Data Processing Agreement

Last Updated: July 14, 2026  |  Effective Date: July 14, 2026

1. Parties & Definitions

This Data Processing Agreement (“DPA”) is entered into between the customer who has accepted the SOSRoute API Terms of Service (“Controller” or “Customer”) and Sandbox Synergy LLC, a New Mexico limited liability company (“Processor” or “Company”), and supplements the Terms of Service governing the Customer’s use of the SOSRoute API platform at sosroute.dev.

This DPA is designed to meet the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the UK General Data Protection Regulation. The following definitions apply throughout this DPA:

• “Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”) as defined in GDPR Article 4(1), which the Processor processes on behalf of the Controller in connection with the Services.
• “Processing” means any operation or set of operations performed on Personal Data, as defined in GDPR Article 4(2), including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.
• “Data Subject” means the identified or identifiable natural person to whom the Personal Data relates.
• “Sub-processor” means any third-party processor engaged by the Processor to process Personal Data on behalf of the Controller in connection with the Services.
• “Supervisory Authority” means an independent public authority established by an EU/EEA Member State pursuant to GDPR Article 51, or the UK Information Commissioner’s Office (ICO).
• “Data Protection Laws” means the GDPR, UK GDPR, the Swiss Federal Act on Data Protection (FADP), the California Consumer Privacy Act (CCPA/CPRA), and any other applicable data protection legislation.
• “Standard Contractual Clauses” (“SCCs”) means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission under Commission Implementing Decision (EU) 2021/914.
• “Technical and Organizational Measures” (“TOMs”) means the security measures described in Annex II of this DPA, implemented by the Processor to protect Personal Data.
• “Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed, as defined in GDPR Article 4(12).

2. Scope & Purpose of Processing

This DPA applies to the Processing of Personal Data by the Processor on behalf of the Controller in connection with the provision of the SOSRoute API Services as described in the Terms of Service. The Processor processes Personal Data solely for the purpose of providing the Services to the Controller, which includes:

• Processing API requests submitted by the Controller’s applications, including resolving geographic coordinates to deliver location-relevant safety data, hazard alerts, risk scores, and nearest emergency facility information.
• Delivering webhook notifications and event-driven alerts to Controller-specified endpoints based on geographic and threat-based triggers configured by the Controller.
• Maintaining account authentication, API key management, rate limit enforcement, and usage analytics for the Controller’s account.
• Processing payment transactions and billing information through third-party payment processors on behalf of the Controller.

The Processor shall not process Personal Data for any purpose other than as described in this DPA and the Terms of Service, or as otherwise instructed in writing by the Controller. The Processor shall not process Personal Data for its own purposes, including marketing, profiling, or selling Personal Data.

3. Duration of Processing

This DPA shall remain in effect for the duration of the Controller’s use of the Services as defined in the Terms of Service. Processing of Personal Data begins upon the issuance of an API key to the Controller and continues until the termination or expiration of the service agreement.

Upon termination of the service agreement, the Processor shall cease Processing Personal Data on behalf of the Controller, except as required to fulfill deletion obligations described in Section 14 of this DPA, or as required by applicable law. Any Personal Data retained after termination shall be limited to the minimum necessary to comply with legal obligations and shall be securely deleted once those obligations are fulfilled.

4. Nature of Processing

The Processing carried out by the Processor under this DPA is exclusively automated. The Processor processes API requests programmatically, resolves geographic coordinates against safety data sources, correlates alerts with geofenced regions, and delivers webhook event notifications to Controller-specified HTTP endpoints. No manual processing, review, or human decision-making is performed on Personal Data.

The Processor does not engage in profiling, automated individual decision-making as defined in GDPR Article 22, or any form of behavioral tracking or scoring of Data Subjects. Location coordinates submitted through the API are processed transiently to resolve the relevant API response and are not stored, aggregated, or used to create profiles of individual Data Subjects. API request metadata (timestamps, endpoints, status codes) is retained for operational purposes (rate limiting, abuse detection, analytics) in accordance with the retention periods specified in the Privacy Policy.

