Data Processing Agreement

1. Definitions

The following terms have the meanings set out below for the purposes of this Data Processing Agreement ("DPA"):

• "Controller" means the entity that determines the purposes and means of the processing of Personal Data. Under this DPA, the Customer acts as the Controller.
• "Processor" means the entity that processes Personal Data on behalf of the Controller. Under this DPA, StepBase acts as the Processor.
• "Data Subject" means an identified or identifiable natural person whose Personal Data is processed.
• "Personal Data" means any information relating to a Data Subject that can be used, directly or indirectly, to identify that person.
• "Sub-processor" means any third party engaged by StepBase to assist in the processing of Personal Data on behalf of the Customer.
• "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, erasure, or destruction.
• "Supervisory Authority" means an independent public authority established by an EU or EEA member state, or the UK Information Commissioner's Office, responsible for monitoring the application of data protection legislation.
• "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation), and, where applicable, the UK GDPR as retained under the Data Protection Act 2018.
• "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.

2. Scope & Applicability

This Data Processing Agreement applies whenever StepBase processes Personal Data on behalf of the Customer in connection with the Customer's use of the StepBase platform. It supplements and forms part of the StepBase Terms of Service.

For the purposes of this DPA, the Customer is the Controller and StepBase is the Processor. The Customer determines the purposes and means of processing Personal Data through its configuration and use of workflows, forms, and other features within the StepBase platform. StepBase processes such data solely in accordance with the Customer's documented instructions and as necessary to provide the service.

In the event of any conflict between this DPA and the Terms of Service, the provisions of this DPA shall prevail with respect to matters of data protection.

3. Data Processing Details

4. Customer Obligations

As the Controller, the Customer is responsible for ensuring that its use of the StepBase platform complies with applicable data protection laws. In particular, the Customer shall:

• Ensure that a lawful basis exists for the processing of Personal Data (e.g., consent, legitimate interest, contractual necessity, or legal obligation) before inputting such data into the platform
• Inform Data Subjects about the processing of their Personal Data, including the involvement of StepBase as a Processor, in accordance with applicable transparency requirements
• Ensure the accuracy and relevance of Personal Data provided to StepBase, and update or correct such data as necessary
• Provide processing instructions to StepBase that are compliant with applicable data protection laws, and refrain from instructing StepBase to process data in a manner that would violate such laws
• Implement appropriate organizational measures within its own operations to protect Personal Data

5. StepBase Obligations

As the Processor, StepBase commits to the following obligations with respect to the processing of Personal Data:

• Process Personal Data only on the basis of documented instructions from the Customer, unless required to do so by applicable law, in which case StepBase will inform the Customer of such legal requirement before processing (unless prohibited by law)
• Ensure that all personnel authorized to process Personal Data are bound by appropriate confidentiality obligations, whether contractual or statutory
• Implement and maintain appropriate technical and organizational security measures to protect Personal Data against unauthorized or unlawful processing, accidental loss, destruction, or damage
• Assist the Customer in responding to Data Subject Access Requests (DSARs) and other requests from Data Subjects exercising their rights under applicable data protection law, taking into account the nature of the processing
• Notify the Customer without undue delay upon becoming aware of a Data Breach involving Personal Data processed on behalf of the Customer
• Upon termination of the service agreement, delete all Personal Data within 30 days or return it to the Customer, at the Customer's election, unless retention is required by applicable law
• Make available to the Customer all information necessary to demonstrate compliance with this DPA and applicable data protection obligations

6. Security Measures

StepBase implements and maintains the following technical and organizational measures to ensure a level of security appropriate to the risk of the processing:

• Encryption in transit using TLS 1.2 or higher for all data transmitted between clients and the StepBase platform
• Encryption at rest for all stored Personal Data
• AES-256-GCM encryption for connector credentials and other sensitive configuration data
• Workspace isolation through a multi-tenant architecture with strict data boundaries, ensuring that each Customer's data is logically separated from that of other customers
• Role-based access controls that restrict access to Personal Data to authorized personnel on a need-to-know basis
• Comprehensive audit logging of data access and administrative actions within the platform
• Regular security assessments, including vulnerability scanning and review of security practices
• Documented incident response procedures to detect, contain, and remediate security incidents in a timely manner

StepBase reviews and updates these measures periodically to address evolving threats and maintain alignment with industry best practices.

