Data Processing Addendum
Processor terms for Enterprise customers: scope, sub-processors, security, assistance, transfers, deletion and audits.
Last updated October 12, 2026.
Draft — have a lawyer review before launch. This text is a working draft and is not yet the binding version.
This Data Processing Addendum ("DPA") forms part of the Company Subscription Agreement between VisualSphere Solutions, LLC ("Processor") and the Enterprise customer ("Controller") when the Controller submits personal data to the Platform for processing on its behalf.
1. Scope
| Item | Detail |
|---|---|
| Subject matter | Hosting and processing of Controller's users, sites, private notes, scorecards, incidents, requirement profiles and uploaded files |
| Duration | The subscription term plus the export window |
| Nature and purpose | Providing the Platform under the Agreement |
| Data subjects | Controller's employees and contractors' personnel named in Controller's records |
| Data categories | Names, work contact details, job titles, account activity, content Controller uploads |
| Special categories | None intended; Controller will not upload health or other special-category data |
Contractor profile data that the Platform verifies and publishes is processed by us as an independent controller under our Privacy Policy, not under this DPA.
2. Processor obligations
Processor will:
- process personal data only on Controller's documented instructions, including the Agreement;
- ensure personnel are bound by confidentiality;
- implement the security measures in Annex A;
- assist Controller with data subject requests, security, breach notification and impact assessments, taking into account the nature of processing;
- notify Controller of a personal data breach without undue delay and within 48 hours of becoming aware;
- at the end of the term, delete or return personal data within 30 days, except where law requires retention;
- make available information reasonably needed to demonstrate compliance, and allow audits by Controller or its auditor once a year on 30 days' notice, or by providing a current SOC 2 report when available.
3. Sub-processors
Controller authorizes the sub-processors listed at our sub-processor list. Processor will give 30 days' notice of new sub-processors; Controller may object on reasonable data-protection grounds, and if the parties can't resolve the objection Controller may terminate the affected service with a pro-rata refund.
4. International transfers
Where personal data is transferred out of the EEA, UK or Switzerland to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2) and the UK Addendum apply and are incorporated by reference.
5. US state privacy laws
To the extent the CCPA/CPRA or similar state laws apply, Processor is a "service provider" or "processor" and will not sell or share personal data, retain, use or disclose it outside the direct business relationship, or combine it with other data except as permitted.
Annex A: Security measures
- Encryption in transit (TLS 1.2+) and at rest; field-level encryption for sensitive identifiers
- Role-based access control; MFA for all staff; logged staff impersonation
- Tenant isolation enforced in application middleware and tested automatically
- Virus scanning and content-type checks on uploads; signed links expiring after five minutes
- Append-only audit log of sensitive actions
- Daily backups with 30-day retention and point-in-time recovery, restore tested quarterly
- Vulnerability management, dependency scanning and an annual penetration test