Data Processing Agreement

Last Updated: May 14, 2026

These documents are business-ready drafts and should be reviewed by qualified legal counsel before public reliance.

Last Updated: May 14, 2026

This Data Processing Agreement ("DPA") is a template for situations where BaloWaci LLC ("BaloWaci") processes personal data on behalf of a customer, partner, pilot organization, or other business entity, or where a vendor processes personal data on behalf of BaloWaci. This DPA should be attached to a signed written agreement before it is relied on for a specific relationship.

1. Definitions

• "Controller" means the party that determines the purposes and means of processing personal data.
• "Processor" means the party that processes personal data on behalf of the Controller.
• "Personal Data" means information relating to an identified or identifiable person.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, deletion, or transfer.
• "Subprocessor" means a third party engaged by a Processor to process Personal Data.

2. Roles

The parties will identify their roles in the underlying agreement. Depending on the relationship, BaloWaci may act as Controller, Processor, or independent Controller.

3. Processing Details

3.1 Categories of Data Subjects

• Website and app users.
• Feedback form respondents.
• Pilot, customer, partner, or business contacts.
• Support and inquiry contacts.

3.2 Categories of Personal Data

• Contact information.
• Feedback, survey, and inquiry content.
• Device, usage, analytics, diagnostic, and log information.
• Approximate location, time zone, weather, or contextual information where used by the Service.
• Account, billing, or transaction information if those features are added.

3.3 Purposes

Personal Data may be processed to provide, maintain, secure, support, analyze, and improve the Service; respond to inquiries; support pilots or partnerships; comply with law; and perform the underlying agreement.

4. Processor Obligations

The Processor will:

• Process Personal Data only on documented instructions from the Controller, unless required by law.
• Ensure personnel with access are subject to confidentiality obligations.
• Use reasonable technical and organizational security measures.
• Assist the Controller with data subject requests where legally required and reasonably possible.
• Assist with security incident investigation and notification obligations.
• Delete or return Personal Data at the end of the services unless retention is legally required.
• Make reasonable information available to demonstrate compliance with this DPA.

5. Security Measures

Appropriate measures may include:

• Access controls and least-privilege permissions.
• Encryption in transit where practical.
• Secure hosting and infrastructure controls.
• Logging, monitoring, backup, and recovery practices.
• Vendor review and confidentiality obligations.
• Incident response procedures.

6. Subprocessors

The Processor may use Subprocessors to provide the Service. The Processor will require Subprocessors to protect Personal Data using obligations materially similar to this DPA. Where required, the Processor will provide notice of new Subprocessors and an opportunity to object.

7. International Transfers

Where Personal Data is transferred internationally, the parties will use appropriate safeguards where required, such as standard contractual clauses, adequacy decisions, or other lawful transfer mechanisms.

8. Security Incidents

The Processor will notify the Controller without undue delay after becoming aware of a confirmed security incident affecting Personal Data processed under this DPA. Notice will include available information needed for the Controller to meet legal obligations.

9. Audits

Upon reasonable notice, the Processor will provide information reasonably necessary to demonstrate compliance with this DPA. Any audit must avoid disruption, protect confidential information, and be limited to systems relevant to the Personal Data at issue.

10. Term and Termination

This DPA lasts for the term of the underlying agreement and for as long as the Processor processes Personal Data under that agreement.

11. Contact

• Email: info@balowaci.com
• Website: https://balowaci.com