Data Processing Agreement

# Data Processing Agreement

**Effective Date:** Automatically, upon acceptance of the ComOS [Terms of Service](https://comos-federation.com/terms), for any Merchant who processes Personal Data through the Platform.
**Last Updated:** September 27, 2026

**Between:**
- **Data Controller**: The Merchant ("you," "Controller")
- **Data Processor**: **ComOS Federation, Inc.**, a Delaware corporation (incorporated; effective July 20, 2026), operating the ComOS platform ("ComOS," "we," "Processor"). ComOS Federation, Inc. is the Processor, and all obligations under this DPA are those of the corporation.

---

## 1. Introduction

This Data Processing Agreement ("DPA") is **incorporated by reference into the ComOS [Terms of Service](https://comos-federation.com/terms)** ("Agreement") and takes effect automatically — with no separate signature or request required — for any Merchant who processes Personal Data on behalf of Data Subjects protected by applicable Data Protection Laws. It governs the processing ComOS performs as a Processor on the Merchant's behalf.

This DPA reflects the parties' commitment to comply with applicable Data Protection Laws, including the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and the California Consumer Privacy Act ("CCPA").

---

## 2. Definitions

**"Data Protection Laws"** means all applicable laws relating to data protection and privacy, including GDPR, UK GDPR, CCPA, and other applicable regulations.

**"Personal Data"** means any information relating to an identified or identifiable natural person processed by ComOS on behalf of the Merchant through the Platform.

**"Processing"** means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.

**"Data Subject"** means the identified or identifiable natural person to whom Personal Data relates.

**"Sub-processor"** means any third party engaged by ComOS to process Personal Data on behalf of the Merchant.

**"Standard Contractual Clauses" or "SCCs"** means the standard contractual clauses approved by the European Commission for international data transfers.

---

## 3. Scope and Roles

### 3.1 Controller and Processor

- **Merchant is the Data Controller** for Personal Data collected through their use of the Platform (e.g., customer data, order data)
- **ComOS is the Data Processor** processing such data on the Merchant's behalf

### 3.2 ComOS as Controller

ComOS acts as an independent Data Controller for:
- Merchant account information
- Billing and payment data
- Usage analytics
- Data collected for our own business purposes

This DPA governs only the processing where ComOS acts as Processor.

---

## 4. Processing Details

### 4.1 Subject Matter

Processing of Personal Data necessary to provide the ComOS platform services.

### 4.2 Duration

Processing continues for the term of the Agreement plus any retention period required by law or specified in Section 10.

### 4.3 Nature and Purpose

| Purpose | Description |
|---------|-------------|
| Order Processing | Store and process customer orders |
| Customer Management | Maintain customer profiles and history |
| Communications | Send transactional emails on Merchant's behalf |
| Analytics | Generate reports and insights for Merchant |
| AI Features | Power AI-driven features (e.g., recommendations) |
| Support | Assist with customer service inquiries |

### 4.4 Categories of Data Subjects

- Merchant's customers
- Merchant's prospective customers
- Merchant's employees and contractors (if applicable)

### 4.5 Types of Personal Data

- Contact information (name, email, phone, address)
- Transaction data (orders, payments, refunds)
- Communication records
- Device and usage data
- Any other data Merchant collects through the Platform

### 4.6 Special Categories of Data

The Platform is not designed to process special categories of data (e.g., health, biometric, religious data). Merchant agrees not to collect such data unless they have implemented appropriate safeguards.

---

## 5. Processor Obligations

ComOS shall:

### 5.1 Lawful Processing

Process Personal Data only on documented instructions from the Controller, unless required by law. If required by law to process data otherwise, we will inform the Controller before processing (unless prohibited by law).

### 5.2 Confidentiality

Ensure that personnel authorized to process Personal Data are subject to confidentiality obligations.

### 5.3 Security Measures

Implement appropriate technical and organizational measures to protect Personal Data, including:

| Measure | Implementation |
|---------|----------------|
| Encryption | TLS in transit (current clients negotiate TLS 1.3); AES-256 at rest, provided by Google Cloud and MongoDB Atlas |
| Access Control | Scope-based, fail-closed authorization on every tool call; privileged scopes issued only to entitled managers; merchant sign-in through Google or GitHub |
| Monitoring | Audit log of every tool call; scheduled automated checks of service error rates and ledger integrity |
| Change Control | Automated tests, dependency vulnerability audit, and secret scanning in CI on every change pushed to the main branch |
| Incident Response | Breach notification under Section 5.8 |

### 5.4 Sub-processors

- Engage Sub-processors only with Controller's authorization (see Section 6)
- Impose equivalent data protection obligations on Sub-processors
- Remain liable for Sub-processor compliance

### 5.5 Data Subject Rights

Assist the Controller in responding to Data Subject requests to exercise their rights under Data Protection Laws, including:
- Access
- Rectification
- Erasure
- Restriction
- Portability
- Objection

### 5.6 Compliance Assistance

Assist the Controller with:
- Data protection impact assessments
- Prior consultations with supervisory authorities
- Demonstrating compliance with Data Protection Laws

### 5.7 Audits

Upon reasonable notice, allow for and contribute to audits and inspections conducted by the Controller or an authorized auditor. ComOS may charge reasonable fees for audit assistance beyond standard reporting.

### 5.8 Data Breach Notification

Notify the Controller without undue delay (and within 72 hours where feasible) after becoming aware of a Personal Data breach, providing:
- Description of the breach
- Categories and approximate number of Data Subjects affected
- Likely consequences
- Measures taken or proposed to address the breach

---

## 6. Sub-processors

### 6.1 Authorized Sub-processors

Controller authorizes the use of the Sub-processors listed in **Appendix A**. The current list is always Appendix A of this DPA as published at https://comos-federation.com/dpa.

