Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between the customer ("Controller") and Psycho Solutions LLC DBA OnePane ("Processor," "OnePane") for use of the OnePane platform (the "Service"), and applies to the extent OnePane processes personal data on the Controller's behalf that is subject to the GDPR, the UK GDPR, or comparable data-protection laws. Where it conflicts with the main agreement on data protection, this DPA controls.

1Roles and Scope

The Controller determines the purposes and means of processing the personal data it submits to the Service; OnePane processes that personal data only as a processor, on the Controller's documented instructions, including as set out in the agreement and this DPA. For OnePane's own account and billing data, OnePane acts as an independent controller under its Privacy Policy.

2Nature of Processing

Subject matter: provision of the Service. Duration: the term of the agreement plus any deletion period below. Nature and purpose: hosting, monitoring, alerting, reporting and support for the Controller's connected infrastructure.

Categories of data subjects

• the Controller's authorized users and administrators
• individuals identifiable from connected-device telemetry the Controller submits

Categories of personal data

• identifiers (name, work email, company, phone)
• authentication and access-control data
• device, network and usage telemetry, including geolocation of connected devices

3Processor Obligations

• process personal data only on the Controller's documented instructions, including for international transfers, unless required by law (and then we notify you unless the law forbids it);
• ensure persons authorized to process the data are bound by confidentiality;
• implement appropriate technical and organizational measures under Article 32 (see Security below);
• assist the Controller, taking into account the nature of processing, in responding to data-subject requests and in meeting its obligations under Articles 32–36;
• make available information necessary to demonstrate compliance and allow for and contribute to audits (see Audits below).

4Sub-processors

The Controller provides general written authorization for OnePane to engage sub-processors (for example, cloud hosting, payment processing and email delivery). OnePane imposes data-protection obligations on each sub-processor no less protective than this DPA and remains responsible for their performance. A current list of sub-processors is available on request at privacy@onepane.io; OnePane will give notice of intended changes and a reasonable opportunity to object.

5Data-Subject Requests

Taking into account the nature of the processing, OnePane will assist the Controller by appropriate technical and organizational measures, insofar as possible, to respond to requests to exercise data-subject rights. If OnePane receives such a request directly, it will, unless legally required to act, refer the individual to the Controller.

6International Transfers

Where OnePane transfers personal data across borders on the Controller's behalf, it does so subject to appropriate safeguards recognized under applicable law — such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum where they apply — which are incorporated by reference into this DPA to the extent required.

7Security Measures

OnePane maintains technical and organizational measures appropriate to the risk, including:

• encryption of data in transit (TLS) and encryption at rest of sensitive credentials;
• role-based access controls and tenant isolation, with least-privilege administration;
• optional multi-factor authentication and step-up authentication for privileged actions;
• a tamper-evident, per-tenant audit log of privileged actions;
• regular backups and monitoring for security incidents.

8Personal Data Breach

OnePane will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's personal data, and will provide information reasonably available to help the Controller meet its own notification obligations.

9Deletion or Return

On termination of the Service, OnePane will, at the Controller's choice, delete or return the personal data it processes on the Controller's behalf, and delete existing copies, unless retention is required by law. Deletion follows the timelines in the Privacy Policy.

10Audits

OnePane will make available information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates, subject to reasonable notice, confidentiality, and frequency limits.

11Contact

Questions about this DPA or requests for a signed copy: privacy@onepane.io.