Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between goTether Platform, LLC ("Processor") and business customers ("Controller") for the provision of services. This DPA applies to processing governed by GDPR, UK GDPR, and similar data protection laws.

• Personal Data: Information about identified or identifiable individuals
• Processing: Any operation performed on Personal Data
• Controller: Entity determining processing purposes and methods
• Processor: Entity processing data on Controller's behalf
• Sub-processor: Third parties engaged by Processor for processing
• Data Subject: Individual whose Personal Data is processed

goTether commits to:

• Process Personal Data only per documented Controller instructions
• Ensure authorized personnel maintain confidentiality
• Implement appropriate technical and organizational security measures (Article 32)
• Not engage sub-processors without prior authorization
• Assist with data subject rights requests
• Notify Controller of data breaches without undue delay
• Delete or return Personal Data upon service termination
• Provide compliance documentation upon request

The following categories of sub-processors are authorized:

• Cloud Infrastructure: Vercel, Supabase
• Payment Processing: Stripe
• Communications: Twilio (SMS), email providers
• Analytics: Sentry (error tracking)

Data transfers to the United States are protected through:

• EU Standard Contractual Clauses (SCCs)
• UK Addendum to the SCCs
• Supplementary measures based on transfer impact assessments

SCCs will be executed upon request from the Controller.

We implement comprehensive security measures including:

• TLS encryption in transit and encryption at rest
• Access controls and multi-factor authentication
• Regular security assessments and penetration testing
• Incident response procedures
• Employee security training
• Physical data center security via cloud providers
• Backup and disaster recovery procedures

goTether assists Controllers with fulfilling data subject requests, including:

• Access requests (Art. 15)
• Rectification requests (Art. 16)
• Erasure requests (Art. 17)
• Restriction requests (Art. 18)
• Data portability requests (Art. 20)
• Objection to processing (Art. 21)

Contact privacy@gotether.app to initiate assistance with data subject requests.

Upon reasonable request, goTether will:

• Provide documentation demonstrating compliance
• Contribute to audits conducted by the Controller or authorized auditors

This DPA is effective for the duration of the service agreement. Upon termination:

• Personal Data will be deleted or returned within 30 days
• Retention may continue where required by law
• Certification of deletion provided upon request

For DPA-related inquiries: