The DPA we sign with every org.

01Definitions

Terms used in this DPA have the meanings set forth below. Capitalized terms not defined here have the meaning given in the Principal Agreement.

02Roles & Scope

2.1 Roles of the parties

The Customer is the Controller of Personal Data and determines the purposes and means of its processing. ResponderOS is the Processor and processes Personal Data only on the documented instructions of the Customer as set forth in the Principal Agreement, this DPA, and the Customer's use of the Service.

2.2 Customer responsibilities

The Customer is solely responsible for:

• Ensuring that it has a lawful basis for the collection and processing of Personal Data under Applicable Data Protection Law;
• Providing all required notices to Data Subjects and obtaining all required consents;
• Configuring the Service's access controls, roles, and retention settings consistent with the Customer's legal obligations and internal policies;
• Determining what categories of Personal Data may be entered into the Service by the Customer's authorized users.

2.3 ResponderOS responsibilities

ResponderOS will:

• Process Personal Data only on the documented instructions of the Customer, as expressed through the Principal Agreement and the Customer's configuration of the Service;
• Not sell, rent, or share Personal Data as those terms are defined under Applicable Data Protection Law;
• Not use Personal Data for advertising, marketing, profiling, or any purpose outside of providing and improving the Service as described in this DPA and the ResponderOS Privacy Practices;
• Not combine Personal Data received under this DPA with personal information received from any other source for any purpose other than providing the Service to the Customer.

03Details of Processing

The subject matter, duration, nature, purpose, categories of Data Subjects, and categories of Personal Data processed under this DPA are set forth in Annex A (Description of Processing).

04Permitted Use of Personal Data

4.1 Service provision

ResponderOS may process Personal Data only to:

• Provide, maintain, and support the Service in accordance with the Principal Agreement;
• Comply with the Customer's documented instructions;
• Comply with applicable law, subject to Section 4.3 below.

4.2 Service improvement — limited and aggregate only

ResponderOS may process aggregate, de-identified technical and operational data about how the Service is used — such as which screens are frequently accessed, which workflows have high error or abandonment rates, and aggregate performance metrics — solely to maintain, troubleshoot, and improve the Service. ResponderOS will not read, review, analyze, or otherwise process the substantive content of records the Customer creates within the Service (including but not limited to counseling logs, evaluations, station notes, scene documentation, or personnel observations) for any purpose, including service improvement, except as strictly necessary to deliver the Service or respond to a Customer support request initiated by the Customer.

4.3 Legally required disclosures

If ResponderOS is required by applicable law, regulation, or valid legal process to disclose Personal Data, it will (to the extent legally permitted) notify the Customer in writing in advance and provide reasonable cooperation in any lawful effort by the Customer to challenge or limit the disclosure.

05Security Measures

5.1 Technical and organizational measures

ResponderOS will implement and maintain appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Current measures include those set forth in Annex B (Security Measures). ResponderOS may update these measures from time to time, provided that the level of protection is not materially diminished.

5.2 Personnel

ResponderOS ensures that any person it authorizes to process Personal Data is subject to a duty of confidentiality (whether contractual or statutory) and is trained on data protection requirements consistent with their role.

5.3 Encryption

Personal Data is encrypted in transit using TLS 1.2 or higher and at rest using industry-standard encryption (AES-256 or equivalent) provided by the Sub-Processors identified in Section 7 and Annex C.

06Security Incident Notification

Upon becoming aware of a Security Incident, ResponderOS will:

1. Notify the Customer in writing without undue delay and in any event within seventy-two (72) hours of becoming aware of the Security Incident;
2. Provide reasonably available information about the nature of the Security Incident, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed to address and mitigate the Security Incident;
3. Reasonably cooperate with the Customer's investigation, mitigation, and (where applicable) notification obligations under Applicable Data Protection Law.

Notice of a Security Incident is not, by itself, an acknowledgment by ResponderOS of any fault or liability with respect to the incident.

07Sub-Processors

7.1 General authorization

The Customer provides general authorization for ResponderOS to engage Sub-Processors to process Personal Data, subject to the requirements of this Section 7. The Sub-Processors authorized as of the Effective Date are listed in Annex C.

7.2 Sub-Processor obligations

ResponderOS will:

• Enter into a written agreement with each Sub-Processor imposing data protection obligations no less protective than those in this DPA;
• Remain fully liable to the Customer for the acts and omissions of its Sub-Processors with respect to Personal Data.

7.3 Changes to Sub-Processors

ResponderOS will notify the Customer at least thirty (30) days before adding or replacing a Sub-Processor. The Customer may object to the change in writing within fifteen (15) days of notice on reasonable data protection grounds. If the parties cannot resolve the objection in good faith within a further fifteen (15) days, the Customer may terminate the Principal Agreement with respect to the affected portion of the Service, without penalty, on thirty (30) days' written notice.

08Data Subject Rights & Customer Assistance

8.1 Data Subject requests

If ResponderOS receives a request from a Data Subject to exercise rights under Applicable Data Protection Law (e.g., access, correction, deletion, portability), ResponderOS will, where lawful and practicable, forward the request to the Customer without undue delay and will not respond to the Data Subject directly other than to confirm receipt and direct them to the Customer.

8.2 Cooperation

Taking into account the nature of the processing, ResponderOS will reasonably assist the Customer, by appropriate technical and organizational measures, in fulfilling the Customer's obligations to respond to Data Subject requests, conduct data protection assessments where required, and consult with regulators where required.

09Audits & Compliance Verification

ResponderOS will make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA. Upon the Customer's reasonable written request, and no more than once per calendar year (except in the event of a Security Incident or regulatory inquiry), ResponderOS will respond in good faith to reasonable questions concerning its data protection and security practices. The Customer agrees that responses to a current security questionnaire (such as a Vendor Security Alliance or CAIQ questionnaire) and the documentation referenced in Annex B will satisfy this obligation in most cases.

10Data Location

Personal Data processed under this DPA is stored and processed in the United States. ResponderOS will not transfer Personal Data outside the United States without prior written notice to the Customer and, where required, the implementation of an appropriate cross-border transfer mechanism.

11Return & Deletion

Upon termination or expiration of the Principal Agreement, or earlier upon the Customer's written request, ResponderOS will, at the Customer's election:

• Make Personal Data available to the Customer for export in a machine-readable format (JSON or CSV) for a period of thirty (30) days; or
• Delete or return all Personal Data in its possession.

After expiration of any applicable export period or upon Customer's instruction to delete, ResponderOS will delete Personal Data from active systems within thirty (30) days. Personal Data may persist in encrypted backups for up to ninety (90) days thereafter as part of standard disaster recovery, after which it will be permanently overwritten. ResponderOS may retain Personal Data only to the extent and for the duration required by applicable law, and only for that purpose.

12Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set forth in the Principal Agreement. Nothing in this DPA limits or excludes either party's liability to a Data Subject to the extent such liability cannot be excluded under Applicable Data Protection Law.

13General

13.1 Order of precedence

In the event of a conflict between this DPA and the Principal Agreement with respect to the processing of Personal Data, this DPA controls.

13.2 Amendments

ResponderOS may update this DPA from time to time to reflect changes in Applicable Data Protection Law, Sub-Processors, or security practices, provided that no such update materially diminishes the protections provided to the Customer. Material changes will be communicated to the Customer at least thirty (30) days before taking effect.

13.3 Governing law

This DPA is governed by the laws of the Commonwealth of Virginia, without regard to its conflict of laws principles, and is subject to the exclusive jurisdiction of the state and federal courts located in Virginia Beach, Virginia, except where Applicable Data Protection Law requires otherwise.

13.4 Entire agreement

This DPA, together with the Principal Agreement and the Annexes referenced herein, constitutes the entire agreement between the parties with respect to the processing of Personal Data and supersedes all prior or contemporaneous agreements on the same subject.