Data processing addendum

The dealer is the Controller of customer data; ADP is the Processor. Each party maintains records of processing activities (Article 30) and complies with applicable laws.

Approved sub-processors as of the version date:

Customer is notified by email at least 30 days before any new sub-processor is added. Customer may object on reasonable grounds; if we can't accommodate, customer may terminate without penalty.

AES-256 encryption at rest, TLS 1.3 in transit, per-tenant key envelope for PII, MFA on all production access, quarterly access review, annual penetration test by an independent firm. Full schedule of technical and organizational measures in Annex II of this DPA.

For transfers from EEA / UK / Switzerland to the US, we rely on the EU Standard Contractual Clauses (Commission Decision 2021/914) and supplementary measures per Schrems II guidance.

Where ADP receives a request directly from a data subject, we route it to the relevant dealer (controller). We assist the dealer to respond within statutory timelines.

ADP notifies affected customers without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting their data. Notification includes nature, categories, and approximate volume of records, likely consequences, and measures taken or proposed.

Customer may audit ADP's compliance with this DPA once per year, on 30 days' notice, at customer's expense. ADP will provide its current SOC 2 Type II report under NDA in lieu of an on-site audit where the customer is satisfied with that level of assurance.

On termination, ADP deletes or returns customer personal data within 30 days, subject to a longer retention period required by law (e.g., audit log retention for tax purposes).