BēCN Technologies, LLC (d/b/a BēCN Pets)
Template version: 1.0 · Effective Date: [DATE]
1. DEFINITIONS
1.1 Capitalized terms not defined in this DPA have the meaning given in the Principal Agreement.
1.2
"Data Protection Law" means all laws and regulations applicable to the processing of Personal Data under this DPA, including, where applicable, the GDPR, the UK GDPR, the CCPA/CPRA, and other applicable state privacy laws.
"GDPR" means Regulation (EU) 2016/679.
"Personal Data" means any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller under the Principal Agreement. This includes pet owner names, contact details, account identifiers, and any personal information contained in a pet record.
"Data Subject" means the individual to whom Personal Data relates.
"Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
"Subprocessor" means a third party engaged by the Processor to process Personal Data on behalf of the Controller.
"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by the European Commission for the transfer of Personal Data to third countries.
"Personal Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.
"Supervisory Authority" means an independent public authority with competence over data protection matters.
2. ROLES AND SCOPE
2.1 Roles. The Customer is the Controller of the Personal Data it submits to the Services. The Processor processes that Personal Data on the Controller's behalf and in accordance with the Controller's documented instructions.
2.2 Processor as controller in limited respects. The Processor is an independent controller of certain data, including: account administration data, billing and payment records, security and audit logs, and data the Processor collects for its own legal compliance. This DPA does not apply to the Processor's processing as an independent controller, which is governed by the Processor's Privacy Policy.
2.3 Scope. The Processor will process Personal Data only for the purposes described in Schedule A, and only in accordance with this DPA and the Controller's lawful instructions.
2.4 Duration. Processing continues for the term of the Principal Agreement and, where applicable, the period described in Section 12.
3. PROCESSING INSTRUCTIONS
3.1 The Controller instructs the Processor to process Personal Data for the purposes set out in Schedule A.
3.2 The Processor will not process Personal Data for any other purpose unless required by law, in which case the Processor will inform the Controller before processing, unless the law prohibits it from doing so.
3.3 The Processor will not sell Personal Data, and will not share it for cross-context behavioral advertising.
3.4 The Processor will notify the Controller promptly if, in its opinion, an instruction from the Controller infringes Data Protection Law. The Processor may suspend performance of that instruction pending resolution.
3.5 The Processor will provide reasonable assistance to the Controller in responding to Data Subject requests and in meeting the Controller's own compliance obligations.
4. PROCESSOR OBLIGATIONS
The Processor will:
4.1 Process Personal Data only on documented instructions from the Controller, as described in Section 3.
4.2 Ensure that personnel authorized to process Personal Data are subject to appropriate confidentiality obligations, and receive appropriate training.
4.3 Implement the technical and organizational measures described in Schedule B, and maintain them for the duration of the processing.
4.4 Assist the Controller in ensuring compliance with its obligations regarding security, breach notification, data protection impact assessments, and prior consultation with supervisory authorities, taking into account the nature of the processing and the information available to the Processor.
4.5 Notify the Controller of a Personal Data Breach in accordance with Section 9.
4.6 Maintain records of processing activities as required by applicable Data Protection Law, and make them available to the Controller on reasonable request.
4.7 At the Controller's choice, delete or return Personal Data at the end of the provision of Services, as described in Section 12.
5. CONFIDENTIALITY
5.1 The Processor will treat Personal Data as confidential and will not disclose it to any third party except as permitted under this DPA or instructed by the Controller.
5.2 Access to Personal Data is granted on a least-privilege, need-to-know basis and is logged.
5.3 Personnel obligations of confidentiality survive the end of their engagement.
6. SECURITY
6.1 The Processor will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by applicable Data Protection Law and as described in Schedule B.
6.2 In assessing the appropriate level of security, the Processor will consider the state of the art, the costs of implementation, the nature, scope, context, and purposes of processing, and the risk to Data Subjects.
6.3 The Processor will restrict access to Personal Data to personnel who require it, and will ensure those personnel are bound by confidentiality.
6.4 The Processor will maintain a documented security program and will review its measures periodically and on a material change to the processing.
Note for the Processor's team: Schedule B is a contractual commitment. Do not list a control that is not actually implemented and testable. A DPA that promises a control you do not have is worse than a DPA that promises less, because the gap is now a documented misrepresentation.
7. SUBPROCESSORS
7.1 General authorization. The Controller grants the Processor general authorization to engage Subprocessors, subject to this section. The Subprocessors engaged as of the Effective Date are listed in Schedule C. ☐ Alternative: the Controller requires specific authorization, and the Processor must notify the Controller before engaging each Subprocessor.
7.2 Notice of change. The Processor will notify the Controller at least [THIRTY (30)] days before engaging a new Subprocessor or replacing one, giving the Controller the opportunity to object.
7.3 Objection. Where the Controller objects on reasonable data protection grounds, the Parties will discuss in good faith. If no resolution is reached, the Controller may terminate the affected part of the Services.
7.4 Flow-down obligations. The Processor will impose on each Subprocessor, by written contract, obligations equivalent to those in this DPA. The Processor remains liable to the Controller for a Subprocessor's performance.
7.5 Current Subprocessors. Listed in Schedule C, and maintained at a page the Controller can review where the Processor operates one.
8. DATA SUBJECT RIGHTS
8.1 Taking into account the nature of the processing, the Processor will assist the Controller by appropriate technical and organizational measures, in so far as possible, in fulfilling the Controller's obligation to respond to Data Subject requests.
8.2 Where a Data Subject contacts the Processor directly to exercise a right, the Processor will not respond substantively unless legally required, and will refer the request to the Controller without undue delay.
8.3 The Processor will provide information reasonably necessary to allow the Controller to respond, within a timeframe that allows the Controller to meet its own legal deadlines.
8.4 The Processor will make available the functionality necessary for the Controller to correct, delete, and export Personal Data, to the extent the Services provide that functionality.
9. PERSONAL DATA BREACH
9.1 Notification. The Processor will notify the Controller without undue delay, and in any event within [TWENTY-FOUR (24)] hours, after becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA.
9.2 What the notification will include. To the extent then known:
- (a) the nature of the breach, including the categories and approximate number of Data Subjects and records affected;
- (b) the likely consequences of the breach;
- (c) the measures taken or proposed to address the breach and mitigate its effects;
- (d) contact details for further information.
9.3 Delayed information. Where all information is not available at once, the Processor will provide it in phases without further undue delay.
9.4 Assistance. The Processor will assist the Controller in meeting the Controller's own notification obligations, and will take reasonable steps to mitigate the breach and prevent recurrence.
9.5 Documentation. The Processor will document breaches, including the facts, effects, and remedial action taken.
9.6 No admission. A notification is not an acknowledgment of fault or liability.
10. INTERNATIONAL TRANSFERS
10.1 Where the Processor transfers Personal Data outside the EEA, the UK, or Switzerland, it will ensure an appropriate transfer mechanism is in place.
10.2 Where the SCCs apply, they are incorporated by reference and completed as follows:
| SCC element | Completion |
|---|---|
| Module | Module Two (Controller to Processor) |
| Clause 7 docking clause | ☐ Applies ☐ Does not apply |
| Clause 9(a) subprocessors | ☐ Option 1 (general) ☐ Option 2 (specific) |
| Clause 11 optional redress | ☐ Applies ☐ Does not apply |
| Clause 17 governing law | [Ireland / Member State] |
| Clause 18(b) forum | [Member State courts] |
| Annex I | Schedule A of this DPA |
| Annex II | Schedule B of this DPA |
| Annex III | Schedule C of this DPA |
10.3 Transfer impact assessment. Where required, the Parties will cooperate on a transfer impact assessment and will implement supplementary measures where necessary.
10.4 Alternative mechanisms. Where the UK International Data Transfer Addendum applies, it is incorporated for transfers subject to UK law.
11. AUDIT AND INSPECTION
11.1 The Processor will make available to the Controller information reasonably necessary to demonstrate compliance with this DPA.
11.2 The Processor will allow for and contribute to audits and inspections conducted by the Controller or an auditor mandated by the Controller, subject to the following conditions:
- (a) no more than [ONE (1)] audit per [TWELVE (12)] month period, unless required by a supervisory authority or following a Personal Data Breach;
- (b) at least [THIRTY (30)] days' prior written notice;
- (c) conducted during normal business hours and in a manner that does not disrupt operations;
- (d) at the Controller's cost;
- (e) subject to reasonable confidentiality obligations;
- (f) scope limited to the processing described in Schedule A.
11.3 Certifications and reports. The Processor may satisfy an audit request by providing a current independent audit report, certification, or equivalent documentation, where that reasonably demonstrates compliance. The Processor does not currently hold a SOC 2 report or ISO certification — if this is a requirement, it must be addressed commercially before signature.
