![](media/image2.jpg){width="2.5077438757655295in"
height="1.7291666666666667in"}

**DATA PROCESSING AGREEMENT**

**Effective Date:** \[Date\]

**PARTIES**

**This Data Processing Agreement (\"DPA\") is entered into between:**

**Data Controller:**\
\[Legal Name\]\
\[Address\]\
\[City, Country, Postal Code\]\
(\"Controller\")

**AND**

**Data Processor:**\
Proof Labs LLC d/b/a Phase Mirror\
\[Address\]\
\[City, State, ZIP Code, USA\]\
(\"Processor\")

**RECITALS**

**WHEREAS**, Controller has engaged Processor to provide AI governance
services, including the Phase Mirror Oracle platform, consulting, and
related services (the \"Services\");

**WHEREAS**, in the course of providing the Services, Processor will
process Personal Data on behalf of Controller;

**WHEREAS**, Controller is subject to the General Data Protection
Regulation (EU) 2016/679 (\"GDPR\") and related data protection laws;

**WHEREAS**, Controller may use Processor\'s services in connection with
AI systems subject to Regulation (EU) 2024/1689 (the \"EU AI Act\");

**WHEREAS**, the parties wish to ensure compliance with applicable data
protection laws and establish the terms under which Personal Data will
be processed;

**NOW, THEREFORE**, the parties agree as follows:

**ARTICLE 1: DEFINITIONS AND INTERPRETATION**

**1.1 Definitions**

For purposes of this DPA:

  Term                                      Definition
  ----------------------------------------- ------------------------------------------------------------------------------------------------------------------------------------------------------------------
  **Affiliate**                             Any entity that directly or indirectly controls, is controlled by, or is under common control with a party
  **Applicable Data Protection Law**        GDPR, EU AI Act, and all other applicable laws relating to data protection, privacy, and security
  **Controller Personal Data**              Personal Data processed by Processor on behalf of Controller pursuant to this DPA
  **Data Subject**                          An identified or identifiable natural person as defined in GDPR Article 4(1)
  **Data Subject Request**                  A request from a Data Subject to exercise their rights under Applicable Data Protection Law
  **EEA**                                   European Economic Area
  **EU AI Act**                             Regulation (EU) 2024/1689 of the European Parliament and of the Council on Artificial Intelligence
  **Personal Data**                         Any information relating to an identified or identifiable natural person as defined in GDPR Article 4(1)
  **Personal Data Breach**                  A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data
  **Processing**                            Any operation performed on Personal Data as defined in GDPR Article 4(2)
  **Services Agreement**                    The underlying agreement(s) between the parties governing provision of the Services, including Terms of Service, Statements of Work, and subscription agreements
  **Standard Contractual Clauses (SCCs)**   The standard contractual clauses approved by the European Commission for transfers of Personal Data to third countries
  **Sub-processor**                         Any third party engaged by Processor to process Controller Personal Data
  **Supervisory Authority**                 An independent public authority established by an EU Member State pursuant to GDPR Article 51

**1.2 Interpretation**

References to \"GDPR Article\" or \"GDPR Annex\" mean the article or
annex of the GDPR. Terms not defined in this DPA have the meanings given
in the GDPR.

**ARTICLE 2: SCOPE AND RELATIONSHIP TO SERVICES AGREEMENT**

**2.1 Scope**

This DPA applies to all Processing of Controller Personal Data by
Processor in connection with the Services.

**2.2 Relationship to Services Agreement**

This DPA forms part of and supplements the Services Agreement. In the
event of conflict between this DPA and the Services Agreement with
respect to Processing of Personal Data, this DPA prevails.

**2.3 Hierarchy of Documents**

In the event of conflict, documents take precedence in the following
order:

1.  Standard Contractual Clauses (if applicable)

2.  This Data Processing Agreement

3.  Services Agreement

4.  Service-specific exhibits

**ARTICLE 3: ROLES AND RESPONSIBILITIES**

**3.1 Respective Roles**

The parties acknowledge and agree that:

\(a\) Controller is the Controller of Controller Personal Data;

\(b\) Processor is the Processor of Controller Personal Data;

\(c\) Each party shall comply with its obligations under Applicable Data
Protection Law;

\(d\) Controller shall ensure it has all necessary legal bases and
provides all required notices for Processor to process Controller
Personal Data as contemplated by the Services Agreement.

**3.2 Controller Instructions**

\(a\) Processor shall process Controller Personal Data only on
documented instructions from Controller, unless required to do so by EU
or Member State law.

\(b\) The Services Agreement, this DPA, and any subsequent written
instructions constitute Controller\'s complete documented instructions
for Processing.

\(c\) If Processor believes an instruction infringes Applicable Data
Protection Law, Processor shall immediately inform Controller.

\(d\) Controller may issue additional written instructions via:

-   Email to \[processor-instructions\@phasemirror.io\]

-   Through the Platform\'s administrative interface (for Platform
    > customers)

-   Written notice pursuant to the Services Agreement

**3.3 Processing Details**

**Annex I attached hereto specifies:**

-   Nature and purpose of Processing

-   Types of Personal Data

-   Categories of Data Subjects

-   Duration of Processing

**ARTICLE 4: PROCESSOR OBLIGATIONS**

**4.1 Confidentiality**

\(a\) Processor shall ensure that persons authorized to process
Controller Personal Data:

-   Are subject to binding confidentiality obligations (contractual or
    > statutory);

-   Receive appropriate training on data protection;

-   Process Personal Data only as necessary for the Services.

\(b\) Processor maintains a list of personnel with access to Controller
Personal Data, available upon request.

**4.2 Security Measures**

\(a\) Processor shall implement appropriate technical and organizational
measures to ensure a level of security appropriate to the risk,
including as appropriate:

-   Pseudonymization and encryption of Personal Data;

-   Ability to ensure ongoing confidentiality, integrity, availability,
    > and resilience of Processing systems;

-   Ability to restore availability and access to Personal Data in a
    > timely manner after an incident;

-   Regular testing, assessment, and evaluation of effectiveness of
    > security measures.

\(b\) **Annex II attached hereto describes** Processor\'s technical and
organizational security measures.

\(c\) Processor shall take steps to ensure that Sub-processors implement
equivalent security measures.

**4.3 Sub-processing**

\(a\) Controller provides general authorization for Processor to engage
Sub-processors, subject to the requirements of this Article 4.3.

\(b\) **Current Sub-processors** are listed in **Annex III attached
hereto**.

\(c\) **New Sub-processors:** Processor shall inform Controller at least
**30 days** in advance of any intended addition or replacement of
Sub-processors. Controller may object to such changes on reasonable
grounds relating to data protection within **14 days** of notification.

\(d\) If Controller objects:

-   Parties shall discuss in good faith to address concerns;

-   If unresolved, Controller may terminate the affected Services
    > without penalty;

-   Processor shall not engage the objected Sub-processor for
    > Controller\'s data.

\(e\) Processor shall:

-   Impose data protection obligations on Sub-processors that are
    > equivalent to those in this DPA;

-   Ensure Sub-processors comply with GDPR Chapter V for international
    > transfers;

-   Remain fully liable to Controller for Sub-processor performance.

\(f\) Upon Controller request, Processor shall provide copies of
Sub-processor agreements (with commercially sensitive terms redacted).

**4.4 Data Subject Rights**

\(a\) Taking into account the nature of Processing, Processor shall
assist Controller by implementing appropriate technical and
organizational measures, insofar as possible, to fulfill Controller\'s
obligations to respond to Data Subject Requests.

\(b\) **Requests Received by Processor:**\
If Processor receives a Data Subject Request directly, Processor shall:

-   Forward the request to Controller within **2 business days**;

-   Not respond to the request except on Controller\'s documented
    > instructions or as required by law;

-   Inform the Data Subject that Processor is acting as Processor and
    > refer them to Controller.

\(c\) **Assistance to Controller:**\
Upon Controller\'s request, Processor shall assist Controller in
responding to Data Subject Requests by:

  Right (GDPR Article)         Processor Assistance
  ---------------------------- -----------------------------------------------------------------------------------------------------
  Access (Art. 15)             Provide access to Controller Personal Data in Processor\'s systems within 10 business days
  Rectification (Art. 16)      Rectify inaccurate Personal Data as directed by Controller within 5 business days
  Erasure (Art. 17)            Delete Personal Data as directed by Controller within 10 business days
  Restriction (Art. 18)        Restrict Processing as directed by Controller within 5 business days
  Data Portability (Art. 20)   Provide Personal Data in structured, commonly used, machine-readable format within 10 business days
  Objection (Art. 21)          Cease Processing as directed by Controller within 5 business days

\(d\) Processor may charge reasonable fees for assistance beyond
ordinary obligations, calculated at \[rate\] per hour.

**4.5 Data Protection Impact Assessment and Prior Consultation**

\(a\) Processor shall provide reasonable assistance to Controller in
conducting Data Protection Impact Assessments (DPIAs) under GDPR Article
35, if required.

\(b\) Processor shall provide reasonable assistance to Controller in
consulting with Supervisory Authorities under GDPR Article 36, if
required.

\(c\) Such assistance includes:

-   Description of Processing operations and purposes;

-   Assessment of necessity and proportionality of Processing;

-   Description of security measures implemented;

-   Information about Sub-processors and international transfers.

**4.6 Personal Data Breach Notification**

\(a\) Processor shall notify Controller without undue delay and in any
event within **24 hours** of becoming aware of a Personal Data Breach
affecting Controller Personal Data.

\(b\) Notification shall include:

-   Description of the nature of the breach, including where possible:

    -   Categories and approximate number of Data Subjects affected;

    -   Categories and approximate number of Personal Data records
        > affected;

-   Name and contact details of Processor\'s data protection officer or
    > other contact point;

-   Description of likely consequences of the breach;

-   Description of measures taken or proposed to address the breach and
    > mitigate its possible adverse effects.

\(c\) If information cannot be provided simultaneously, Processor shall
provide information in phases without undue further delay.

\(d\) Processor shall:

-   Document all Personal Data Breaches;

-   Cooperate with Controller\'s breach investigation;

-   Provide Controller with information necessary for Controller to
    > notify Supervisory Authorities and Data Subjects;

-   Not notify Supervisory Authorities, Data Subjects, or third parties
    > without Controller\'s prior written consent, except as required by
    > law.

\(e\) **Breach Investigation and Remediation:**\
Processor shall:

-   Conduct root cause analysis within 10 business days;

-   Implement remediation measures within timeframe agreed with
    > Controller;

-   Provide written breach report to Controller within 15 business days;

-   Reimburse Controller for reasonable costs of mandatory Data Subject
    > notifications caused by Processor\'s breach (subject to
    > limitations in Services Agreement).

**4.7 Deletion or Return of Personal Data**

\(a\) Upon termination or expiration of the Services Agreement,
Processor shall, at Controller\'s choice:

-   Delete all Controller Personal Data; or

-   Return all Controller Personal Data to Controller.

\(b\) **Timeline:** Within **30 days** of termination/expiration.

\(c\) **Certification:** Processor shall certify in writing to
Controller that it has complied with this Article 4.7.