7. Sub-processors

The Customer authorizes StepBase to engage the following Sub-processors in connection with the provision of the StepBase platform:

• Stripe: payment processing (United States)
• Auth0 / Authentication Provider: identity management and user authentication
• Cloud hosting provider: infrastructure and data storage (region disclosed upon request)
• AI service provider: workflow and flow generation features (no Personal Data retention by the provider)

StepBase will notify the Customer at least 30 days in advance of engaging any new Sub-processor or materially changing an existing Sub-processor arrangement. Notification will be provided via email or through the platform.

The Customer may object to the appointment of a new Sub-processor on reasonable grounds related to data protection. If StepBase and the Customer are unable to resolve the objection within a reasonable timeframe, the Customer may terminate the affected services without penalty. StepBase will ensure that each Sub-processor is bound by data protection obligations no less protective than those set out in this DPA.

8. Data Subject Rights

StepBase will assist the Customer in fulfilling its obligations to respond to requests from Data Subjects exercising their rights under applicable data protection law, including the right of access, rectification, erasure, restriction of processing, data portability, and objection.

If StepBase receives a request directly from a Data Subject regarding Personal Data processed on behalf of the Customer, StepBase will promptly notify the Customer and will not respond to the request directly unless authorized by the Customer or required by applicable law.

Where technically feasible, StepBase provides tools within the platform to facilitate data export and deletion, enabling the Customer to respond to Data Subject requests efficiently.

9. Data Breach Notification

StepBase will notify the Customer without undue delay, and in any event within 72 hours, of becoming aware of a Data Breach affecting Personal Data processed on behalf of the Customer.

The notification will include, to the extent reasonably available at the time:

• A description of the nature of the Data Breach, including the categories of data and processing activities affected
• The categories and approximate number of Data Subjects affected
• An assessment of the likely consequences of the Data Breach
• A description of the measures taken or proposed to address the Data Breach, including measures to mitigate its potential adverse effects

StepBase will cooperate with the Customer and take reasonable steps to assist in the investigation, mitigation, and remediation of the Data Breach. StepBase will provide additional information as it becomes available and will document all facts relating to the breach, its effects, and the remedial actions taken.

10. International Data Transfers

StepBase will not transfer Personal Data outside the European Economic Area (EEA) or the United Kingdom unless adequate safeguards are in place in accordance with applicable data protection law.

Where transfers to countries outside the EEA or UK are necessary for the provision of the service, StepBase relies on appropriate transfer mechanisms, which may include Standard Contractual Clauses (SCCs) as adopted by the European Commission, adequacy decisions, or other lawful transfer mechanisms recognized under applicable law.

Copies of the applicable Standard Contractual Clauses or details of other transfer mechanisms are available upon request. The Customer may contact StepBase at any time to request information about the specific safeguards applied to international data transfers.

11. Audits

The Customer may audit StepBase's compliance with this DPA, subject to the following conditions:

• The Customer must provide reasonable advance written notice of at least 30 days prior to any audit
• Audits will be conducted during normal business hours and in a manner that minimizes disruption to StepBase's operations
• The Customer (or its appointed auditor) must comply with StepBase's reasonable security and confidentiality requirements
• StepBase may satisfy audit requests by providing relevant third-party audit reports, certifications (e.g., SOC 2), or other documentation that demonstrates compliance

Audits will be conducted at the Customer's expense, unless the audit reveals material non-compliance with this DPA on the part of StepBase, in which case StepBase will bear the reasonable costs of the audit.

StepBase will cooperate in good faith with any audit and provide reasonable access to relevant information, systems, and personnel as necessary to verify compliance.

12. Term & Termination

This DPA takes effect when the Customer begins using the StepBase platform and remains in effect for the duration of the main service agreement between the Customer and StepBase.

Upon termination or expiration of the service agreement, StepBase will delete all Personal Data processed on behalf of the Customer within 30 days, unless applicable law requires further retention. The Customer may request a full export of its data prior to deletion, and StepBase will make reasonable efforts to facilitate such export in a commonly used, machine-readable format.

Provisions of this DPA that by their nature should survive termination (including, without limitation, obligations relating to confidentiality, data deletion, liability, and cooperation with audits or investigations) will continue to apply after termination.

13. Contact

For questions, requests, or concerns regarding this Data Processing Agreement or StepBase's data protection practices, please reach out to us.