"Controller" means the Subscriber, who determines the purposes and means of processing Personal Data.

"Processor" means Top Flow Lifestyle LLC d/b/a DanManTools, which processes Personal Data on behalf of the Controller.

"Personal Data" means any information relating to an identified or identifiable natural person that is processed by the Processor on behalf of the Controller in connection with the Service.

"Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.

"Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.

"Data Protection Laws" means all applicable laws and regulations relating to the processing of Personal Data, including the GDPR, UK GDPR, CCPA/CPRA, and any other applicable national or state privacy laws.

This DPA applies where the Processor processes Personal Data on behalf of the Controller in connection with the Service. This DPA forms part of and is incorporated into the Software License & Subscription Agreement between the parties.

The Controller is the data controller and the Processor is the data processor with respect to Personal Data processed under this DPA. Each party shall comply with its obligations under applicable Data Protection Laws.

Subject matter: Provision of the DanManTools software-as-a-service platform.

Duration: For the term of the Subscription Agreement and as required to fulfill post-termination obligations.

Nature and purpose: Hosting, storing, and processing Customer Data to provide the Service features selected by the Controller.

Types of Personal Data: May include names, contact information, payment references, employee records, customer records, and other data the Controller inputs into the Service.

Categories of data subjects: The Controller's customers, employees, contractors, and other individuals whose data is entered into the Service by the Controller.

The Processor shall:

• Process Personal Data only on documented instructions from the Controller, including as set out in this DPA and the Subscription Agreement.
• Ensure that persons authorized to process Personal Data are bound by appropriate confidentiality obligations.
• Implement and maintain appropriate technical and organizational security measures as described in Section 6.
• Assist the Controller in responding to data subject rights requests, to the extent technically feasible.
• Assist the Controller in meeting its obligations under Data Protection Laws regarding security, breach notification, data protection impact assessments, and prior consultation.
• Delete or return all Personal Data to the Controller upon termination of the Agreement, at the Controller's choice, and delete existing copies unless retention is required by law.
• Make available to the Controller all information necessary to demonstrate compliance with this DPA.

The Controller represents and warrants that:

• It has a lawful basis for processing Personal Data and for instructing the Processor to process Personal Data on its behalf.
• It has provided all required notices and obtained all required consents from data subjects.
• Its instructions to the Processor comply with applicable Data Protection Laws.
• It will not instruct the Processor to process Personal Data in a manner that would violate applicable Data Protection Laws.

The Processor implements and maintains appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage, including:

• Encryption of Personal Data in transit using TLS 1.2 or higher.
• Encryption of Personal Data at rest.
• Access controls and authentication requirements for personnel.
• Regular security assessments and vulnerability management.
• Incident response and breach notification procedures.
• Physical security controls for data center facilities (managed by cloud infrastructure providers).

The Controller provides general authorization for the Processor to engage sub-processors. The Processor shall: (a) enter into a written agreement with each sub-processor imposing data protection obligations no less protective than those in this DPA; (b) remain liable to the Controller for the acts and omissions of sub-processors; and (c) provide the Controller with at least 30 days' prior notice of any intended changes to sub-processors.

Current sub-processors include, without limitation: cloud infrastructure providers (e.g., AWS, Google Cloud), payment processors (Stripe), and email delivery services. A current list of sub-processors is available upon request at ' + CONTACT + '.

Where Personal Data is transferred from the EEA, UK, or Switzerland to a country not recognized as providing an adequate level of data protection, the Processor shall ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission or the UK Information Commissioner's Office, as applicable.

The Controller may request a copy of applicable transfer mechanisms by contacting ' + CONTACT + '.

The Processor shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach affecting the Controller's Personal Data. Such notification shall include, to the extent available: (a) a description of the nature of the breach; (b) the categories and approximate number of data subjects and records affected; (c) likely consequences of the breach; and (d) measures taken or proposed to address the breach.

The Processor shall provide reasonable assistance to the Controller in fulfilling its obligations to respond to data subject rights requests (access, rectification, erasure, restriction, portability, objection). The Controller is responsible for responding to data subjects directly. The Processor shall promptly forward to the Controller any data subject requests it receives that relate to the Controller's Personal Data.

The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits and inspections conducted by the Controller or an auditor mandated by the Controller, subject to reasonable notice (at least 30 days), confidentiality obligations, and agreement on scope and cost.

The Processor may satisfy audit requests by providing relevant third-party audit reports (e.g., SOC 2) where available.

This DPA is effective for the duration of the Subscription Agreement. Upon termination of the Subscription Agreement, the Processor shall, at the Controller's election, delete or return all Personal Data within 30 days, and certify such deletion in writing upon request. Obligations that by their nature survive termination (including confidentiality and security) shall survive.

This DPA is governed by the same governing law as the Subscription Agreement (State of Utah), except to the extent that applicable Data Protection Laws require otherwise.

For questions about this DPA or to request a list of sub-processors, contact us at ' + CONTACT + '.