\(d\) **Exceptions:** Processor may retain Controller Personal Data to
the extent required by applicable law, provided that Processor shall:

-   Inform Controller of such legal requirement before retention;

-   Ensure confidentiality and limit Processing to purposes required by
    > law;

-   Continue to protect Personal Data in accordance with this DPA;

-   Delete when retention is no longer legally required.

\(e\) **Backups:** Personal Data in backup systems will be deleted in
accordance with Processor\'s standard backup deletion cycle (maximum 90
days) following active deletion.

**4.8 Audits and Inspections**

\(a\) Processor shall make available to Controller all information
necessary to demonstrate compliance with GDPR Article 28.

\(b\) **Documentation:** Upon reasonable request, Processor shall
provide:

-   Current security policies and procedures;

-   SOC 2 Type II report (under NDA);

-   Evidence of Sub-processor compliance;

-   Personnel training records;

-   Incident logs.

\(c\) **Audits:** Processor shall allow for and contribute to audits,
including inspections, conducted by Controller or an auditor mandated by
Controller, subject to:

  Audit Element         Terms
  --------------------- -----------------------------------------------------------------------------------------
  **Frequency**         Once per year, plus additional audits if reasonable grounds exist
  **Notice**            30 days\' advance written notice (except for urgent breach investigations)
  **Scope**             Limited to Controller Personal Data and compliance with this DPA
  **Timing**            During Processor\'s business hours
  **Confidentiality**   Auditor must execute Processor\'s standard NDA
  **Cost**              Controller bears cost; Processor may charge for time beyond 8 hours at \[rate\]/hour
  **Disruption**        Audits conducted to minimize disruption to Processor\'s business
  **Report**            Controller provides audit report within 30 days; parties address findings in good faith

\(d\) Controller may rely on third-party certifications (SOC 2 Type II,
ISO 27001) in lieu of on-site audit, provided such certifications are
current (within 12 months).

**4.9 Records of Processing Activities**

Processor shall maintain records of Processing activities carried out on
behalf of Controller in accordance with GDPR Article 30(2), including:

-   Name and contact details of Processor and Controller;

-   Categories of Processing;

-   Description of technical and organizational security measures;

-   Where applicable, transfers to third countries and appropriate
    > safeguards.

Processor shall make such records available to Supervisory Authorities
upon request.

**ARTICLE 5: INTERNATIONAL DATA TRANSFERS**

**5.1 General Provisions**

\(a\) Controller acknowledges that Processor is located in the United
States and Processing may involve transfer of Controller Personal Data
outside the EEA.

\(b\) Controller appoints Processor to effect such transfers on
Controller\'s behalf, subject to appropriate safeguards.

**5.2 Data Transfer Locations**

**Primary Processing Location:** United States (specify region:
\[US-East / US-West / other\])

**Sub-processor Locations:** As specified in Annex III

**Controller Options:**\
☐ Controller requires EU-only data residency (Enterprise tier only)\
☐ Controller permits US processing with appropriate safeguards\
☐ Controller permits global processing with appropriate safeguards

**5.3 Transfer Mechanisms**

For transfers of Controller Personal Data from the EEA to Processor or
Sub-processors in third countries not subject to an adequacy decision,
the parties agree to the following transfer mechanism:

**Primary Mechanism:**\
☐ **Standard Contractual Clauses (SCCs)** - EU Commission Decision
2021/914

-   Module: Controller-to-Processor (Module Two)

-   Clauses executed as **Annex IV** to this DPA

-   Clauses incorporated by reference and form integral part of DPA

☐ **Data Privacy Framework (DPF)** - EU-U.S. Data Privacy Framework

-   Processor is certified under DPF (Certification \#: \[\_\_\_\_\_\])

-   Certification status: \[Active / Pending renewal\]

-   Verification:
    > [[https://www.dataprivacyframework.gov/]{.underline}](https://www.dataprivacyframework.gov/)

☐ **Binding Corporate Rules (BCRs)** - For transfers within corporate
group

-   BCR approval: \[Supervisory Authority\] dated \[Date\]

**Supplementary Measures:**\
In addition to the transfer mechanism above, Processor implements the
following supplementary measures per Schrems II (CJEU C-311/18):

-   ☑ Encryption of Personal Data in transit (TLS 1.3) and at rest
    > (AES-256)

-   ☑ Pseudonymization where technically feasible

-   ☑ Access controls limiting personnel access

-   ☑ Contractual prohibitions on government data requests beyond legal
    > requirements

-   ☑ Transparency: Processor will notify Controller of government
    > access requests unless legally prohibited

-   ☑ Split processing: Sensitive Personal Data processed only in EEA
    > (if applicable)

-   ☑ Regular review and update of transfer impact assessment

**5.4 Transfer Impact Assessment (TIA)**

\(a\) Processor has conducted a Transfer Impact Assessment for transfers
to the United States, considering:

-   Applicable law in country of destination;

-   Effectiveness of contractual safeguards;

-   Practical circumstances of transfer;

-   Nature and purpose of Processing.

\(b\) **TIA Conclusion:** \[Summary of findings - to be completed based
on Processor\'s assessment\]

\(c\) Controller may request copy of TIA (with confidential portions
redacted) for Controller\'s own assessment.

\(d\) Processor shall update TIA if there are material changes to:

-   Law or practice in country of destination;

-   Technical or organizational measures;

-   Nature of Processing.

**5.5 Onward Transfers by Sub-processors**

Any Sub-processor engaged by Processor that involves a transfer to a
third country shall:

-   Be subject to same transfer mechanism (SCCs or adequacy decision);

-   Implement equivalent supplementary measures;

-   Be listed in Annex III with transfer safeguards specified.