### 6.2 Changes to Sub-processors

ComOS will notify the Controller at least 14 days before engaging a new Sub-processor by:
- Updating the Sub-processor list
- Sending email notification to the account's primary contact

### 6.3 Objection to Sub-processors

Controller may object to a new Sub-processor within 14 days of notification by emailing support@comos-federation.com with reasonable grounds. If the objection cannot be resolved, Controller may terminate the affected services without penalty.

---

## 7. International Data Transfers

### 7.1 Transfer Mechanisms

For transfers of Personal Data outside the EEA/UK to countries without an adequacy decision, ComOS relies on:

- **Standard Contractual Clauses (SCCs)**: As approved by the European Commission (Decision 2021/914)
- **UK International Data Transfer Addendum**: For UK transfers

### 7.2 SCCs Incorporation

The SCCs are incorporated by reference into this DPA:
- **Module Two** (Controller to Processor) applies
- ComOS is the "data importer"
- Controller is the "data exporter"

### 7.3 Supplementary Measures

ComOS implements supplementary measures including:
- Encryption of data in transit and at rest
- Access controls and authentication
- Automated security checks on every change
- Transparency about government access requests

---

## 8. Controller Obligations

The Controller shall:

- Comply with Data Protection Laws in its use of the Platform
- Ensure lawful basis for processing (e.g., consent, contract)
- Provide appropriate privacy notices to Data Subjects
- Respond to Data Subject requests (with Processor assistance)
- Ensure accuracy of Personal Data
- Not use the Platform to process data beyond what is necessary

---

## 9. Data Subject Requests

### 9.1 Processor Response

If ComOS receives a request from a Data Subject regarding the Controller's data, we will:
- Promptly notify the Controller
- Not respond directly unless authorized by the Controller
- Provide reasonable assistance to fulfill the request

### 9.2 Self-Service

The Platform provides tools for Controllers to respond to many Data Subject requests directly, including data export and deletion.

---

## 10. Data Retention and Deletion

### 10.1 During the Agreement

Personal Data is retained as long as necessary to provide the services and as specified in the Agreement.

### 10.2 Upon Termination

Upon termination of the Agreement:
- **30 days**: Controller may export all data
- **90 days**: Data deleted from production systems
- **1 year**: Data purged from backups

### 10.3 Exceptions

ComOS may retain data as required by law or for legitimate business purposes (e.g., billing records, legal claims).

---

## 11. Liability

Liability under this DPA is subject to the limitations in the Agreement. Each party is liable for damages caused by its breach of Data Protection Laws.

---

## 12. Governing Law

This DPA is governed by the same law as the Agreement, except that:
- GDPR claims are governed by the law of the EU Member State of the Controller's establishment
- UK GDPR claims are governed by the laws of England and Wales

---

## 13. Changes to This DPA

ComOS may update this DPA to reflect changes in law or our practices. Material changes will be notified 30 days in advance.

---

## Appendix A: Authorized Sub-processors

| Sub-processor | Service | Location | Data Processed |
|---------------|---------|----------|----------------|
| Google Cloud | Hosting, file storage, event messaging | USA | All Platform data |
| Google Vertex AI | AI model service for in-Platform AI features | Global (Google-managed endpoint) | Data processed by AI features |
| Google Sign-In | Sign-in | USA | Name, email address, account identifier, profile picture URL |
| GitHub | Sign-in | USA | Profile, email addresses |
| MongoDB Atlas | Database hosting | USA | All Platform data |
| Stripe | Card payments and refunds for U.S.-dollar orders | USA | Payment and transaction data |
| Circle | USDC funding, redemptions, and payouts | USA | Wallet addresses, amounts |
| Resend | Email delivery | USA | Email addresses, message content |
| Tavily | Web search for research tools | USA | Search query text |

This list is authoritative and matches the Service Providers list in the [Privacy Policy](https://comos-federation.com/privacy) §4.1.

**Last Updated:** September 27, 2026

---

## Appendix B: Technical and Organizational Measures

### B.1 Access Control

- Scope-based authorization on every tool call, fail-closed: a tool not mapped to a granted scope is denied
- Privileged scopes issued only to managers holding the matching entitlement
- Merchant sign-in through Google or GitHub OAuth; ComOS provides no multi-factor authentication of its own, and sign-in inherits the multi-factor authentication the user enables with that provider
- OAuth tokens revocable on demand (RFC 7009), effective within seconds
- Access to production systems limited to ComOS personnel and ComOS-controlled service accounts

### B.2 Encryption

- TLS for data in transit; current clients negotiate TLS 1.3
- AES-256 encryption at rest, with key management provided by Google Cloud and MongoDB Atlas

### B.3 Network Security

- Public traffic terminates at Google Cloud's front end, which provides DDoS protection
- Rate limits on tool calls, keyed per tenant or caller

### B.4 Application Security

- Automated tests and type checking in CI on every change pushed to the main branch
- Dependency vulnerability audit and secret scanning in CI on the same changes

### B.5 Operational Security

- Audit log of every tool call (metadata only, retained 90 days)
- Scheduled automated checks of service error rates and ledger integrity
- Breach notification under Section 5.8

### B.6 Physical Security

ComOS operates no data centers. Physical security of the facilities that store Platform data is provided by Google Cloud and MongoDB Atlas under their own controls.

### B.7 Personnel Security

- Confidentiality obligations for all personnel with access to Personal Data
- Access revocation upon departure