Data Processing Agreement - Fulmico

Agreement Overview

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer", "Data Controller") and Fulmico Ltd ("Fulmico", "Data Processor") and governs the processing of personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR).

Definitions

Data Controller

The Customer who determines the purposes and means of processing personal data.

Data Processor

Fulmico, who processes personal data on behalf of the Data Controller.

Personal Data

Any information relating to an identified or identifiable natural person.

Processing

Any operation performed on personal data, including collection, storage, and transmission.

Scope and Nature of Processing

Purpose of Processing

Fulmico processes personal data solely to provide business automation services as outlined in our Terms of Service, including:

Order processing and fulfillment automation
Subscription management and billing
Customer communication and notifications
Analytics and reporting for business operations
Technical support and platform maintenance

Categories of Personal Data

Customer Data

• Names and contact information
• Email addresses
• Business information
• Payment information (processed by third parties)

End-User Data

• Customer's customer information
• Order and transaction data
• Subscription information
• Communication preferences

Data Subjects

Personal data may relate to:

Customer account holders and authorized users
Customer's end-users and subscribers
Contact persons at customer organizations
Recipients of automated communications

Data Controller Obligations

As the Data Controller, Customer warrants and undertakes that:

It has the legal right to transfer personal data to Fulmico for processing
It has obtained all necessary consents and provided required notices to data subjects
Processing instructions comply with applicable data protection laws
It will implement appropriate measures to ensure data security
It will promptly notify Fulmico of any changes affecting data processing

Data Processor Obligations

As the Data Processor, Fulmico undertakes to:

Process personal data only according to documented instructions from the Customer
Ensure personnel processing data are bound by confidentiality obligations
Implement appropriate technical and organizational security measures
Assist Customer in responding to data subject rights requests
Notify Customer of personal data breaches within 72 hours
Delete or return personal data upon termination of services

Technical and Organizational Security Measures

Technical Measures

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• Multi-factor authentication systems
• Regular security monitoring and logging
• Automated backup and recovery systems
• Network segmentation and firewalls

Organizational Measures

• Role-based access controls
• Employee background checks
• Regular security training programs
• Incident response procedures
• Third-party security audits
• SOC 2 Type II compliance

Sub-Processing

Customer provides general authorization for Fulmico to engage sub-processors, subject to the following conditions:

Sub-processors must provide the same level of data protection as this DPA
Fulmico remains fully liable for sub-processor compliance
Customer will be notified of any changes to sub-processors

Current Sub-Processors

Cloud Infrastructure: AWS, Google Cloud (hosting and storage)
Payment Processing: Stripe, PayPal (payment data handling)
Communication Services: Email service providers (notifications)
Analytics: Analytics platforms (usage data processing)

International Data Transfers

Personal data may be transferred to and processed in countries outside the European Economic Area (EEA). Such transfers are protected by appropriate safeguards:

Standard Contractual Clauses: EU-approved SCCs for data transfers
Adequacy Decisions: Transfers to countries with adequacy decisions
UK IDTA: UK International Data Transfer Agreement where applicable
Additional Safeguards: Encryption and access controls for transferred data

Data Subject Rights

Fulmico will assist Customer in fulfilling data subject rights requests, including:

Access Rights

• Right to access personal data
• Data portability assistance
• Information about processing

Control Rights

• Right to rectification
• Right to erasure (right to be forgotten)
• Right to restrict processing
• Right to object to processing

Data Breach Notification

Notification Procedures

Initial Notification: Within 72 hours of becoming aware of a breach
Detailed Report: Comprehensive breach assessment within 5 business days
Ongoing Updates: Regular updates on investigation and remediation

Breach Information

Notifications will include:

• Nature and scope of the personal data breach
• Categories and approximate number of data subjects affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact information for further inquiries

Audits and Compliance

To demonstrate compliance with this DPA and applicable data protection laws:

Fulmico will provide relevant compliance documentation upon request
Third-party audit reports (SOC 2) available under appropriate confidentiality
Customer may request specific compliance information for regulatory purposes
Reasonable assistance provided for Customer's own compliance obligations

Term and Termination

This DPA remains in effect for the duration of the Terms of Service. Upon termination:

Fulmico will delete or return all personal data within 30 days
Customer data export tools available during termination period
Legal retention requirements may extend deletion timelines
Certification of deletion provided upon request

Contact Information

For questions about this Data Processing Agreement or data protection matters:

Data Protection Officer:

Email: dpo@fulmico.com

Phone: +44 7537 175639

General Contact:

Email: admin@fulmico.com

Response Time: Within 72 hours

Governing Law

This Data Processing Agreement shall be governed by and construed in accordance with the laws of England and Wales. Any disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.