, signature, and termination are governed by the accepted service agreement and executed instrument. This preview makes no countersignature or turnaround commitment.

Send DPA and data-protection questions to privacy@defrostmail.com.