Effective October 23, 2025 • 37 Dimensions LLC • https://37-dimensions.com
1) Parties & Scope
This DPA forms part of the Agreement between 37 Dimensions LLC (“Processor/Service Provider”) and the customer entity (“Customer”).
2) Roles
Customer is the Controller/Business; 37 Dimensions is the Processor/Service Provider.
3) Processing Instructions
Process personal information only on documented instructions from Customer, including with respect to cross-border transfers, subject to law.
4) Service Provider (CPRA) Commitments
Process solely to provide the Services; do not sell/share personal information; do not combine personal information except as permitted; assist with CPRA requests; notify if unable to meet obligations.
5) Security Measures
Maintain appropriate technical and organizational measures: access controls, encryption in transit, logging/monitoring, vulnerability management, personnel confidentiality.
6) Confidentiality
Personnel with access are bound by confidentiality obligations.
7) Sub‑processors
Authorized use of sub‑processors as needed; impose equivalent protections by contract; remain responsible; provide advance notice of material changes and allow reasonable objection.
8) Assistance with Data Subject Requests
Provide reasonable assistance for access, deletion, correction, portability, and opt‑out requests.
9) Incident Response & Notifications
Notify Customer without undue delay after becoming aware of a personal data breach affecting Customer’s data; provide information needed for legal obligations.
10) Audits & Assessments
Allow annual audits or more frequently if required by law or following a verified incident/regulator request; minimize disruption; protect confidentiality.
11) Return or Deletion
Upon termination/expiry, delete or return personal information unless retention is required by law; continue protections for retained data.
12) International Transfers
Implement transfer mechanisms as required (e.g., EU/UK SCCs). Parties may execute SCCs referencing this DPA and Agreement (annexes not included here).
13) Priority
If conflict between this DPA and the Agreement, this DPA controls for processing of personal information.