Data Processing Agreement

1. Scope & Purpose

This DPA applies to the processing of Personal Data by IPR on behalf of professional account holders ("Customers"), including shelters, rescues, veterinary clinics, breeders, and government agencies that use IPR's subscription services.

The purpose of data processing is to provide the IPR platform services, including pet registration management, medical record storage, microchip database operations, transfer processing, reporting, and directory listings as described in the Terms of Service.

The categories of data subjects include pet owners, staff members of professional organizations, and individuals associated with pet records. The types of personal data processed include names, contact information, pet ownership details, veterinary medical records, and transaction data.

2. Definitions

• "Controller" means the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. In the context of this DPA, the Customer is the Controller when IPR processes data on the Customer's behalf.
• "Processor" means the natural or legal person which processes Personal Data on behalf of the Controller. IPR acts as Processor for data submitted by professional accounts.
• "Data Subject" means an identified or identifiable natural person whose Personal Data is processed.
• "Personal Data" means any information relating to an identified or identifiable natural person, as defined in GDPR Article 4(1).
• "Sub-Processor" means any third party engaged by IPR to process Personal Data on behalf of the Customer.
• "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
• "Standard Contractual Clauses" (SCCs) means the contractual clauses approved by the European Commission for the transfer of Personal Data to third countries.

3. Role of IPR

The relationship between IPR and the Customer depends on the context of processing:

• IPR as Processor: When IPR processes Personal Data submitted by professional accounts (shelters, vets, breeders, government) in the course of managing their pet registrations, medical records, and organizational data, IPR acts as a Data Processor on behalf of the Customer (Controller).
• IPR as Controller: IPR acts as an independent Data Controller for its own business purposes, including account management, billing, platform security, and the operation of the shared microchip registry and NAAR.

This DPA governs IPR's role as Processor. IPR's processing as Controller is governed by the Privacy Policy.

4. Processing Instructions

IPR shall process Personal Data only in accordance with the Customer's documented instructions, which are deemed to include:

• Processing necessary to provide the Service as described in the Terms of Service.
• Processing initiated by authorized users within the Customer's account.
• Processing required to comply with applicable law (in which case IPR will inform the Customer of the legal requirement before processing, unless prohibited by law).

IPR shall immediately inform the Customer if, in IPR's opinion, an instruction infringes applicable data protection legislation.

5. Sub-Processors

The Customer provides general authorization for IPR to engage Sub-Processors. IPR currently engages the following Sub-Processors:

IPR will notify the Customer at least 30 days before engaging a new Sub-Processor or replacing an existing one, providing the Customer the opportunity to object. If the Customer objects on reasonable data protection grounds, IPR will make reasonable efforts to address the objection or will allow the Customer to terminate the affected services.

IPR imposes data protection obligations on each Sub-Processor no less protective than those in this DPA through written agreements. IPR remains liable for the acts and omissions of its Sub-Processors.

6. Security Measures

IPR implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of Personal Data at rest (AES-256) and in transit (TLS 1.3).
• Role-based access controls and the principle of least privilege.
• Row-Level Security (RLS) policies at the database level.
• Regular security assessments, vulnerability scanning, and penetration testing.
• Automated monitoring and alerting for security events.
• Documented incident response procedures.
• Employee security training and confidentiality agreements.
• Secure development lifecycle practices, including code review and SAST.

A detailed description of our security measures is available at /legal/security.

7. Data Breach Notification

In the event of a Data Breach affecting Personal Data processed on behalf of the Customer, IPR will:

• Notify the Customer without undue delay and in any event within 72 hours of becoming aware of the breach, in compliance with GDPR Article 33.
• Provide the Customer with sufficient information to meet the Customer's obligations to notify supervisory authorities and data subjects, including:
  • The nature of the breach, including where possible the categories and approximate number of data subjects and records concerned.
  • The likely consequences of the breach.
  • The measures taken or proposed to address the breach, including measures to mitigate its adverse effects.
• Cooperate with the Customer in investigating and remediating the breach.
• Document all breaches, including the facts, effects, and remedial actions taken.

8. Data Subject Rights Assistance

IPR will assist the Customer in fulfilling its obligations to respond to data subject requests under applicable data protection laws, including requests for:

• Access to Personal Data.
• Rectification of inaccurate data.
• Erasure of Personal Data ("right to be forgotten").
• Restriction of processing.
• Data portability.
• Objection to processing.

If IPR receives a data subject request directly from an individual whose data is processed on behalf of the Customer, IPR will promptly redirect the request to the Customer, unless otherwise required by law.

IPR will provide the Customer with self-service tools to export, modify, and delete data where technically feasible, and will provide manual assistance for requests that cannot be fulfilled through self-service tools.

9. Data Return & Deletion

Upon termination or expiration of the Customer's subscription:

• IPR will make the Customer's data available for export in a commonly used, machine-readable format for a period of 30 days following termination.
• After the 30-day export period, IPR will delete the Customer's Personal Data from active systems within 90 days, except where retention is required by applicable law or for legitimate purposes described in the Privacy Policy.
• Data stored in backup systems will be overwritten in the normal course of backup rotation, typically within 180 days.
• NAAR records submitted by the Customer will be retained as permanent records per the NAAR terms, but will be disassociated from the Customer's account.
• Upon request, IPR will provide written confirmation of data deletion.

10. Audit Rights

The Customer has the right to audit IPR's compliance with this DPA, subject to the following conditions:

• IPR will make available to the Customer all information necessary to demonstrate compliance with obligations under this DPA and applicable data protection law.
• IPR will allow and contribute to audits conducted by the Customer or a qualified third-party auditor mandated by the Customer, subject to reasonable advance notice (at least 30 days) and confidentiality obligations.
• Audits shall be conducted during normal business hours, no more than once per year (unless required by a supervisory authority or following a Data Breach), and shall not unreasonably disrupt IPR's operations.
• IPR may satisfy audit requests by providing relevant third-party audit reports (e.g., SOC 2, ISO 27001) and certifications, supplemented by additional information as reasonably requested.

11. Cross-Border Transfer Mechanisms

When Personal Data is transferred from the EEA, UK, or Switzerland to a country not recognized as providing an adequate level of data protection, IPR relies on the following transfer mechanisms:

• Standard Contractual Clauses (SCCs): IPR enters into the European Commission's approved SCCs (Module 2: Controller to Processor, and Module 3: Processor to Processor as applicable) with Customers and Sub-Processors.
• UK International Data Transfer Agreement (IDTA): For transfers from the UK, IPR uses the UK IDTA or the UK Addendum to the EU SCCs as applicable.
• Supplementary Measures: Where required by the Schrems II decision, IPR implements supplementary technical measures including encryption, pseudonymization, and access controls.
• Transfer Impact Assessments: IPR conducts transfer impact assessments to evaluate the level of protection available in the recipient country.

12. Liability & Indemnification

Each party's liability under this DPA is subject to the limitations of liability set out in the Terms of Service.

IPR shall be liable for damages caused by processing that does not comply with the obligations of this DPA or applicable data protection law specifically directed at IPR as Processor. IPR shall be exempt from liability if it demonstrates that it is not in any way responsible for the event giving rise to the damage.

Each party shall indemnify the other party for any costs, claims, damages, or expenses (including reasonable legal fees) arising from the indemnifying party's breach of this DPA or applicable data protection law.

13. Term & Termination

This DPA takes effect on the date the Customer first accesses the Service and continues for the duration of IPR's processing of Personal Data on behalf of the Customer.

The DPA automatically terminates upon expiration or termination of the underlying Terms of Service, subject to IPR's obligations regarding data return and deletion (Section 9).

Provisions that by their nature should survive termination shall survive, including data deletion obligations, audit rights (for a period of one year after termination), confidentiality obligations, and liability provisions.

This DPA shall be governed by the same law that governs the Terms of Service. In the event of any conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to matters of data protection.