**5.6 Government Access Requests**

\(a\) If Processor receives a legally binding request from a government
authority for access to Controller Personal Data, Processor shall:

-   Notify Controller immediately unless legally prohibited;

-   Challenge the request if Processor has reasonable grounds to believe
    > it is unlawful;

-   Provide minimum Personal Data necessary to comply;

-   Document the request and response;

-   Inform Controller of legal prohibition if notification was initially
    > prohibited but prohibition is later lifted.

\(b\) Processor publishes an annual transparency report detailing
government requests received (in aggregate, anonymized form).

**ARTICLE 6: EU AI ACT COMPLIANCE**

**6.1 Applicability**

This Article applies when Controller uses Processor\'s Services in
connection with AI systems subject to the EU AI Act.

**6.2 Nature of AI-Related Processing**

Controller acknowledges that Processor provides:

-   AI governance analysis tools (Phase Mirror Oracle);

-   Risk classification engines for EU AI Act compliance;

-   Documentation and conformity assessment support;

-   Consulting services for AI governance.

Processor does not:

-   Develop or deploy AI systems on Controller\'s behalf;

-   Make decisions about AI system design or use cases;

-   Determine purposes or means of AI system deployment.

**6.3 Processing for AI Governance Purposes**

\(a\) **Personal Data in AI System Documentation:**\
Controller may provide Personal Data to Processor as part of:

-   AI system technical documentation;

-   Risk assessments and logs;

-   Testing and validation datasets;

-   Incident reports and monitoring data.

\(b\) **Purpose Limitation:**\
Processor shall process such Personal Data solely to provide AI
governance services to Controller, not for:

-   Training Processor\'s own AI systems (unless explicitly agreed and
    > anonymized);

-   Benchmarking Controller\'s AI systems publicly;

-   Any purpose beyond the Services.

\(c\) **Special Categories of Personal Data:**\
If Controller\'s AI system processes special categories of Personal Data
(GDPR Article 9) or Personal Data relating to criminal convictions (GDPR
Article 10):

-   Controller shall notify Processor in writing;

-   Additional security measures specified in Annex II shall apply;

-   Controller warrants it has legal basis under GDPR Article 9(2) or
    > national law.

**6.4 High-Risk AI Systems**

\(a\) If Controller uses Services for AI systems classified as
\"high-risk\" under EU AI Act Article 6 and Annex III:

**Enhanced Record-Keeping:**

-   Processor shall retain records of Processing activities for minimum
    > **10 years** from completion of Services (per EU AI Act Article
    > 12);

-   Records shall include: date and time of Processing, purpose, data
    > categories, recipients, and retention periods;

-   Controller may request copies of such records for regulatory
    > purposes.

**Enhanced Security:**

-   Processor shall implement additional security measures appropriate
    > for high-risk systems;

-   Annual third-party security audit (ISO 27001 or equivalent);

-   Enhanced logging and monitoring.

**Support for Conformity Assessment:**

-   Processor shall provide information necessary for Controller\'s
    > conformity assessment under EU AI Act Article 43;

-   Processor shall cooperate with notified bodies conducting
    > Controller\'s conformity assessment;

-   Processor may charge reasonable fees for extensive conformity
    > support beyond ordinary obligations.

\(b\) **Controller Notification Obligation:**\
Controller shall notify Processor in writing if an AI system for which
Services are used is classified as high-risk. Notification triggers
enhanced obligations above.

**6.5 Prohibited AI Practices**

\(a\) Controller warrants that it will not use Processor\'s Services for
AI practices prohibited under EU AI Act Article 5, including:

-   Social scoring systems;

-   Subliminal manipulation techniques;

-   Exploitation of vulnerabilities;

-   Real-time remote biometric identification in publicly accessible
    > spaces (except as permitted).

\(b\) If Processor becomes aware that Services are being used for
prohibited practices, Processor may:

-   Suspend Services immediately;

-   Notify relevant Supervisory Authority;

-   Terminate Services Agreement without penalty.

**6.6 Transparency Obligations**

\(a\) Processor shall maintain transparency regarding its Processing of
Personal Data for AI governance purposes, including:

-   Clear documentation of how Personal Data is used in dissonance
    > reports;

-   Explanation of risk classification methodology;

-   Description of automated decision-making (if any) in governance
    > tools.

\(b\) Processor shall provide Controller with information necessary for
Controller to fulfill its transparency obligations under EU AI Act
Article 13.

**6.7 Incident Reporting for AI Systems**

\(a\) If Processor becomes aware of:

-   A serious incident involving Controller\'s AI system (as defined in
    > EU AI Act Article 73);

-   A malfunction or breach that could lead to serious incident;

-   Personal Data Breach related to AI system;

Processor shall notify Controller within **24 hours** with sufficient
detail for Controller to assess reporting obligations to market
surveillance authorities.

\(b\) Processor shall cooperate with any investigation by market
surveillance authorities related to Controller\'s AI systems.

**6.8 Human Oversight**

\(a\) Processor\'s Services are designed to support, not replace, human
decision-making in AI governance.

\(b\) All dissonance reports, risk classifications, and governance
recommendations generated by Processor\'s tools:

-   Are advisory in nature;

-   Require human review and approval before implementation;

-   Do not constitute binding determinations or legal advice.

\(c\) Controller retains full responsibility for decisions regarding AI
system design, deployment, and governance.

**ARTICLE 7: LIABILITY AND INDEMNIFICATION**

**7.1 Liability Under GDPR**

\(a\) Each party\'s liability under GDPR Article 82 shall be subject to
the limitations in the Services Agreement, except where such limitations
are prohibited by law.

\(b\) Processor shall be liable for damages caused by Processing only
where it:

-   Has not complied with obligations specifically directed to
    > Processors under GDPR; or

-   Has acted outside or contrary to lawful instructions of Controller.

\(c\) Processor shall not be liable where it proves the event giving
rise to damage is not in any way attributable to Processor.

**7.2 Chain of Liability**

Where both Controller and Processor are involved in the same Processing
and liable for damages:

-   Each shall be held liable for the entire damage to ensure effective
    > compensation;

-   Processor may seek recourse from Sub-processors for the portion of
    > damages attributable to Sub-processor;

-   Where Processor has paid full compensation, Processor is entitled to
    > claim back from Controller or another Processor involved the
    > portion corresponding to their part of responsibility.

**7.3 Indemnification**

\(a\) **Processor Indemnification:**\
Processor shall indemnify Controller against:

-   GDPR fines and penalties imposed on Controller due to Processor\'s
    > breach of this DPA;

-   Reasonable costs of Data Subject compensation claims caused by
    > Processor\'s breach;

-   Reasonable legal fees incurred by Controller defending claims caused
    > by Processor\'s breach.

\(b\) **Controller Indemnification:**\
Controller shall indemnify Processor against:

-   Claims arising from Controller\'s unlawful instructions;

-   Claims arising from Controller\'s failure to obtain valid legal
    > basis for Processing;

-   GDPR penalties imposed on Processor for following Controller\'s
    > documented instructions despite Processor\'s notice that
    > instructions violate GDPR.

\(c\) **Indemnification Process:**

-   Indemnified party shall notify indemnifying party promptly of claim;

-   Indemnifying party has right to control defense;

-   Indemnified party shall cooperate in defense;

-   No settlement without indemnified party\'s consent if settlement
    > imposes obligations on indemnified party.

\(d\) **Caps:**\
Indemnification obligations are subject to liability caps in Services
Agreement, except where prohibited by law.

**ARTICLE 8: TERM AND TERMINATION**

**8.1 Term**

This DPA becomes effective on the Effective Date and continues for the
duration of the Services Agreement or until all Controller Personal Data
is deleted or returned, whichever is later.

**8.2 Termination for Cause**

\(a\) Controller may terminate this DPA immediately if:

-   Processor commits material breach and fails to remedy within 30
    > days;

-   Processor is subject to insolvency proceedings;

-   Processor cannot provide adequate safeguards for international
    > transfers.

\(b\) Upon such termination:

-   Services Agreement also terminates (or relevant Services are
    > removed);

-   Processor shall delete or return Personal Data per Article 4.7;

-   Controller is not liable for fees for terminated Services.

**8.3 Survival**

The following provisions survive termination:

-   Article 4.7 (Deletion or Return of Personal Data);

-   Article 4.8 (Audits for prior period);

-   Article 7 (Liability and Indemnification);

-   Article 9.4 (Governing Law);

-   Any other provisions that by their nature should survive.

**ARTICLE 9: GENERAL PROVISIONS**

**9.1 Data Protection Officer**

**Processor\'s Data Protection Officer:**

-   Name: \[Name\]

-   Email: \[dpo\@phasemirror.io\]

-   Address: \[Address\]

Controller and Data Subjects may contact the DPO regarding all matters
related to Processing of Controller Personal Data and exercise of rights
under GDPR.

**Controller\'s Data Protection Officer** (if applicable):

-   Name: \[To be provided by Controller\]

-   Email: \[To be provided by Controller\]

**9.2 Supervisory Authority**

Controller\'s lead Supervisory Authority is:

-   Name: \[To be specified by Controller\]

-   Country: \[To be specified by Controller\]

**9.3 Order of Precedence**

In case of conflict between documents, the following order of precedence
applies:

1.  Standard Contractual Clauses (Annex IV, if applicable)

2.  This Data Processing Agreement

3.  Services Agreement

4.  Other exhibits and attachments

**9.4 Governing Law**

\(a\) This DPA shall be governed by the laws of \[Ireland / other EU
Member State specified by Controller\], without regard to conflicts of
law principles.

\(b\) Standard Contractual Clauses (if applicable) are governed by the
law specified in the SCCs.

**9.5 Jurisdiction**

\(a\) Disputes arising under this DPA shall be subject to the exclusive
jurisdiction of the courts of \[Dublin, Ireland / other location
agreed\].

\(b\) Notwithstanding the above, either party may bring proceedings
before the Supervisory Authority or courts of any EU Member State in
accordance with GDPR Article 79.

**9.6 Amendment**

\(a\) This DPA may be amended only by written agreement signed by both
parties.

\(b\) Processor may update Annexes II (Security Measures) and III
(Sub-processors) in accordance with notification procedures in this DPA
without formal amendment.

\(c\) If changes to Applicable Data Protection Law require amendments to
this DPA, Processor shall propose amendments and parties shall negotiate
in good faith.

**9.7 Severability**

If any provision of this DPA is held invalid or unenforceable, the
remainder shall remain in effect and the invalid provision shall be
reformed to the minimum extent necessary to make it enforceable while
preserving parties\' intent.

**9.8 Language**

This DPA is executed in English. If translated, the English version
prevails in case of conflict.

