Data Processing Agreement (DPA)

Version: 1.0

Effective Date: 1st October 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between MSP SecureView LLC-FZ, trading as SecuVeo, and the Customer organization identified by its SecuVeo Account.

SecuVeo: MSP SecureView LLC-FZ, Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. Authorized representative: Luis Navarro, Founder. Data protection contact: legal@secuveo.com.

Customer: The organization on whose behalf the Terms and this DPA are accepted. Its contact is the authorized representative whose full name and email are recorded for the Account, unless it designates another contact in writing. Where a separate Data Transfer Agreement is accepted, the Customer’s completed legal entity and contact details in that agreement identify it for the transfer arrangements.

This DPA governs Personal Data processed by SecuVeo on the Customer’s behalf. Where the Customer determines the purposes and means of processing, it acts as Controller and SecuVeo acts as Processor. Where the Customer processes Personal Data on behalf of a Client, it acts as Processor and SecuVeo acts as Sub-Processor. The Customer is responsible for the authority and Client authorizations required to instruct SecuVeo.

Processing for which SecuVeo determines its own purposes and means, such as its own business-account administration, billing and marketing, is described separately in the Privacy Policy. A Data Transfer Agreement separately accepted under Section 10, including its completed details and schedules, forms part of this DPA.

1. Definitions

For the purposes of this Agreement:

Applicable Data Protection Law means all applicable privacy and data protection laws relevant to the parties and processing activities, including where applicable:

  • EU General Data Protection Regulation (EU GDPR)
  • UK GDPR
  • United States federal and state privacy laws
  • UAE Federal Decree Law No. 45 of 2021 on Personal Data Protection
  • Other applicable national or regional privacy laws

Controller means the entity determining the purposes and means of processing Personal Data.

Processor means MSP SecureView LLC-FZ, acting as a processor or sub-processor in relation to Personal Data, as applicable. References in this DPA to the Controller’s instructions, choices or rights may be exercised by the Customer on behalf of its Client where the Customer acts as that Client’s processor.

Personal Data means any information relating to an identified or identifiable natural person.

Processing means any operation performed on Personal Data including collection, storage, use, transmission, disclosure or deletion.

Sub-Processor means a third party engaged by the Processor to assist in providing the Services.

2. Scope and Purpose of Processing

The Processor processes Personal Data solely for the purpose of providing the Services.

Processing begins when the Customer first submits or makes Personal Data available through the Services and continues for the duration of the Services, subject to the return, deletion and lawful retention provisions in Section 12.

Processing activities may include:

  • User account administration
  • Client and contact synchronization, management and retention
  • Report generation
  • Report delivery
  • Activity and audit logging
  • Email communications
  • AI-assisted report generation
  • Platform support
  • Service administration
  • Security monitoring

The Processor shall not process Personal Data for unrelated purposes.

SecuVeo shall process Personal Data only on the Customer’s documented instructions, including instructions concerning international transfers, except where applicable law requires otherwise. The Terms of Service, this DPA, the Customer’s configuration and use of the Services, and written instructions from the Customer constitute documented instructions. Where applicable law requires other processing, SecuVeo shall inform the Customer before processing unless the law prohibits notice.

3. Categories of Personal Data

The Processor may process:

  • Names
  • Email addresses
  • Company names
  • IP addresses
  • Client billing information imported through authorized integrations; SecuVeo’s own subscription billing is addressed separately in the Privacy Policy
  • Report recipient information
  • User activity information
  • Audit records
  • Authentication information
  • Client account information
  • Platform usage information
  • Personal Data in report content, uploaded files and attachments, including AI-assisted inputs and outputs
  • Postal addresses, telephone numbers and job titles where included in Customer Data
  • Microsoft 365 security and compliance configuration information retrieved from authorized Microsoft Graph, Exchange Online and Microsoft Purview connections

4. Categories of Data Subjects

  • Data subjects may include:
  • Customer employees
  • Customer contacts
  • Platform users
  • Report recipients
  • Client contacts

5. Sensitive Data

The Services are not intended for special category or other highly sensitive Personal Data, including health, biometric or genetic information, information concerning racial or ethnic origin, religious or philosophical beliefs, political opinions or trade union membership, government identification numbers, and criminal convictions or offenses.

