Data Processing Addendum (DPA)

This Data Processing Addendum ("DPA") forms part of the Terms of Service and applies to the processing of personal data by Loweford Inc. on behalf of users and clients in compliance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable global data protection laws.

1. Technical & Organizational Measures

• Data pseudonymization and anonymization where feasible
• Industry-standard encryption of data at rest and in transit
• Continuous security threat monitoring and vulnerability assessments
• Strict logical access controls based on the principle of least privilege

2. Authorized Sub-processors

Loweford Inc. engages specific sub-processors. All are bound by written agreements providing at least the same level of data protection:

3. Breach Notification

In the event of a confirmed personal data breach, Loweford Inc. will notify affected users without undue delay, and where feasible, within 72 hours of becoming aware of the breach.

4. Audit Rights

Upon reasonable written request, Loweford Inc. will make available to clients information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits conducted by the client or an auditor mandated by the client.