**9.9 Notices**

Notices under this DPA shall be sent to:

**To Controller:** \[Address and email from preamble\]

**To Processor:**\
Proof Labs LLC d/b/a Phase Mirror\
Attn: Data Protection Officer\
\[Address\]\
Email: \[dpo\@phasemirror.io\]

**SIGNATURES**

**IN WITNESS WHEREOF**, the parties have executed this Data Processing
Agreement as of the Effective Date.

**DATA CONTROLLER:**

\[Legal Name\]

By: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Print Name: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Title: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Date: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**DATA PROCESSOR:**

Proof Labs LLC d/b/a Phase Mirror

By: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Print Name: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Title: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Date: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**ANNEX I: DETAILS OF PROCESSING**

**A. List of Parties**

**Data Controller:**

-   Name: \[Controller legal name\]

-   Address: \[Controller address\]

-   Contact person: \[Name, title, email\]

-   Activities relevant to data transferred: \[e.g., Healthcare provider
    > operating AI systems for clinical decision support\]

-   Role: Controller

**Data Processor:**

-   Name: Proof Labs LLC d/b/a Phase Mirror

-   Address: \[Address\]

-   Contact person: Data Protection Officer, \[dpo\@phasemirror.io\]

-   Activities relevant to data transferred: AI governance SaaS
    > platform, consulting services, and related support

-   Role: Processor

**B. Description of Transfer**

**Nature and purpose of Processing:**

☐ **Platform Services (SaaS):**

-   Analyzing AI system configurations, code, and documentation for
    > governance gaps

-   Generating dissonance reports identifying contradictions

-   Providing compliance assessment dashboards

-   Logging user activity and system access

☐ **Healthcare & Life Sciences Compliance Pack:**

-   Running HIPAA-specific governance rules

-   Generating compliance reports

-   Providing documentation templates

-   Privacy impact assessments

☐ **Consulting Services:**

-   AI governance diagnostics

-   Policy review and development

-   Risk assessment

-   Strategic advisory

☐ **Implementation Services:**

-   Technical deployment of Platform

-   Integration with client systems

-   Configuration and testing

-   Administrator training

☐ **Support Services:**

-   Technical support and troubleshooting

-   Issue investigation and resolution

-   Platform optimization

☐ **Training Programs:**

-   Educational courses on AI governance

-   Certification programs

**Duration of Processing:**

-   Active Processing: Duration of subscription or engagement

-   Retention after termination: 30 days (then deletion unless legally
    > required)

-   Backup retention: Up to 90 days

**Frequency of Processing:**

-   Continuous (Platform services)

-   Project-based (Consulting, Implementation)

-   On-demand (Support, Training)

**C. Categories of Data Subjects**

☐ Employees of Controller\
☐ Contractors/consultants of Controller\
☐ Healthcare providers (physicians, nurses, clinicians)\
☐ Administrative staff\
☐ IT/Technical staff\
☐ Patients (if PHI in AI system documentation) - *Specify if
applicable*\
☐ Research subjects (if AI used in research)\
☐ Other: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**D. Categories of Personal Data**

☐ **Identity Information:**

-   Names

-   Employee IDs

-   User IDs/account names

-   Email addresses

-   Phone numbers

☐ **Professional Information:**

-   Job titles

-   Department/organization

-   Professional credentials

☐ **Technical Information:**

-   IP addresses

-   Device identifiers

-   Login timestamps

-   System access logs

-   User activity data

☐ **AI System Documentation:**

-   Configuration files (may contain data subject references)

-   Code comments (may contain names)

-   Test data (should be synthetic/de-identified)

-   Error logs

-   System specifications

☐ **Communications:**

-   Support ticket content

-   Email correspondence

-   Meeting notes from consulting engagements

☐ **Health Data** (if applicable, Controller must notify Processor):

-   Diagnoses, treatment information (if in AI documentation)

-   Clinical notes excerpts

-   Medical device data

-   Research subject data

☐ **Special Categories** (GDPR Article 9 - Controller must provide
explicit notice):

-   Racial or ethnic origin

-   Political opinions

-   Religious/philosophical beliefs

-   Trade union membership

-   Genetic data

-   Biometric data

-   Health data

-   Sex life/sexual orientation

☐ **Criminal Conviction Data** (GDPR Article 10 - Controller must
provide explicit notice):

-   Criminal convictions and offences

**E. Sensitive Data**

**Are special categories of Personal Data (GDPR Art. 9) involved?**\
☐ Yes (specify categories above and legal basis below)\
☐ No

**If yes, Controller\'s legal basis for Processing:**\
☐ Explicit consent (GDPR Art. 9(2)(a))\
☐ Employment/social security law (GDPR Art. 9(2)(b))\
☐ Vital interests (GDPR Art. 9(2)(c))\
☐ Legitimate activities (GDPR Art. 9(2)(d))\
☐ Data manifestly made public (GDPR Art. 9(2)(e))\
☐ Legal claims (GDPR Art. 9(2)(f))\
☐ Substantial public interest (GDPR Art. 9(2)(g))\
☐ Health/social care (GDPR Art. 9(2)(h))\
☐ Public health (GDPR Art. 9(2)(i))\
☐ Archiving/research/statistics (GDPR Art. 9(2)(j))

**F. Competent Supervisory Authority**

**Controller\'s lead Supervisory Authority:**

-   Name: \[e.g., Irish Data Protection Commission, CNIL, etc.\]

-   Country: \[Country\]

-   Website: \[URL\]

**ANNEX II: TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES**

**A. Measures of Pseudonymization and Encryption**

  Measure                     Description                                            Status
  --------------------------- ------------------------------------------------------ -------------------------------------
  **Encryption at Rest**      AES-256 encryption for all stored Personal Data        ✓ Implemented
  **Encryption in Transit**   TLS 1.3 for all data transmissions                     ✓ Implemented
  **Database Encryption**     Transparent Data Encryption (TDE) for databases        ✓ Implemented
  **Backup Encryption**       Encrypted backups with separate key management         ✓ Implemented
  **Pseudonymization**        User IDs pseudonymized in analytics/calibration data   ✓ Implemented (where applicable)
  **Tokenization**            Sensitive identifiers tokenized where feasible         ○ Available on request (Enterprise)

**B. Measures to Ensure Confidentiality**

**1. Physical Access Control**

  Control                    Implementation
  -------------------------- ----------------------------------------------------
  **Data Center Security**   SOC 2 Type II certified facilities (AWS/Azure/GCP)
  **Physical access**        Biometric access control, 24/7 security personnel
  **Visitor management**     Escort requirements, access logging
  **Asset disposal**         Certified destruction for storage media

**2. System Access Control**

  Control                   Implementation
  ------------------------- -----------------------------------------------------------------
  **Authentication**        Multi-factor authentication (MFA) required for all accounts
  **Password policy**       Minimum 12 characters, complexity requirements, 90-day rotation
  **Role-based access**     Least privilege principle, role-based access controls (RBAC)
  **Access reviews**        Quarterly review of all access rights
  **Termination process**   Immediate access revocation upon employment termination
  **Session management**    Automatic timeout after 30 minutes inactivity

**3. Data Access Control**

  Control                   Implementation
  ------------------------- --------------------------------------------------------------------
  **Segregation**           Customer data logically segregated (separate databases or schemas)
  **Need-to-know basis**    Access granted only for legitimate business purposes
  **Privileged access**     Break-glass procedures with full audit logging
  **Read/write controls**   Granular permissions based on role and necessity
  **Data minimization**     Personnel access only data necessary for their function

**4. Transmission Control**

  Control                    Implementation
  -------------------------- ---------------------------------------------------------------
  **Network encryption**     TLS 1.3 for API communications
  **VPN**                    Required for remote administrative access
  **Secure file transfer**   SFTP, encrypted email, or secure portal for document exchange
  **Data Loss Prevention**   DLP tools monitor and prevent unauthorized data exfiltration
  **Network segmentation**   Production environment isolated from corporate network

**5. Input Control**

  Control                Implementation
  ---------------------- ---------------------------------------------------------------
  **Audit logging**      All data modifications logged with user, timestamp, action
  **Log retention**      Audit logs retained for 2 years (7 years for Enterprise tier)
  **Log protection**     Logs immutable, tamper-evident
  **User attribution**   All actions attributable to specific user accounts
  **Change tracking**    Version control for configuration changes

**C. Measures to Ensure Integrity**

  Measure                   Implementation
  ------------------------- ------------------------------------------------
  **Data validation**       Input validation to prevent data corruption
  **Integrity checks**      Regular checksums and hash verification
  **Version control**       Tracking of changes to configurations and data
  **Backup verification**   Regular testing of backup restoration
  **Malware protection**    Antivirus, anti-malware on all systems

**D. Measures to Ensure Availability and Resilience**

  Measure                   Implementation                                       Tier Availability
  ------------------------- ---------------------------------------------------- ----------------------
  **Redundancy**            Multi-zone deployment with automatic failover        Business, Enterprise
  **Load balancing**        Distributed across multiple servers                  All tiers
  **Backups**               Daily automated backups, geo-redundant storage       All tiers
  **Disaster recovery**     RTO: 4-24 hours; RPO: 1-24 hours (tier-dependent)    All tiers
  **Uptime SLA**            99.0% (Team), 99.5% (Business), 99.9% (Enterprise)   Per tier
  **Business continuity**   Documented BC/DR plan tested annually                All tiers

**E. Measures for Regular Testing and Evaluation**

  Measure                        Frequency     Description
  ------------------------------ ------------- ---------------------------------------
  **Vulnerability scanning**     Weekly        Automated scanning of infrastructure
  **Penetration testing**        Annually      Third-party security assessment
  **Security audits**            Annually      SOC 2 Type II audit
  **Compliance reviews**         Quarterly     Internal GDPR compliance checks
  **Incident response drills**   Bi-annually   Simulated breach scenarios
  **Access reviews**             Quarterly     Review of all personnel access rights
  **Supplier assessments**       Annually      Sub-processor security reviews

**F. Measures for Incident Response**

  Component                    Details
  ---------------------------- -------------------------------------------------------------------------
  **Incident response plan**   Documented procedures for detection, containment, eradication, recovery
  **Response team**            Designated security incident response team (SIRT)
  **Contact procedures**       24/7 security hotline for critical incidents
  **Forensics**                Evidence preservation and forensic analysis capabilities
  **Communication plan**       Procedures for notifying Controller within 24 hours
  **Post-incident review**     Root cause analysis and corrective action plan for all incidents

**G. Organizational Measures**

  Measure                       Implementation
  ----------------------------- -----------------------------------------------------------
  **Security policies**         Comprehensive information security policy framework
  **Training**                  Annual security and privacy training for all personnel
  **GDPR training**             Specific GDPR training for personnel with data access
  **Background checks**         Pre-employment screening for all personnel
  **Confidentiality**           NDAs and confidentiality clauses in employment agreements
  **Security officer**          Designated Chief Information Security Officer (CISO)
  **Data Protection Officer**   Designated DPO per GDPR Article 37
  **Vendor management**         Security requirements in all supplier contracts
  **Insurance**                 Cyber liability insurance coverage

**H. Certifications and Standards**

  Certification/Standard               Status                          Scope
  ------------------------------------ ------------------------------- -----------------------------------
  **SOC 2 Type II**                    Current                         Infrastructure, platform security
  **ISO 27001**                        Planned \[Date\]                Information security management
  **EU-U.S. Data Privacy Framework**   \[Certified / Pending / N/A\]   International transfers
  **HIPAA Technical Safeguards**       Implemented                     Healthcare customers (BAA)