The Customer must not deliberately submit such information unless SecuVeo has separately agreed to the processing and the necessary lawful conditions, documented instructions and appropriate safeguards are in place. The Customer’s own lawful basis or need for the information does not, by itself, authorize that processing through the Services.

If such information is submitted unexpectedly, the parties shall cooperate to restrict access and arrange its removal or other lawful handling as appropriate. Each party retains its own applicable data protection obligations.

6. Processor Responsibilities

The Processor shall:

  • Process Personal Data only as necessary to provide the Services
  • Ensure that personnel authorized to process Personal Data are subject to appropriate confidentiality obligations or are under an appropriate statutory duty of confidentiality.
  • Implement appropriate technical and organizational security measures
  • Restrict access to authorized personnel only
  • Take reasonable steps to prevent unauthorized access, disclosure, alteration or destruction of Personal Data
  • Notify the Customer without undue delay after becoming aware of a Personal Data breach affecting Personal Data processed on its behalf
  • Taking into account the nature of the processing and the information available to SecuVeo, assist the Customer with data subject requests, security and Personal Data breach obligations, data protection impact assessments, and consultations with supervisory authorities where required by applicable law.

SecuVeo shall promptly inform the Customer if, in its opinion, a documented instruction infringes Applicable Data Protection Law, unless prohibited from doing so by law.

7. Security Measures

The Processor maintains appropriate technical and organizational security measures, including:

  • Encryption in transit using TLS/HTTPS.
  • Encryption at rest using industry-standard encryption.
  • Multi-Factor Authentication (MFA) for supported authentication methods.
  • Microsoft Single Sign-On (SSO).
  • Role-based access controls.
  • Secure password handling.
  • Authentication monitoring.
  • Audit logging.
  • Security event logging.
  • Continuous infrastructure and security monitoring.
  • Vulnerability management.
  • Regular security updates and patch management.
  • Automated encrypted backups.
  • Point-in-Time Recovery (PITR).
  • Disaster recovery procedures.
  • Backup integrity and recovery testing.

The Processor may modify security measures from time to time provided that overall security protections are not materially reduced.

Current user roles include:

  • MSP Admin
  • Basic User
  • Viewer (Read-Only) User

8. Artificial Intelligence Processing

The Services may use third-party artificial intelligence services to assist with generating report content, executive summaries, recommendations and similar outputs.

Information submitted for AI processing may include:

  • Customer names
  • Client names
  • Billing information
  • Microsoft 365 Security Evidence
  • Report findings
  • Recommendations
  • Operational information required to generate report content

Customers acknowledge that such information may be processed by approved AI Sub-Processors solely for the purpose of providing the Services.

Customers remain responsible for reviewing all AI-generated content before use, distribution or implementation.

The Processor does not guarantee the accuracy, completeness or suitability of AI-generated outputs.

SecuVeo shall ensure that approved AI Sub-Processors are bound by the data protection obligations described in Section 11. AI processing is limited to the Customer-authorized functionality and necessary provision, maintenance, security, support and abuse prevention for that functionality under lawful documented instructions and the applicable provider agreement. Personal Data in submitted report content remains subject to the DPA and applicable transfer safeguards. Any processing required by law remains subject to the applicable legal and contractual restrictions.

9. Data Storage and Hosting

SecuVeo is incorporated in the United Arab Emirates. Platform infrastructure is hosted using Amazon Web Services (AWS) in the United States, with primary hosting in Virginia, backups in Oregon and archive storage in Ohio.

Anthropic uses United States storage with further processing and access locations described in Section 11. Mandrill/Mailchimp Transactional uses United States hosting with service-dependent further locations described there. Verisys scans uploaded attachments in the United Kingdom. Authorized SecuVeo support staff and developers may access data from the United Kingdom, Spain, the United Arab Emirates and India. These are internal personnel subject to confidentiality and access restrictions; the transfer safeguards in Section 10 apply where required.

SecuVeo shall maintain the security measures described in Section 7, including encryption, access controls, monitoring, backup and recovery measures. Processing locations are subject to Section 10; disclosure or acceptance of a location is not, by itself, a transfer safeguard.

PDF archive retention after live Account deletion is governed by Section 12.3.

10. International Data Transfers

SecuVeo is established in the United Arab Emirates and uses the processing locations described in Sections 9 and 11. The parties shall ensure that any international transfer requiring a legal safeguard is covered by an effective safeguard before the affected transfer begins. Acknowledgment of a processing location does not replace that safeguard.

UK and EU/EEA Customers identified during approval of new Free Trial Accounts must complete the applicable Data Transfer Agreement through the mandatory first-login process before platform access is enabled. The authorized representative must enter the required company and representative details and expressly accept the agreement. The completed, accepted Data Transfer Agreement and its schedules form part of this DPA and will be available in the Customer’s Policy Center.
The separate agreement contains the applicable European Commission Standard Contractual Clauses and, for UK transfers, the UK Addendum or other applicable approved UK instrument, together with the required selections, party details and processing schedules. Those mandatory instruments prevail over conflicting commercial provisions according to their own precedence rules.

Each party shall fulfill its applicable transfer-assessment, cooperation and supplementary-safeguard obligations. SecuVeo shall apply lawful safeguards to onward transfers to Sub-Processors. Neither Account approval nor completion of the first-login form replaces those obligations. Where applicable law requires safeguards for a Customer outside the UK or EEA, those safeguards must also be in place before the affected transfer, even though this standard first-login flow targets UK and EU/EEA Customers.

SecuVeo assigns the first-login Data Transfer Agreement based on the Customer’s declared headquarters location: the UK agreement for UK Customers and the EU/EEA agreement for EU/EEA Customers. The Customer must notify SecuVeo at legal@secuveo.com before beginning processing that requires additional regional transfer safeguards not covered by its assigned agreement. SecuVeo will arrange the applicable additional or combined agreement before affected processing begins. This notification obligation applies to all Customers, regardless of headquarters location.

If an applicable transfer safeguard becomes ineffective or cannot be complied with, the parties shall take the action required by applicable law and the relevant agreement, including suspending affected transfers or processing and returning or deleting data where required.

11. Sub-Processors

The Customer grants general written authorization for SecuVeo to engage the providers below to the extent they process Personal Data on the Customer’s behalf. The contracted provider entity is the entity identified in SecuVeo’s applicable agreement with that provider.

  • Amazon Web Services EMEA SARL (Luxembourg): cloud hosting and storage, with primary infrastructure in Virginia (us-east-1), backups in Oregon (us-west-2) and PDF archive storage in Ohio (us-east-2), United States. Further service-specific processing locations are governed by the applicable AWS provider records and transfer safeguards.
  • Anthropic, PBC (United States): direct commercial API processing for AI-assisted report functionality. Data is stored in the United States; default processing traffic may be routed through the United States, Europe, Asia and Australia. Affiliate personnel may access data for authorized support, safety and incident handling as described in the applicable provider records.
  • The Rocket Science Group LLC d/b/a Mailchimp (United States), including Mandrill/Mailchimp Transactional: transactional email delivery involving names, email addresses and necessary message content. Hosting is in the United States. Its published provider records include further service-dependent locations, including Germany, the United Kingdom, Romania and Greece; listing these locations does not mean each handles SecuVeo data.
  • Ionx Solutions LLP (United Kingdom), trading as Verisys: malware scanning of uploaded attachments using the UK scanning endpoint. Files submitted for routine scanning are normally deleted when scanning finishes. Ionx’s published terms permit exceptional retention for legal requirements, disputes, fraud prevention and contractual enforcement. This processing, including any exceptional retention, is governed by a binding data processing agreement between SecuVeo and Ionx. SecuVeo shall ensure any required onward-transfer protections are in place before the affected transfer begins. Any retained Personal Data remains subject to applicable purpose, security and deletion requirements.