5. Types of Personal Data

The following categories of Personal Data may be processed by the Processor on behalf of the Controller in connection with the Services:

• Geographic Coordinates: Latitude and longitude values submitted through API requests by the Controller’s applications on behalf of Data Subjects. These coordinates are processed transiently and are not stored beyond the duration of request processing.
• IP Addresses: Source IP addresses of API requests, used for rate limiting, security monitoring, and abuse prevention. Retained in logs for ninety (90) days.
• Email Addresses: Email addresses of Controller account holders and administrators, used for account management, billing notifications, and security alerts.
• API Authentication Tokens: API keys issued to the Controller, stored as salted cryptographic hashes (bcrypt). API keys are classified as pseudonymous identifiers.
• Request Metadata: Timestamps, HTTP methods, endpoint paths, user agent strings, response status codes, and response times associated with API requests.

The Processor does not intentionally collect or process special categories of personal data (as defined in GDPR Article 9), including racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data, or health data. If the Controller’s use of the API inadvertently causes special category data to be transmitted, the Controller bears sole responsibility for ensuring an appropriate legal basis for such processing.

6. Categories of Data Subjects

The Personal Data processed under this DPA relates to the following categories of Data Subjects:

• End Users: Individuals who use the Controller’s applications and whose location data or other personal information may be transmitted to the SOSRoute API through the Controller’s integration. The Processor processes this data on behalf of the Controller and has no direct relationship with these Data Subjects.
• Account Holders: Individuals who register for a SOSRoute API account on behalf of the Controller organization, including primary account owners and billing contacts.
• Developers & Technical Personnel: Individuals within the Controller’s organization who access the developer dashboard, generate API keys, configure webhooks, or otherwise interact with the Services in a technical capacity.

The Controller is responsible for informing its Data Subjects about the processing of their Personal Data by the Processor, including by maintaining an appropriate privacy policy and obtaining any necessary consents, particularly with respect to the transmission of location data to third-party services.

7. Processor Obligations

In accordance with GDPR Article 28, the Processor agrees to the following obligations:

7.1 Documented Instructions

The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country, unless required to do so by Union or Member State law to which the Processor is subject. In such case, the Processor shall inform the Controller of that legal requirement before processing, unless prohibited by law from doing so. The instructions at the time of entering into this DPA are as set forth in the Terms of Service and this DPA. The Controller may provide additional written instructions, provided they are consistent with the Terms of Service.

7.2 Confidentiality

The Processor shall ensure that all personnel authorized to process Personal Data have committed themselves to confidentiality obligations or are under an appropriate statutory obligation of confidentiality. The Processor shall ensure that access to Personal Data is limited to those employees, contractors, and agents who have a need to access the data in connection with the performance of the Services.

7.3 Security Measures

The Processor shall implement and maintain appropriate technical and organizational security measures as described in Section 9 (Annex II) of this DPA, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects.

7.4 Assistance with Data Subject Rights

The Processor shall assist the Controller, by appropriate technical and organizational measures and insofar as possible, in fulfilling the Controller’s obligation to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR (access, rectification, erasure, portability, restriction, and objection). If the Processor receives a request directly from a Data Subject, it shall promptly redirect the Data Subject to the Controller and notify the Controller of the request.

7.5 Assistance with Compliance Obligations

The Processor shall assist the Controller in ensuring compliance with the obligations pursuant to GDPR Articles 32 through 36, taking into account the nature of processing and the information available to the Processor. This includes assistance with data protection impact assessments (DPIAs) and prior consultation with supervisory authorities where required.

7.6 Deletion and Return of Data

Upon termination of the service agreement, the Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller and delete existing copies, unless Union or Member State law requires storage of the Personal Data. The Controller shall have thirty (30) days following termination to request return of data. After this period, the Processor shall securely delete all Personal Data within thirty (30) days and provide written certification of deletion upon request.

7.7 Audit Information

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in GDPR Article 28, and shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, subject to the conditions in Section 12 of this DPA.