**ANNEX III: LIST OF SUB-PROCESSORS**

**Current Sub-processors**

  Sub-processor Name                   Service Provided                       Location                        Transfer Safeguards   BAA/DPA in Place?
  ------------------------------------ -------------------------------------- ------------------------------- --------------------- -------------------
  \[Cloud Provider - AWS/Azure/GCP\]   Infrastructure hosting, data storage   \[US-East, EU-West, specify\]   SCCs / DPF            Yes
  \[Backup Service Provider\]          Encrypted backup storage               \[Location\]                    SCCs / DPF            Yes
  \[Email Service Provider\]           Transactional email delivery           \[Location\]                    SCCs / DPF            Yes
  \[Support Platform\]                 Customer support ticketing             \[Location\]                    SCCs / DPF            Yes
                                                                                                                                    

**Sub-processor Change Notification Process**

1.  **Advance Notice:** 30 days before engaging new Sub-processor or
    > replacing existing one

2.  **Notification Method:**

    -   Email to: \[Controller email\]

    -   Updated list published at:
        > [[https://phasemirror.com/subprocessors]{.underline}](https://phasemirror.com/subprocessors)

    -   In-platform notification (for Platform customers)

3.  **Objection Procedure:**

    -   Controller has 14 days to object on reasonable data protection
        > grounds

    -   Objection sent to: \[dpo\@phasemirror.io\]

    -   If objection sustained, Controller may terminate affected
        > Services without penalty

4.  **Information Provided:**

    -   Name and location of Sub-processor

    -   Service to be provided

    -   Transfer safeguards implemented

    -   Confirmation of equivalent data protection obligations

**Sub-processor Obligations**

All Sub-processors are contractually bound to:

-   Process Personal Data only on documented instructions

-   Maintain confidentiality

-   Implement appropriate security measures (equivalent to Annex II)

-   Assist with Data Subject Requests

-   Notify Processor of Personal Data Breaches within 24 hours

-   Delete or return Personal Data upon termination

-   Allow audits by Processor or mandated auditors

-   Comply with GDPR and applicable data protection law

**ANNEX IV: STANDARD CONTRACTUAL CLAUSES**

**\[This Annex applies ONLY if SCCs are the selected transfer mechanism
per Article 5.3\]**

**Standard Contractual Clauses (SCCs)**\
**EU Commission Decision 2021/914**\
**Module Two: Controller-to-Processor**

\[Complete SCC text would be inserted here - the official text from EU
Commission Decision 2021/914, with the following completed sections:\]

**Selections for Module Two:**

**Clause 7 - Docking Clause:**\
☐ Optional clause INCLUDED\
☐ Optional clause NOT INCLUDED

**Clause 9 - Use of Sub-processors:**\
☐ **Option 2 selected:** GENERAL WRITTEN AUTHORISATION\
Controller provides general authorization for Sub-processors, subject to
30-day advance notice and objection rights.

**Clause 11 - Redress:**\
☐ **Option 1 selected:** Data Subjects may lodge complaint with
independent dispute resolution body.

-   Dispute resolution body: \[To be specified\]

**Clause 17 - Governing Law:**\
☐ Laws of: \[Ireland / other EU Member State where Controller is
established\]

**Clause 18 - Choice of Forum and Jurisdiction:**\
☐ Courts of: \[Dublin, Ireland / other location in EU Member State\]

**SCC Annexes:**

**Annex I.A - List of Parties:** As completed in DPA Annex I.A above

**Annex I.B - Description of Transfer:** As completed in DPA Annex I.B-F
above

**Annex II - Technical and Organizational Measures:** As completed in
DPA Annex II above

**Annex III - List of Sub-processors:** As completed in DPA Annex III
above

**Supplementary Information:**

**Module-specific provisions:**

-   The parties agree that certification mechanisms (GDPR Art. 42) or
    > approved codes of conduct (GDPR Art. 40) may be used to
    > demonstrate compliance with security obligations.

**Modifications permitted:**\
The parties may modify the SCCs only to:

-   Add additional parties (Clause 7 docking);

-   Update Annexes (Sub-processors, security measures) per procedures in
    > DPA;

-   Add commercial clauses not contradicting SCCs.

**END OF DATA PROCESSING AGREEMENT**

**Additional Resources for Implementation**

This DPA should be accompanied by:

1.  **Controller Onboarding Checklist:** Form for Controller to complete
    > Annex I details

2.  **Sub-processor Notification Template:** Standard email for 30-day
    > notices

3.  **Breach Notification Template:** Pre-formatted incident
    > notification

4.  **DSAR Response Template:** Standardized Data Subject Access Request
    > response

5.  **TIA Summary:** Executive summary of Transfer Impact Assessment

Would you like me to create any of these supporting documents?

⁂

1.  A Clear Guide to Phase Mirror\'s Services.pdf

2.  Phase mirror dissonance\_\_\_Open core must be useful.pdf

3.  Phase Mirror\_ Comprehensive Services Catalog.docx.pdf

4.  License\_ Strategic & Legal Analysis.pdf

5.  Phase Mirror\_ Consultation & SaaS.pdf

6.  Agentic Domain-Specific Reasoning.pdf

7.  Policy Memo\_ Managing Agentic AI Liability with the Phase Mirror
    > Framework.pdf

8.  The Phase Mirror does not resolve dissonance---it names it.pdf

9.  Understanding Phase Mirror Dissonance\_ A Beginner\'s Guide.pdf

10. The Phase of Mirror Dissonance.pdf

11. Implementation Guide\_ Applying Phase Mirror Dissonance.pdf
