Data Processing Agreement (DPA)
This Data Processing Agreement (“DPA”) forms part of the agreement between Um Family Labs, LLC (“Processor”, “we”, “us”) and the customer entity that has accepted it (“Controller”, “you”, “Customer”) for the provision of du-game-maker (the “Services”).
This DPA reflects the parties’ agreement with respect to the Processing of Personal Data by us on behalf of you, in connection with the Services.
1. Definitions
- Data Protection Laws: any privacy or data-protection laws applicable to the Processing of Personal Data under this DPA, including without limitation the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), and any other applicable laws.
- Personal Data: any information relating to an identified or identifiable natural person, as defined by the applicable Data Protection Laws.
- Processing: any operation performed on Personal Data, as defined by the applicable Data Protection Laws.
- Sub-processor: any third party engaged by us to Process Personal Data on behalf of the Customer in the provision of the Services.
- Data Subject: the natural person to whom Personal Data relates.
Other capitalized terms have the meanings given to them in the applicable Data Protection Laws or in the parties’ main agreement.
2. Roles & Scope
For the Processing of Personal Data covered by this DPA:
- The Customer is the Controller of Personal Data.
- Um Family Labs, LLC is the Processor acting on Customer’s documented instructions.
- This DPA applies only to Processing carried out by us in our role as Processor in the provision of the Services to the Customer.
3. Customer Instructions
We will Process Personal Data only on Customer’s documented instructions, including with regard to transfers to a third country, unless required to do so by applicable law. We will inform Customer of that legal requirement before Processing, unless that law prohibits such information.
The parties agree that the main agreement and this DPA, together with Customer’s use of the Services in accordance with their documentation, constitute Customer’s complete documented instructions to us.
4. Confidentiality
We will ensure that persons authorized to Process Personal Data are bound by confidentiality obligations.
5. Security Measures
We will implement appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures are described in Annex B (Security Measures) below.
We will assist Customer, taking into account the nature of the Processing and the information available to us, in ensuring compliance with Customer’s obligations relating to security under applicable Data Protection Laws.
6. Sub-processors
Customer authorizes us to engage Sub-processors listed at https://du-game-maker.umfamily.org/legal/sub-processors. We will:
- Impose data-protection obligations on Sub-processors substantively equivalent to those in this DPA.
- Remain liable to Customer for the acts and omissions of our Sub-processors to the same extent as if we had performed the acts or omissions ourselves.
- Maintain the list of Sub-processors at the URL above. Customer may subscribe to update notifications at that page.
- Notify Customer at least 30 days before engaging a new Sub-processor. If Customer reasonably objects on data-protection grounds within that notice period, the parties will work in good faith to find a solution; if no solution can be agreed, Customer may terminate the affected Services.
7. Data Subject Rights
Taking into account the nature of the Processing, we will assist Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling Customer’s obligations to respond to requests to exercise Data Subject rights under applicable Data Protection Laws (including access, rectification, erasure, restriction, data portability, and objection).
If we receive a request from a Data Subject in respect of Personal Data processed under this DPA, we will, where lawful, forward the request to Customer and not respond to the Data Subject directly, except to acknowledge receipt and direct the Data Subject to Customer.
8. Data Breach Notification
We will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer’s Personal Data. The notification will include, to the extent then known:
- The nature of the breach, including the categories and approximate number of Data Subjects and records concerned.
- Likely consequences of the breach.
- Measures taken or proposed to address the breach and mitigate its effects.
9. Data Protection Impact Assessments
We will provide reasonable assistance to Customer with any Data Protection Impact Assessments and prior consultations with supervisory authorities that Customer is required to carry out under applicable Data Protection Laws.
10. Audits
We will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer, no more than once per year and on reasonable advance notice, subject to confidentiality obligations.
For Customers with no specific audit requirements, we may satisfy this obligation by providing third-party audit reports (e.g., when available, SOC 2 reports) or completed industry-standard security questionnaires.
11. International Transfers
If Personal Data is transferred outside the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the transfer is governed by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), incorporated into this DPA by reference, with the following module elections:
- Module Two (Controller-to-Processor) applies between the parties.
- For onward transfers to Sub-processors, Module Three (Processor-to-Processor) applies between us and the Sub-processor.
For transfers from the United Kingdom, the UK Addendum to the SCCs applies. For transfers from Switzerland, the Swiss Federal Data Protection Act variant applies.
12. Deletion or Return of Personal Data
Upon termination of the Services, we will, at Customer’s choice, delete or return all Personal Data Processed on Customer’s behalf, and delete existing copies, unless applicable law requires retention. Deletion will be completed within 90 days of termination unless a longer period is specified by applicable law or expressly agreed.
Customer may export Personal Data via the Services prior to termination.
13. Liability
Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the parties’ main agreement.
14. Term
This DPA is effective for as long as we Process Personal Data on Customer’s behalf under the main agreement.
15. Governing Law
This DPA is governed by the laws specified in the parties’ main agreement, except where mandatory Data Protection Laws require otherwise.
Annex A — Description of Processing
| Item | Description |
|---|---|
| Subject matter | Provision of the du-game-maker Service |
| Duration | For the term of the main agreement plus any required retention period |
| Nature & purpose | Operating, maintaining, and improving the Service; providing customer support; legal compliance |
| Categories of Data Subjects | Customer’s authorized users, customer’s end users, customer’s business contacts |
| Categories of Personal Data | Identification data (name, email), authentication data (hashed passwords, session tokens), profile data, content provided by users, usage and log data, billing data |
| Special-category data | Not intended; Customer is responsible for not submitting special-category data unless specifically agreed |
Annex B — Security Measures
We implement appropriate technical and organizational measures including:
Access control
- Role-based access control to production systems with least-privilege defaults
- Multi-factor authentication required for administrative access
- Centralized identity management and access reviews
- Production access logged and audited
Encryption
- Encryption in transit using TLS 1.2 or higher
- Encryption at rest for production data stores (AWS-managed encryption with AES-256)
- Secrets stored in AWS Secrets Manager; never in source code or environment files committed to version control
Network security
- All public endpoints behind AWS WAF with managed rule sets and rate limiting
- Bot protection on public forms
- Restricted egress from production workloads
- Regular vulnerability scanning of dependencies
Operational security
- Production environments segregated from development
- Infrastructure provisioned through code (CDK) with change tracking
- Automated backups for critical data stores; periodic restore testing
- Incident response procedures documented and exercised
- Centralized logging with retention of at least 90 days for production logs
Personnel
- All personnel with access to Personal Data are bound by written confidentiality obligations.
- Security awareness training upon hire and periodically thereafter.
These measures will be reviewed periodically and updated as appropriate to reflect changes in the threat landscape and the nature of the Processing.
Acceptance: This DPA is accepted upon written acceptance by both parties (including electronic acceptance via the Customer’s authorized representative in the Service’s billing or account settings) or upon Customer’s first use of the Services following notification of these terms.
To execute this DPA outside the Service, contact privacy@du-game-maker.umfamily.org.