8. Sub-processors

8.1 Authorized Sub-processors

The Controller provides general written authorization for the Processor to engage the following Sub-processors to process Personal Data in connection with the Services:

• DigitalOcean, LLC (New York, NY, USA) — Cloud infrastructure hosting. Provides compute, storage, networking, and load balancing for the API platform. SOC 2 Type II and ISO 27001 certified.
• Neon, Inc. (USA) — Managed PostgreSQL database hosting. Stores account data, subscription records, and API usage metadata. Encrypted at rest.
• Upstash, Inc. (USA) — Managed Redis caching and rate limiting. Processes API key hashes and rate limit counters. Data is ephemeral with automatic expiration.
• Cloudflare, Inc. (San Francisco, CA, USA) — CDN, DNS management, and DDoS protection. Processes IP addresses and request headers for security filtering and performance optimization.
• Stripe, Inc. (San Francisco, CA, USA) — Payment processing. Processes billing information for paid subscriptions. PCI DSS Level 1 certified.
• Twilio SendGrid (San Francisco, CA, USA) — Transactional email delivery. Processes email addresses for account notifications, billing receipts, and security alerts.

8.2 Notification & Objection Procedure

The Processor shall notify the Controller in writing at least thirty (30) days before adding or replacing any Sub-processor. The notification shall include the name, location, and nature of processing performed by the proposed Sub-processor. The Controller may object to the appointment of a new Sub-processor by providing written notice to the Processor within fourteen (14) days of receiving the notification, stating reasonable grounds for the objection related to data protection concerns.

Upon receipt of an objection, the Processor shall use commercially reasonable efforts to make available to the Controller a change in the Services or recommend a commercially reasonable alternative to avoid processing of Personal Data by the objected-to Sub-processor. If the Processor is unable to provide an alternative within thirty (30) days, either party may terminate the affected Services by providing written notice. The Processor shall impose data protection obligations on each Sub-processor that are no less protective than those set forth in this DPA, through a written contract in accordance with GDPR Article 28(4). The Processor remains fully liable to the Controller for the performance of each Sub-processor’s obligations.

9. Technical and Organizational Security Measures (Annex II)

The Processor implements and maintains the following technical and organizational measures to ensure the security of Personal Data in accordance with GDPR Article 32:

9.1 Encryption

All data transmitted between the Controller’s applications and the SOSRoute API is encrypted using TLS 1.3 with strong cipher suites. HTTPS is enforced on all API endpoints; plaintext HTTP connections are rejected. Data at rest in PostgreSQL databases and file storage is encrypted using AES-256 encryption. Database backups are encrypted and stored in access-controlled locations.

9.2 Access Controls

Role-based access controls (RBAC) are implemented across all infrastructure components. Access to production databases, servers, and administrative interfaces requires multi-factor authentication (MFA). API keys are stored as salted cryptographic hashes using bcrypt and are never stored or logged in plaintext. Administrative access is restricted to authorized personnel on a strict need-to-know basis, with access reviews conducted quarterly.

9.3 Network Security

Production infrastructure is isolated within Virtual Private Cloud (VPC) networks with strict firewall rules permitting only necessary traffic. Cloudflare provides DDoS protection, Web Application Firewall (WAF) rules, and bot management at the network edge. Internal services communicate over private networks and are not exposed to the public internet. Intrusion detection and network anomaly monitoring are enabled.

9.4 Incident Response

The Processor maintains a documented incident response plan with defined roles, responsibilities, escalation paths, and communication procedures. Security events are monitored 24/7 through automated alerting on infrastructure metrics, API error rates, and access anomalies. Incidents are classified by severity level, and response procedures include containment, investigation, eradication, recovery, and post-incident review phases.

9.5 Disaster Recovery

Automated database backups are performed daily with point-in-time recovery capability. Backup integrity is verified through periodic restoration testing. The platform is designed with redundancy across availability zones within the DigitalOcean NYC region. Recovery Time Objective (RTO) targets are four (4) hours and Recovery Point Objective (RPO) targets are one (1) hour for critical services.

9.6 Employee Security

All employees and contractors with access to Personal Data are required to complete security awareness training upon onboarding and annually thereafter. Personnel with access to production infrastructure undergo background checks in accordance with applicable law. All personnel are bound by confidentiality agreements that survive the termination of their engagement.

9.7 Physical Security

Physical security of data center facilities is managed by DigitalOcean, which maintains SOC 2 Type II certified data centers with 24/7 physical security, biometric access controls, CCTV surveillance, and environmental controls including fire suppression and climate management. The Processor does not operate its own physical data center facilities.

10. Data Breach Notification

The Processor shall notify the Controller of any confirmed Data Breach without undue delay and no later than forty-eight (48) hours after becoming aware of the breach. The notification shall be sent via email to the Controller’s registered account email address and shall include, to the extent available at the time of notification:

• A description of the nature of the Data Breach, including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned.
• The name and contact details of the Processor’s data protection point of contact.
• A description of the likely consequences of the Data Breach.
• A description of the measures taken or proposed to be taken by the Processor to address the Data Breach, including measures to mitigate its possible adverse effects.

If it is not possible to provide all information at the time of initial notification, the Processor shall provide the information in phases without undue further delay. The Processor shall cooperate with the Controller and take all commercially reasonable steps to assist in the investigation, mitigation, and remediation of each Data Breach. The Processor shall document all Data Breaches, including the facts relating to the breach, its effects, and the remedial actions taken, and shall make this documentation available to the Controller and, upon request, to the relevant Supervisory Authority.

11. International Data Transfers

Personal Data processed under this DPA is stored and processed in the United States, primarily in DigitalOcean’s NYC region data centers. For transfers of Personal Data from the European Economic Area (EEA), United Kingdom, or Switzerland to the United States, the parties agree that the Standard Contractual Clauses (SCCs) adopted by the European Commission under Implementing Decision (EU) 2021/914 (Module Two: Controller to Processor) are hereby incorporated by reference into this DPA.

For the purposes of the SCCs: (a) the Controller is the data exporter; (b) the Processor is the data importer; (c) the governing law of the SCCs shall be the law of the EU Member State in which the Controller is established, or if the Controller is not established in the EU, the law of Ireland; and (d) disputes under the SCCs shall be resolved before the courts of the same jurisdiction. Annexes I, II, and III of the SCCs are deemed completed with the information set forth in this DPA (Sections 1-6 for Annex I, Section 9 for Annex II, and Section 8 for Annex III).

The Processor has conducted a Transfer Impact Assessment and has implemented supplementary measures, including end-to-end encryption of data in transit, encryption at rest, strict access controls, and contractual protections with Sub-processors, to ensure that transferred Personal Data receives a level of protection essentially equivalent to that guaranteed within the EEA. The Transfer Impact Assessment is available to the Controller upon written request.

12. Audit Rights

The Controller has the right to conduct audits, including inspections, to verify the Processor’s compliance with this DPA and applicable Data Protection Laws. Audits shall be subject to the following conditions:

• Notice: The Controller shall provide the Processor with at least thirty (30) days prior written notice of any intended audit, specifying the scope, duration, and start date of the audit.
• Scope: Audits shall be limited to the processing activities covered by this DPA and shall not extend to the Processor’s proprietary business operations, trade secrets, or the data of other customers.
• Frequency: The Controller may conduct no more than one (1) audit per twelve (12) month period, unless an additional audit is required by a Supervisory Authority or is triggered by a confirmed Data Breach.
• SOC 2 Reports: The Processor may satisfy audit requirements by providing the Controller with copies of current SOC 2 Type II audit reports, ISO 27001 certifications, or equivalent third-party audit reports covering the Processor’s infrastructure and security controls. If such reports reasonably address the Controller’s audit objectives, additional on-site audits may not be required.
• Costs: The Controller shall bear all costs associated with audits requested by the Controller, including the Processor’s reasonable costs for personnel time and resources. If an audit reveals material non-compliance by the Processor with this DPA, the Processor shall bear the costs of the audit and shall promptly remediate any identified deficiencies.
• Confidentiality: Any information obtained during an audit shall be treated as Confidential Information of the Processor and shall not be disclosed to third parties without the Processor’s prior written consent, except as required by law or Supervisory Authority.

13. Liability

The liability of each party under this DPA shall be subject to the limitations and exclusions of liability set forth in the Terms of Service, except to the extent that such limitations are prohibited by applicable Data Protection Laws. Nothing in this DPA shall limit either party’s liability for violations of Data Protection Laws where such limitations are not permitted.