Stripe handles SecuVeo subscription billing, not Customer-directed report processing under this DPA. Its activity-specific roles, processing locations and billing-data handling are addressed separately in the Privacy Policy and applicable Stripe documentation.

Provider records identify the service-specific locations and safeguards actually relevant to SecuVeo. Public location lists do not authorize unrestricted processing or remove SecuVeo’s responsibility for lawful onward transfers.

SecuVeo shall make available the applicable provider identities, business addresses, processing services, relevant locations and transfer safeguards as required by the applicable transfer instruments. Processing is for the relevant service above during SecuVeo’s provision of the Services, including the expressly authorized archive period where applicable, followed by return or deletion under the applicable provider agreement and law. The applicable provider records shall be included in or expressly incorporated into the separate Data Transfer Agreement where required.

SecuVeo will notify the Customer in writing at least thirty (30) days before adding or replacing a Sub-Processor that will process Personal Data. The Customer may object during that period on reasonable data protection grounds. The parties will work in good faith to resolve the objection before the proposed Sub-Processor begins processing the Customer’s Personal Data. If they cannot resolve it, the Customer may terminate the affected Subscription before that processing begins, will receive a refund of prepaid fees for the unused portion of the term, and will not owe remaining monthly fees for that term. Any stricter requirement under the EU SCCs or UK Addendum incorporated into a separately accepted Data Transfer Agreement remains applicable.

SecuVeo shall bind each Sub-Processor by a written agreement imposing data protection obligations that provide an equivalent level of protection for Personal Data to those in this DPA. SecuVeo remains responsible to the Customer for each Sub-Processor’s performance of those obligations.

12. Data Retention and Deletion

12.1 Client Retention and Scheduled Deletion

Customers may hide individual Clients or schedule individual Clients for permanent deletion using functionality available within the Services.

Hiding a Client does not constitute an instruction to delete that Client or its associated Customer Data. Where a Customer schedules a Client for future deletion, the Processor will continue to process and store the Client and associated Customer Data on behalf of the Customer until the scheduled deletion date.

Removal, deletion, deactivation or absence of a Client within a connected PSA platform does not constitute an instruction to delete the corresponding Client or associated Customer Data from the Services.

On the scheduled deletion date, the Processor will process the Client and associated Customer Data for permanent deletion in accordance with the Customer’s instruction. An instruction to permanently delete an individual Client also applies to that Client’s separately archived PDF copies unless the Customer expressly instructs otherwise. Any copies temporarily remaining in backups or disaster-recovery systems and any retention required by applicable law are subject to the protection, restricted-use and deletion rules in Section 12.2. General operational or security purposes do not independently authorize retention of Customer Personal Data beyond the lawful processing instructions and applicable law.

Customers may cancel or amend a scheduled deletion before the scheduled deletion date using functionality made available within the Services.

12.2 Account Suspension, Termination and Live-Account Deletion

Suspension, termination and deletion are distinct events. Suspension for non-payment blocks login but does not itself delete Personal Data or terminate the Subscription. During suspension, SecuVeo retains Personal Data on the Customer’s behalf for payment recovery, secure custody, authorized Support requests and the applicable return or deletion process. Processing remains subject to this DPA and is limited to those purposes and any other processing lawfully required.

For non-payment, a SecuVeo Admin may manually terminate an Account only after at least thirty (30) days have elapsed after suspension, as described in Section 8.2 of the Terms. That action cancels the Stripe Subscription. Deletion of the MSP Account and associated live Customer Data is initiated separately by a SecuVeo Admin. These manual administrative steps do not authorize indefinite retention.

During suspension, the Customer may contact SecuVeo Support before termination to request copies of available reports or other records. SecuVeo will verify identity and authority and arrange secure delivery where reasonably practicable. The Customer may communicate its choice of return or deletion to legal@secuveo.com. A return request made before termination shall be handled before the relevant data is deleted. Return does not restore platform access.

