Data Processing Agreement

2.1 Subject Matter and Duration

MS Power House will process personal data as necessary to provide IT services including managed services, cloud migration, data migration, and related technical support.

Duration: For the duration of the Master Service Agreement and applicable data retention periods.

2.2 Nature and Purpose of Processing

2.3 Categories of Data Subjects

• Employees and contractors of the Controller
• Customers and clients of the Controller
• Suppliers and business partners of the Controller
• Website visitors and service users

2.4 Categories of Personal Data

3.1 Processing Instructions

MS Power House will process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to third countries.

• Initial instructions are set out in the Master Service Agreement and SOWs
• Additional instructions may be given in writing during the term
• MS Power House will inform Controller if instructions violate GDPR or other laws

3.2 Confidentiality

MS Power House ensures that persons authorized to process personal data have committed themselves to confidentiality or are under appropriate statutory obligation of confidentiality.

3.3 Data Subject Rights

MS Power House will assist the Controller in fulfilling data subject rights requests:

• Access, rectification, erasure, and portability requests
• Restriction of processing and objection requests
• Response within 72 hours of receiving Controller's request
• Technical and organizational measures to facilitate rights fulfillment

4.1 Security Framework

MS Power House implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk:

4.2 Certifications and Standards

5.1 General Authorization

The Controller provides general written authorization for MS Power House to engage sub-processors, subject to the conditions set out in this DPA.

5.2 Current Sub-processors

5.3 Sub-processor Changes

MS Power House will inform the Controller of any intended changes concerning the addition or replacement of sub-processors, giving the Controller the opportunity to object to such changes.

• 30 days advance notice for new sub-processors
• Controller may object within 15 days of notice
• Updated sub-processor list maintained on our website

6.1 Transfer Mechanisms

Where personal data is transferred outside the EEA, MS Power House ensures appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): EU Commission approved clauses
• Adequacy Decisions: Transfers to countries with adequacy decisions
• Binding Corporate Rules: For intra-group transfers
• Certification Schemes: Approved certification mechanisms

6.2 Data Residency Controls

7.1 Notification Timeline

7.2 Notification Content

Breach notifications will include:

• Nature of the breach and categories of data affected
• Approximate number of data subjects and records affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact details for further information

8.1 End of Processing

Upon termination of services, MS Power House will, at the Controller's choice:

• Return all personal data to the Controller in a structured, commonly used format
• Securely delete all personal data and provide certification of deletion
• Continue to store data subject to ongoing legal obligations

8.2 Deletion Timeline

9.1 Audit Rights

MS Power House will make available to the Controller information necessary to demonstrate compliance with Article 28 GDPR and allow for audits:

• Annual compliance reports and certifications
• Third-party audit reports (SOC 2, ISO 27001)
• On-site audits with reasonable advance notice
• Questionnaire-based assessments

9.2 Audit Costs

Controller may conduct one audit per year at no cost. Additional audits or on-site inspections may be subject to MS Power House's then-current professional services rates.