DATA PROCESSING AGREEMENT

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Seven Gems LLC ("Setsail") and the Customer. It applies where Setsail processes personal data on the Customer's behalf in providing the Service, and is intended to meet the requirements of Article 28 of the EU General Data Protection Regulation ("GDPR") and the UK GDPR. Terms such as "controller," "processor," "personal data," "data subject" and "personal data breach" have the meanings given in the GDPR. Personal data Setsail processes for its own purposes (for example, sign-up and billing contacts) is covered by our Privacy Policy, not this DPA.

1. ROLES OF THE PARTIES

• Direct Customers: The Customer is the controller and Setsail is its processor.
• MSP Customers: Where the Customer is a managed service provider acting for its own clients, the client is the controller, the MSP is its processor, and Setsail is the MSP's sub-processor. The MSP confirms that its agreement with each client permits this sub-processing and imposes obligations consistent with this DPA, and the MSP relays its clients' instructions and requests to Setsail.
• Instructions: Setsail processes personal data only on the Customer's documented instructions, which are these Terms, this DPA and the Customer's configuration and use of the Service, unless law requires otherwise (in which case Setsail will inform the Customer first where legally permitted). Setsail will tell the Customer if it believes an instruction infringes data protection law.

2. SUBJECT MATTER, NATURE AND DURATION

Subject matter and nature: hosting, storing, organising and transmitting personal data to manage the employee lifecycle (onboarding and offboarding), track IT assets, and synchronise with the Customer's connected systems (Microsoft 365, Datto RMM and Autotask PSA) as the Customer directs.

Duration: for the term of the Customer's subscription, and afterwards only for the deletion period in section 9.

3. DATA SUBJECTS AND CATEGORIES OF DATA

3.1 Categories of data subjects

• Employees, contractors and other workers of the Customer or of an MSP's client organizations, including people joining or leaving;
• Users of the Service (administrators and other users the Customer invites);
• Business contacts at the Customer or its client organizations.

3.2 Categories of personal data

• Employee identity and employment details: names, work email addresses, job titles, departments, managers, start dates and termination dates.
• Microsoft 365 account data: account identifiers and attributes read from or written to the Customer's Microsoft 365 tenant, such as user principal name, display name, and licence and group assignments.
• Device and asset data: device records and their assignment to individuals, such as device names, serial numbers and RMM device details, and related PSA ticket content.
• Service user data: sign-in identifiers, roles and permissions, and audit log entries recording actions taken in the Service.

The Service is not designed for special categories of personal data. The Customer should not submit such data unless it is necessary and lawful to do so.

4. CONFIDENTIALITY

Setsail ensures that everyone it authorises to process personal data is bound by an appropriate duty of confidentiality, and that access is limited to those who need it to provide, secure or support the Service.

5. SECURITY MEASURES

Setsail implements technical and organisational measures ("TOMs") appropriate to the risk, as required by Article 32 GDPR, including:

• Encryption: personal data is encrypted in transit using TLS and at rest, with AES-256 encryption applied to member personally identifiable information.
• Tenant isolation: each customer's data is segregated by tenant and organization in the application, with database row-level security as an additional safeguard.
• Access control: access to the Service is through single sign-on only (no passwords), with role-based permissions enforced on the server for every request.
• Secrets management: integration credentials and application secrets are held in a managed key vault, not in source code.
• Audit logging: security-relevant events and administrative actions are recorded in audit logs.
• Hosting: the Service is hosted on Microsoft Azure.

Setsail may update these measures over time, provided the overall level of protection is not reduced.

6. SUB-PROCESSORS

The Customer gives general authorisation for Setsail to engage sub-processors. Setsail currently uses:

• Microsoft Corporation (Microsoft Azure): cloud hosting, database and key management.
• Microsoft Corporation (Microsoft 365 / Microsoft Graph): delivery of transactional email sent by the Service, such as verification and notification messages.

Systems the Customer connects to the Service, such as its own Microsoft 365 tenant, Datto RMM and Autotask PSA, are engaged by the Customer under its own agreements with those vendors. They are not Setsail sub-processors.

Setsail will impose data protection obligations on each sub-processor that are no less protective than this DPA, remains responsible for its sub-processors, and will give the Customer notice before adding or replacing a sub-processor so that the Customer can object on reasonable data protection grounds. If an objection cannot be resolved, the Customer may terminate the affected part of the Service.

7. ASSISTANCE AND DATA SUBJECT REQUESTS

Taking into account the nature of the processing, Setsail will assist the Customer, by appropriate technical and organisational measures, in responding to requests from data subjects to exercise their rights (access, rectification, erasure, restriction, portability and objection). If Setsail receives such a request directly, it will forward it to the Customer and will not respond itself except on the Customer's instructions. Setsail will also provide reasonable assistance with data protection impact assessments, prior consultations and the Customer's security obligations.

8. PERSONAL DATA BREACH NOTIFICATION

Setsail will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer personal data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Setsail will provide further information as it becomes available and take reasonable steps to contain and remedy the breach.

9. DELETION AND RETURN

On termination of the Service, the Customer may export or request a copy of its personal data. Setsail will then delete Customer personal data as described in our Privacy Policy (currently within 90 days of account termination, with encrypted backups expiring within a further 30 days), unless law requires Setsail to retain it.

10. AUDITS

Setsail will make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR, and will allow for and contribute to audits, including inspections, by the Customer or an independent auditor it mandates. Audits require reasonable advance notice, take place during business hours, no more than once a year unless required by a supervisory authority or following a personal data breach, and are subject to confidentiality obligations.

11. INTERNATIONAL TRANSFERS

Where processing involves a transfer of personal data from the European Economic Area, the United Kingdom or Switzerland to a country that has not been found to provide adequate protection, the parties agree that the European Commission's Standard Contractual Clauses (and, for UK transfers, the UK International Data Transfer Addendum) apply to that transfer and are incorporated by reference, together with any supplementary measures required. The data hosting region is [HOSTING REGION TO BE CONFIRMED].

12. UK AND CALIFORNIA ADDENDA

12.1 United Kingdom

For processing subject to the UK GDPR and the Data Protection Act 2018, references in this DPA to the GDPR are read as references to the UK GDPR, and references to EU supervisory authorities as references to the UK Information Commissioner.

12.2 California (CCPA)

To the extent the California Consumer Privacy Act, as amended ("CCPA"), applies, Setsail acts as a "service provider" and will not sell or share personal information, retain, use or disclose it for any purpose other than providing the Service, or combine it with personal information from other sources except as the CCPA permits. Setsail will notify the Customer if it can no longer meet its obligations under the CCPA.

13. CONTACT

Questions about this DPA can be sent to privacy@setsail.today.