In accordance with GDPR Article 82, each party shall be liable for damage caused by processing that infringes the GDPR. The Processor shall be liable for damage caused by processing only where it has not complied with obligations of the GDPR specifically directed at processors, or where it has acted outside of or contrary to the Controller’s lawful instructions. A party shall be exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.

Where both the Controller and the Processor are involved in the same processing and are responsible for any damage caused by that processing, each shall be held liable for the entire damage in order to ensure effective compensation of the Data Subject, in accordance with GDPR Article 82(4). Where a party has paid full compensation for the damage suffered, that party shall be entitled to claim back from the other party that part of the compensation corresponding to its share of responsibility for the damage.

14. Term and Termination

This DPA shall become effective upon the Controller’s acceptance of the Terms of Service (including by creating an account and generating an API key) and shall remain in effect for the duration of the service agreement. This DPA shall automatically terminate upon the termination or expiration of the Terms of Service, subject to the survival of provisions that by their nature are intended to survive termination.

Upon termination of this DPA, the Processor shall: (a) cease all Processing of Personal Data on behalf of the Controller; (b) at the Controller’s election, return or securely delete all Personal Data within thirty (30) days of receiving written instructions from the Controller; and (c) upon request, provide the Controller with written certification confirming that all Personal Data has been deleted or returned. If the Controller does not provide instructions within thirty (30) days of termination, the Processor shall securely delete all Personal Data. The Processor may retain Personal Data to the extent required by applicable law, provided that the retained data is subject to the confidentiality and security obligations of this DPA.

The following sections shall survive termination of this DPA: Section 1 (Definitions), Section 7.2 (Confidentiality), Section 9 (Security Measures, to the extent data is retained), Section 10 (Data Breach Notification), Section 12 (Audit Rights, for twelve months post-termination), and Section 13 (Liability).

15. Governing Law

This DPA shall be governed by and construed in accordance with the laws of the State of New Mexico, United States of America, without regard to its conflict of law principles, except that the provisions of this DPA relating to the rights of Data Subjects and the obligations of Controllers and Processors under Data Protection Laws shall be governed by the applicable Data Protection Laws, including the GDPR and UK GDPR.

Nothing in this DPA shall limit the rights of Data Subjects under applicable Data Protection Laws or restrict the jurisdiction of any Supervisory Authority. In the event of any conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to data protection matters. In the event of any conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

16. Standard Contractual Clauses

For transfers of Personal Data from the EEA, United Kingdom, or Switzerland to the United States, the parties agree that the Standard Contractual Clauses adopted by the European Commission under Implementing Decision (EU) 2021/914 are incorporated into this DPA by reference. The applicable module is Module Two: Transfer Controller to Processor.

The SCCs shall be deemed completed as follows: (a) Clause 7 (docking clause) is included; (b) under Clause 9, Option 2 (general written authorization) applies, and the time period for prior notice of Sub-processor changes is thirty (30) days; (c) under Clause 11, the optional language regarding independent dispute resolution is not included; (d) under Clause 17, Option 1 applies, with the governing law of the EU Member State of the Controller or, for non-EU Controllers, Ireland; (e) under Clause 18, disputes shall be resolved before the courts of the same Member State. The information required for Annexes I (List of Parties, Description of Transfer), II (Technical and Organizational Measures), and III (List of Sub-processors) is as set forth in Sections 1, 2, 5, 6, 9, and 8 of this DPA respectively.

For transfers from the United Kingdom, the International Data Transfer Addendum to the EU SCCs (issued by the ICO under Section 119A of the UK Data Protection Act 2018) is incorporated by reference. For transfers from Switzerland, the SCCs apply with the modifications necessary to reflect the Swiss Federal Act on Data Protection (FADP), including references to the Swiss Federal Data Protection and Information Commissioner (FDPIC) as the competent supervisory authority. In the event of any conflict between the provisions of this DPA and the SCCs, the SCCs shall prevail to the extent of the conflict.

17. Contact Information

For questions or concerns regarding this DPA, please contact:

• Legal & Privacy: [email protected]
• Developer Support: [email protected]
• Company: Sandbox Synergy LLC, 6300 Riverside Plaza Ln., NW Ste 118, PMB 360597, Albuquerque, New Mexico 87120
• Website: sandboxsynergy.org