12. RETURN AND DELETION
12.1 On termination of the Principal Agreement, or on the Controller's written request, the Processor will, at the Controller's choice, delete or return Personal Data processed on the Controller's behalf.
12.2 The Processor will delete existing copies unless applicable law requires storage.
12.3 Retention exceptions. The Processor may retain Personal Data where required by law, for the establishment or defense of legal claims, or for fraud prevention, in each case limited to what is necessary and subject to continuing confidentiality.
12.4 Deletion timeframe. Deletion will be completed within [NINETY (90)] days of the request or termination, save for backups, which are purged on their normal rotation cycle of not more than [THIRTY (30)] days.
12.5 Certification. On request, the Processor will certify deletion in writing.
13. CALIFORNIA AND STATE PRIVACY LAW TERMS
13.1 Where the CCPA/CPRA or a similar state privacy law applies, the Processor acts as a service provider or processor with respect to Personal Data processed under this DPA.
13.2 The Processor:
- (a) will process Personal Data only for the business purposes described in Schedule A, and as permitted by this DPA;
- (b) will not sell or share Personal Data;
- (c) will not retain, use, or disclose Personal Data for any purpose other than the business purposes described, including for its own commercial purposes;
- (d) will not combine Personal Data received from the Controller with Personal Data received from or on behalf of another person, except as permitted by law;
- (e) will comply with applicable obligations and provide the level of privacy protection required of a service provider;
- (f) will notify the Controller if it determines it can no longer meet its obligations;
- (g) grants the Controller the right to take reasonable and appropriate steps to ensure use of Personal Data is consistent with the Controller's obligations;
- (h) will engage subcontractors only under a written contract imposing equivalent obligations.
13.3 Deidentified data. The Processor will not attempt to reidentify deidentified data, and will maintain deidentified data in a manner that prohibits reidentification.
13.4 Sensitive personal information. The Processor will not use sensitive personal information for any purpose other than providing the Services.
14. LIABILITY
14.1 Each Party's liability under this DPA is subject to the limitations and exclusions in the Principal Agreement.
14.2 The Parties acknowledge that a Data Subject may have rights of action under Data Protection Law that cannot be limited by agreement.
14.3 Where one Party becomes liable for a breach caused by the other, the responsible Party will indemnify the other to the extent permitted by the Principal Agreement.
15. TERM, CHANGES, AND GENERAL
15.1 This DPA takes effect on the Effective Date and continues until the later of the termination of the Principal Agreement or the completion of deletion or return under Section 12.
15.2 Where there is a conflict between this DPA and the Principal Agreement on matters of data protection, this DPA controls.
15.3 Amendments must be in writing and signed by both Parties, except where an amendment is required to comply with a change in law, in which case the Processor may notify the change and the Controller may object as provided in Section 7.
15.4 Governing law and jurisdiction follow the Principal Agreement.
15.5 If a provision is unenforceable, it will be modified to the minimum extent necessary or severed.
15.6 Signed counterparts, including electronic signatures, are effective.
SIGNATURES
RESQ TECHNOLOGIES, LLC (d/b/a BēCN Pets)
By: ____ Name: [NAME] · Title: [TITLE] Date: ____
[CONTROLLER LEGAL NAME]
By: ____ Name: [NAME] · Title: [TITLE] Date: ____
---
SCHEDULE A — DETAILS OF PROCESSING
A.1 Data exporter (Controller).
| Field | Entry |
|---|---|
| Name | [CONTROLLER LEGAL NAME] |
| Address | [ADDRESS] |
| Contact | [NAME, EMAIL] |
| Activities relevant to the transfer | [DESCRIBE — e.g., animal sheltering and adoption services] |
| Role | Controller |
A.2 Data importer (Processor).
| Field | Entry |
|---|---|
| Name | BēCN Technologies, LLC (d/b/a BēCN Pets) |
| Address | [ADDRESS] |
| Contact | [PRIVACY CONTACT, EMAIL] |
| Activities relevant to the transfer | Delivery of the BēCN Pets identification and pet record platform |
| Role | Processor |
A.3 Categories of Data Subjects.
- Pet owners and account holders
- Individuals who scan a tag (finders)
- Authorized users of the Controller's organization
- [ADD OTHERS]
A.4 Categories of Personal Data.
- Identification and contact data: name, email address, telephone number, postal address
- Account data: account identifier, authentication data, preferences
- Pet record data: pet name, species, breed, photograph, physical description
- Care data: feeding, medication, and medical notes voluntarily supplied
- Location data: coarse location associated with a scan event, where the scanning device permits
- Usage and technical data: log data, device and browser information, IP address
- [ADD OTHERS]
A.5 Special category data. ☐ Not processed. ☐ Processed as follows: [DESCRIBE AND IDENTIFY THE ARTICLE 9 CONDITION]
A.6 Frequency of transfer. Continuous, on an ongoing basis for the term of the Principal Agreement.
A.7 Nature and purpose of processing.
| Purpose | Description |
|---|---|
| Tag resolution | Resolving a scanned identifier to a pet record |
| Record management | Storing and serving pet profiles on the Controller's behalf |
| Alerting | Distributing lost-pet alerts |
| Partner administration | Provisioning tags and managing registrations |
| Support | Troubleshooting on the Controller's behalf |
A.8 Duration of processing. The term of the Principal Agreement, plus the retention period in Section 12.
A.9 Subprocessors. As listed in Schedule C.
A.10 Competent supervisory authority. [IDENTIFY, where applicable]
---
SCHEDULE B — TECHNICAL AND ORGANIZATIONAL MEASURES
Verify every row before signature. See the note in Section 6.4.
B.1 Access control.
| Measure | Implementation |
|---|---|
| Access provisioning | Least-privilege; role-based; documented approval |
| Authentication | Multi-factor authentication required for all administrative and production access |
| Credential management | Secrets stored in a managed vault; no shared accounts |
| Access review | Quarterly review of production and administrative access |
| Access logging | All access to Personal Data logged with actor, timestamp, and reason |
| Termination | Access revoked within [24 hours] of departure or role change |
B.2 Encryption.
| Measure | Implementation |
|---|---|
| In transit | TLS 1.2 or higher for all external and internal service communication |
| At rest | Encryption of databases and object storage |
| Backups | Encrypted backups |
| Key management | Managed key storage with rotation |
B.3 Network and infrastructure security.
| Measure | Implementation |
|---|---|
| Hosting | Reputable cloud provider with contractual security commitments |
| Boundary protection | Firewalls and network segmentation |
| DDoS protection | [PROVIDER] |
| Vulnerabilities | Dependency scanning; regular patching |
| Logging and monitoring | Centralized logging with alerting on security-relevant events |
B.4 Application security.
| Measure | Implementation |
|---|---|
| Secure development | Secure coding standards; code review before merge |
| Testing | Application security testing as described in the Company's application security standard |
| Identifier security | Cryptographically random identifiers with checksum validation (see the Tag Lifecycle and Anti-Fraud Specification) |
| Rate limiting | Enforced on authentication, lookup, and activation endpoints |
| Abuse detection | Monitoring for enumeration and bulk-access patterns |
B.5 Physical security. Cloud infrastructure physical security is the provider's responsibility. Company premises access is controlled and logged.
B.6 Personnel.
| Measure | Implementation |
|---|---|
| Confidentiality | Written confidentiality obligations for all personnel |
| Background checks | Where lawful and appropriate to the role |
| Training | Security and privacy training on onboarding and [ANNUALLY] |
| Disciplinary process | Documented consequences for policy violation |
B.7 Business continuity.
| Measure | Implementation |
|---|---|
| Backup frequency | [DAILY] |
| Backup retention | [THIRTY (30)] days |
| Recovery Point Objective | [24 hours] |
| Recovery Time Objective | [24 hours] |
| Testing | At least [ANNUALLY] |
B.8 Incident response. Documented incident response plan with defined roles, severity classification, escalation, and notification procedures.
B.9 Data minimization and retention. Personal Data is collected only as needed, and retained only as long as necessary for the purpose or as required by law, per the Company's retention schedule.
---
SCHEDULE C — AUTHORIZED SUBPROCESSORS
Verify and complete. Do not sign with an incomplete subprocessor list — the Controller's ability to assess risk depends on it.
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| [CLOUD HOST] | Application and data hosting | [REGION] | [SCCs / adequacy] |
| [EMAIL PROVIDER] | Transactional email delivery | [REGION] | [SCCs / adequacy] |
| [PAYMENT PROCESSOR] | Payment processing | [REGION] | [SCCs / adequacy] |
| [ANALYTICS PROVIDER] | Product analytics | [REGION] | [SCCs / adequacy] |
| [SMS PROVIDER] | Alert delivery by SMS, if used | [REGION] | [SCCs / adequacy] |
Change log
| Date | Change | Notice given |
|---|---|---|