Data Processing Agreement (DPA)

1. Scope

This Data Processing Agreement (“DPA”) forms part of the Terms of Service and applies when TheZealot processes personal data on behalf of a customer.

2. Roles

• The customer is the data controller

• NovaSage, Inc. is the data processor

3. Processing of Personal Data

We will process personal data:

• Only on documented instructions from the customer

• Only as necessary to provide the service

• In accordance with applicable data protection laws

4. Confidentiality

All personnel authorized to process personal data are subject to confidentiality obligations.

5. Security Measures

We implement appropriate technical and organizational measures, including:

• Encryption in transit and at rest

• Access controls

• Monitoring and logging

6. Subprocessors

We may engage third-party subprocessors to support the service.

A current list of subprocessors is available upon request.

We ensure subprocessors are bound by appropriate data protection obligations.

7. International Transfers

Where personal data is transferred across borders, we implement appropriate safeguards as required by applicable law.

8. Data Subject Rights

We will assist the customer, where reasonably possible, in responding to data subject requests.

9. Data Breach

We will notify the customer without undue delay upon becoming aware of a personal data breach affecting customer data.

10. Deletion and Return of Data

Upon termination of the service, we will delete or return personal data, unless retention is required by law.

11. Audits

We will make available information reasonably necessary to demonstrate compliance with this DPA.

12. Contact

For data protection inquiries: privacy@thezealot.ai