Effective Jan 29, 2026
The Data Processing Agreement (DPA) and its Attachments establish a binding contract between VisiblePassage ("Supplier") and any Customer receiving Supplier Products. This contract governs the provision of these products, either through a written or electronic Agreement.
The DPA takes effect when the Supplier processes Personal Data on behalf of the Customer, as outlined in the Agreement. It becomes an integral part of the Agreement upon signing or incorporation as specified.
In the event of any conflicting terms, this DPA will take precedence over the Agreement. The DPA’s duration aligns with the Agreement’s terms, and all defined terms are consistent with those in the Agreement.
California Personal Information refers to Personal Data regulated by the CCPA.
Canadian Privacy Laws include PIPEDA, Quebec Law 25, Alberta PIPA, and British Columbia PIPA.
Controller means the entity determining the purposes and means of processing Personal Data.
Data Protection Laws include all applicable global privacy and data protection regulations.
Data Subject refers to the individual whose Personal Data is processed.
European Data means Personal Data protected under European Data Protection Laws including GDPR and UK GDPR.
Instructions are documented directions provided by the Customer to the Supplier.
Personal Data includes any information relating to an identifiable individual.
Personal Data Breach means any unauthorized access, disclosure, or loss of Personal Data.
Processor means an entity processing Personal Data on behalf of a Controller.
Products refer to services provided by VisiblePassage under the Agreement.
Sub-Processor means any third party engaged by the Supplier to process Personal Data.
Under European Data Protection Laws, the Supplier acts as a Processor and the Customer acts as a Controller or Processor.
Under CCPA, the Supplier acts as a Service Provider and the Customer acts as a Business.
Under Canadian Privacy Laws, the Supplier processes Personal Data on behalf of the Customer.
Customers must comply with all applicable Data Protection Laws, ensure data accuracy, lawfulness, transparency, and maintain proper consent.
Customers must ensure instructions provided to VisiblePassage comply with applicable laws.
Customers are responsible for securing access credentials and safeguarding data transfers.
VisiblePassage processes Personal Data only according to lawful instructions and this DPA.
Appropriate technical and organizational security measures are implemented to protect Personal Data.
Confidentiality obligations apply to all authorized personnel.
In the event of a Personal Data Breach, customers will be notified in compliance with legal timelines.
Upon termination, Personal Data will be deleted or returned unless retention is legally required.
VisiblePassage assists with lawful Data Subject Requests and notifies Customers when such requests are received.
Customers authorize the use of Sub-Processors, subject to written agreements ensuring equivalent data protection.
Personal Data may be processed globally in compliance with applicable data protection laws.
Transfers from EEA, UK, or Switzerland rely on Standard Contractual Clauses and applicable addendums.
VisiblePassage does not sell or share California Personal Information and processes it strictly for permitted business purposes.
VisiblePassage may update this DPA with thirty (30) days’ notice. Severability applies to invalid provisions.
Liability limitations and governing law follow the main Agreement.
Attachment 1 outlines data processing details including categories of data subjects and Personal Data.
Attachment 2 describes technical and organizational security measures.
Attachment 3 governs international data transfers including Standard Contractual Clauses and UK Addendum.