Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Malo and the organization (“Customer”) and applies where we process personal data on the Customer's behalf.

1. Roles

For content the Customer puts into Malo, the Customer is the data controller and Malo is the data processor. Malo processes that data only to provide the Service and on the Customer's documented instructions.

2. Subprocessors

The Customer authorizes Malo to engage subprocessors — including payment and hosting providers — to deliver the Service. We remain responsible for their compliance and will make a current list available on request.

3. