Data Processing Agreement.

1.1 "Personal Data" means any information relating to an identified or identifiable natural person that is processed by Alleviate on behalf of the Customer.

1.2 "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.

1.3 "Data Controller" means the entity that determines the purposes and means of Processing Personal Data.

1.4 "Data Processor" means the entity that processes Personal Data on behalf of the Data Controller.

1.5 "Applicable Data Protection Laws" means GDPR, UK GDPR, and any other applicable privacy laws.

2.1 Roles of the Parties: The Customer is the Data Controller, and Alleviate is the Data Processor processing Personal Data on the Customer's behalf.

2.2 Purpose of Processing: Alleviate will process Personal Data solely for the purpose of providing its services as described in the Terms of Use.

2.3 Instructions: Alleviate will process Personal Data only on documented instructions from the Customer unless required by law.

3.1 Security Measures: Alleviate shall implement appropriate technical and organizational measures to ensure the security of Personal Data, including:

• Encryption and access controls
• Regular security audits
• Secure storage and transfer protocols

3.2 Confidentiality: Alleviate ensures that all employees or agents authorized to process Personal Data are bound by confidentiality obligations.

4.1 Appointment of Sub-Processors: The Customer authorizes Alleviate to engage third-party sub-processors to process Personal Data, provided that:

• The sub-processor complies with equivalent data protection obligations.
• Alleviate remains fully liable for any sub-processor's actions.

4.2 Current Sub-Processors: A list of Alleviate's sub-processors will be made available upon request.

5.1 Assistance with Requests: Alleviate will assist the Customer in responding to data subject requests (e.g., access, deletion, correction) in compliance with GDPR.

5.2 Complaints and Investigations: If a complaint, audit, or investigation is initiated by a regulatory authority concerning Personal Data, Alleviate will promptly inform the Customer and cooperate as required.

6.1 International Transfers: Alleviate may process Personal Data outside of the EU/EEA. Where applicable, Alleviate shall ensure compliance with GDPR through appropriate safeguards such as Standard Contractual Clauses (SCCs).

7.1 Retention Period: Alleviate will retain Personal Data only for as long as necessary to fulfill its contractual obligations or as required by law.

7.2 Deletion of Data: Upon termination of services, the Customer may request the deletion of all Personal Data processed by Alleviate.

8.1 Limitation of Liability: Alleviate's liability under this DPA shall be limited in accordance with the Terms of Use.

8.2 Indemnification: Each party shall indemnify the other for any claims arising due to a breach of data protection obligations under this DPA.

This DPA shall be governed by the laws of the State of Delaware, United States. Any disputes shall be resolved through arbitration or litigation in accordance with the Terms of Use.

By using Alleviate's services to process Personal Data, the Customer agrees to be bound by the terms of this Data Processing Agreement (DPA).

For any questions, contact us at privacy@alleviate.org.