Data Processing Agreement

1. Scope and Purpose

This Data Processing Agreement (DPA) supplements our Terms of Service and governs the processing of personal data by Foxxy on behalf of customers who act as data controllers under applicable data protection laws.

2. Definitions

'Personal Data', 'Data Controller', 'Data Processor', and 'Processing' have the meanings given in the GDPR (EU Regulation 2016/679) or equivalent applicable legislation.

3. Data Processing Obligations

Foxxy shall process personal data only on documented instructions from the customer, ensure that persons authorized to process data have committed to confidentiality, and implement appropriate technical and organizational security measures.

4. Sub-processors

Foxxy may engage sub-processors to assist in providing services. We maintain a list of current sub-processors and will notify customers of any changes. Sub-processors are bound by data protection obligations equivalent to those in this DPA.

5. Data Subject Rights

Foxxy will assist the customer in responding to requests from data subjects exercising their rights under applicable data protection laws, including access, rectification, erasure, and portability requests.

6. Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and audits
• Access controls and authentication mechanisms
• Incident detection and response procedures
• Regular backup and recovery testing

7. Data Breach Notification

In the event of a personal data breach, Foxxy will notify the customer without undue delay and provide information necessary for the customer to fulfill their breach notification obligations.

8. Data Deletion

Upon termination of services, Foxxy will delete or return all personal data to the customer, unless retention is required by applicable law.