When live platform processing ends, SecuVeo shall, at the Customer’s choice, return or delete Personal Data processed on its behalf and delete remaining copies unless applicable law requires retention or the Customer has instructed SecuVeo to continue the limited PDF archive service in Section 12.3. If the Customer has not requested return, SecuVeo shall proceed with deletion of live Customer Data. SecuVeo shall carry out return and deletion without undue delay; a manual administrative action does not permit unnecessary retention.

The live-account deletion process removes the MSP Account and its live records, including client/contact records, live PDF records, uploaded attachments and audit records. Customer Data that is not Personal Data is also deleted. Separately stored PDF archive copies are governed by Section 12.3, and copies in backups or disaster-recovery systems are governed by the following paragraph.

Personal Data temporarily remaining in encrypted backup, Point-in-Time Recovery or disaster-recovery systems shall be protected, kept beyond ordinary use and deleted through the applicable backup cycle, which may be up to six (6) months. If a backup is restored before that cycle ends, the applicable deletion instructions shall be reapplied before the restored data is used for ordinary processing. This backup cycle does not extend the separate PDF archive period in Section 12.3.

Data retained because applicable law requires it shall be limited to what that law requires, restricted to the required purpose, protected and deleted when the required period ends. SecuVeo’s own billing, business-account and legally required records processed as Controller are addressed separately in the Privacy Policy. Mandatory return, deletion and transfer-clause obligations are not overridden by payment restrictions or the non-payment timetable.

12.3 Limited PDF Archive Following Live-Account Deletion

The Customer instructs SecuVeo, through acceptance of this DPA, to provide a limited recovery archive containing only generated Security Review Report PDFs following deletion of the live MSP Account, unless the Customer instructs SecuVeo to delete those archive copies. Report Compliance Record PDFs and other PDF files are excluded from this recovery archive and are deleted as part of live MSP Account deletion, subject to the protected backup and legally required retention rules in Section 12.2. This archive is a separate, limited continuation of processing on the Customer’s behalf for recovery purposes; it does not restore the Subscription or platform access.

Archive copies may be retained for up to two (2) years from the date of live MSP Account deletion. The archive is retained solely to allow the Customer to request recovery of its reports and is subject to this DPA’s confidentiality, security, international-transfer, Sub-Processor and Data Subject protection obligations throughout that period. It shall not be used for SecuVeo marketing, profiling or unrelated purposes.

An authorized Customer representative may request copies through SecuVeo Support after live Account deletion. SecuVeo shall verify identity and authority and securely provide retained PDFs where available. This service does not provide recovery of Report Compliance Record PDFs or other files and records deleted with the live Account, reconstruction of missing information or renewed login access.

The Customer may end the archive service and request deletion at any time by contacting legal@secuveo.com or SecuVeo Support. A request to delete all Customer Personal Data includes the PDF archive unless the Customer expressly instructs otherwise. SecuVeo shall delete the archive copies without undue delay after that instruction, subject only to retention required by applicable law and the protected backup cycle described in Section 12.2.

Unless the Customer requests deletion earlier or applicable law requires retention, SecuVeo shall delete archive copies at the end of the two-year period. At the end of archive processing, the Customer’s choice of return or deletion and the applicable mandatory deletion obligations apply. The two-year period is a maximum recovery period, not a minimum retention obligation or a waiver of deletion rights.

13. Customer Data Requests

Customers may request termination of their Account by submitting a Support Ticket through the SecuVeo platform or by contacting legal@secuveo.com.

Termination requests shall be processed in accordance with the Terms of Service. Where the Customer is subject to a fixed-term or rolling subscription agreement, termination shall take effect in accordance with the applicable contractual notice and termination provisions.

Following termination of the Services, SecuVeo shall return or delete Personal Data in accordance with the Customer’s choice and Section 12.2. Any continued limited PDF archive processing is governed by the Customer’s instructions and Section 12.3.

The Processor may take reasonable steps to verify the identity and authority of the individual submitting the termination request before processing the request.

14. Data Export

Customers may download Security Review Reports and Report Compliance Records in PDF format and export Audit Log data through the Services while platform access is available. Customers should retain their required copies before suspension, Subscription expiration or Account termination.

If login access is suspended for non-payment, the Customer may contact SecuVeo Support before Account termination to request copies of available reports or other records, subject to identity and authority verification and secure delivery arrangements. This does not restore login access, promise a custom export or require recovery from disaster-recovery backups. After live Account deletion, the separate PDF recovery service in Section 12.3 remains available during its authorized archive period. This Section does not limit the Customer’s return or deletion rights under Sections 12.2 and 12.3, the EU SCCs or UK Addendum incorporated into a separately accepted Data Transfer Agreement, or applicable law.

15. Data Subject Rights

Where required under applicable law, the Processor shall reasonably assist the Customer in responding to:

  • Access requests
  • Rectification requests
  • Deletion requests
  • Restriction requests
  • Data portability requests
  • Objection requests

The Customer remains responsible for determining whether such requests are valid and lawful.

16. Security Incidents

SecuVeo shall notify the affected Customer without undue delay after becoming aware of a Personal Data breach affecting Personal Data processed on the Customer’s behalf. SecuVeo may provide information in phases as its investigation progresses.

Notification may include:

  • Nature of the incident
  • Categories of affected information
  • Potential impact
  • Actions taken
  • Mitigation measures

The Processor shall take reasonable steps to investigate and mitigate confirmed security incidents.

SecuVeo shall reasonably cooperate with the Customer in investigating, mitigating and responding to Personal Data breaches affecting Personal Data processed on the Customer’s behalf.

Where legally permitted, the Processor shall promptly notify the Customer of any legally binding request for disclosure of Personal Data by a public authority.

17. Audit Rights

The Processor shall make available information reasonably necessary to demonstrate compliance with this DPA.

Any audit request must:

  • Be reasonable in scope
  • Be provided with reasonable advance notice
  • Not unreasonably interfere with normal business operations
  • Be subject to appropriate confidentiality obligations

SecuVeo may initially provide policies, procedures, certifications and other relevant compliance documentation to demonstrate compliance. Where that information is insufficient, SecuVeo shall allow for and contribute to an audit or inspection by the Customer or an auditor appointed by the Customer, subject to the reasonable notice, scope, security and confidentiality conditions in this Section.

The Customer shall bear its own costs associated with any audit unless otherwise required by applicable law or agreed in writing.

18. Liability

Liability arising under this DPA is governed by the Terms of Service, except to the extent the applicable EU SCCs, UK Addendum or mandatory law provide otherwise. No limitation or exclusion in the Terms or this DPA overrides liability, compensation rights or remedies under those transfer instruments, including rights of Data Subjects and the parties.

19. Governing Law

Except as required by mandatory law or the applicable EU Standard Contractual Clauses or UK Addendum incorporated into a separately accepted Data Transfer Agreement, this DPA is governed by the laws of the Dubai International Financial Centre (“DIFC”). The parties expressly agree that the Courts of the Dubai International Financial Centre (“DIFC Courts”) shall have exclusive jurisdiction over disputes arising out of or in connection with this DPA, including its existence, validity, interpretation, performance or termination.

The applicable transfer instruments’ governing-law, court-jurisdiction, supervisory-authority and Data Subject rights provisions prevail for matters within their scope.

20. Changes to this DPA

The Processor may update this DPA from time to time to reflect:

  • Changes in applicable law
  • Changes to Services
  • Changes to Sub-Processors
  • Changes to security practices

Changes to this DPA are subject to Section 50 of the Terms of Service. Where a change materially and adversely affects the Customer’s rights or obligations during a current Subscription term, SecuVeo will provide the advance email notice and the Customer will have the rejection, termination and refund rights stated in that Section.

An update does not remove or modify the mandatory provisions of an executed EU SCC agreement or UK Addendum. Changes to those instruments, their permitted selections and appendix information must follow the relevant instrument and Applicable Data Protection Law. Sub-Processor changes remain subject to Section 11.

21. Contact Information

Data Protection Contact

Email: legal@secuveo.com

Websites:

  • https://secuveo.com
  • https://app.secuveo.com

Address:
MSP SecureView LLC-FZ
Meydan Grandstand, 6th Floor
Meydan Road, Nad Al Sheba
Dubai, United Arab Emirates

22. Entire Agreement and Order of Precedence

This Data Processing Agreement forms part of the Terms of Service and should be read together with the Privacy Policy and any documents expressly incorporated by reference.

If there is any conflict between this Data Processing Agreement, the Terms of Service and the Privacy Policy, the documents shall apply in the following order of precedence:

  1. The mandatory transfer instruments incorporated through a separately accepted Data Transfer Agreement, to the extent applicable and as their own precedence rules require;
  2. The remainder of this DPA for processing within its scope;
  3. The Terms of Service; and
  4. The Privacy Policy as the applicable privacy notice.

Nothing in this Data Processing Agreement limits any obligations imposed upon either party under applicable data protection laws.

23. Acceptance

The Customer’s recorded electronic acceptance of the Terms of Service also accepts this DPA. The accepting person represents that they are authorized to bind the Customer organization. SecuVeo agrees to be bound through its offer of this DPA and acceptance of the Customer’s registration, acting through Luis Navarro, Founder, as its authorized representative.

Where required under Section 10, the Customer’s authorized representative must separately enter the required details and expressly accept the applicable Data Transfer Agreement through the mandatory first-login process. The completed details, accepted agreement, incorporated instruments and schedules are retained with the acceptance record. The process must be completed before platform access is enabled and before the affected processing or transfers begin. The legal effectiveness of electronic execution remains subject to applicable signature and contract law.

SecuVeo retains who accepted, when and the applicable document versions. The completed, accepted Data Transfer Agreement is available for download in the Customer’s Policy Center alongside the standard policy documents. The same standard DPA applies to all Customers; execution and regional provisions of the separate Data Transfer Agreement are governed by that agreement.

24. United States Privacy Provisions

These provisions apply to Personal Data processed on the Customer’s behalf to the extent the relevant United States federal or state privacy law applies to that processing. They do not state that every Customer or SecuVeo is subject to every listed law.

24.1 Limited purposes and role

Where the CCPA, as amended by the CPRA, applies, the Customer discloses Personal Data to SecuVeo only for the limited and specified business purposes of hosting and managing Client/contact records, synchronizing authorized integrations, preparing and delivering Security Reviews and associated records, providing authorized AI-assisted report functionality, support, security monitoring, and return/deletion under Sections 2, 8 and 12. SecuVeo acts as a service provider or contractor, as applicable. Under other applicable state privacy laws, SecuVeo acts as Processor when processing on the Customer’s behalf.

24.2 Restrictions

SecuVeo shall not sell or share Personal Data as those terms are defined in the CCPA; retain, use or disclose it for a commercial purpose other than the specified purposes or outside the direct business relationship with the Customer, except as expressly permitted by applicable law; or combine it with Personal Data obtained from another customer or its own interaction with an individual, except as expressly permitted for service providers or contractors under applicable law. Personal Data processed under this DPA shall not be used for cross-context behavioral advertising.

SecuVeo certifies that it understands these restrictions and will comply with them. SecuVeo shall comply with applicable obligations and provide the same level of privacy protection required of the Customer under the CCPA for this processing.

24.3 Assistance, oversight and remediation

SecuVeo shall assist with applicable consumer requests, security obligations, breach responses and assessments, taking account of the nature of processing and available information. SecuVeo shall promptly notify the Customer if it determines that it can no longer meet its obligations under applicable privacy law. The Customer may take reasonable and appropriate steps to verify that SecuVeo’s processing is consistent with these obligations and to stop and remediate unauthorized use, including through the information and audit rights in Section 17.

24.4 Subcontractors and end of processing

SecuVeo shall bind any Sub-Processor handling this Personal Data by a written contract imposing the applicable restrictions and protection obligations, subject to Section 11. Return, deletion, confidentiality, processing instructions and processing duration are governed by the corresponding provisions of this DPA. If mandatory state-law obligations require additional protection, those obligations prevail to that extent.