Data Processing Agreement

1. Controller and Processor Roles

The Customer acts as the Data Controller, determining the purposes and means of processing personal data. AutomateCC acts as the Data Processor, processing personal data solely on behalf of and under the instructions of the Controller.

AutomateCC will process personal data only as necessary to provide the Service and will not process personal data for any purpose beyond the scope of the Controller’s instructions unless required by applicable law.

2. Security Measures

AutomateCC implements and maintains appropriate technical and organizational security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include:

• Encryption of personal data at rest (AES-256) and in transit (TLS 1.2+)
• Access controls and role-based permissions
• Regular security assessments and penetration testing
• Incident response and breach notification procedures
• Employee training on data protection obligations

3. Sub-Processors

AutomateCC uses the following categories of sub-processors to deliver the Service:

• Cloud infrastructure providers (e.g., Amazon Web Services)
• Authentication services
• Monitoring and observability tools
• Customer support software

A current list of sub-processors is available upon request. AutomateCC will provide 30 days’ notice before adding new sub-processors, giving the Controller the opportunity to object.

4. GDPR Compliance Contact

For all GDPR-related inquiries, data subject requests, or to exercise your rights under applicable data protection law, please contact our Data Protection contact at: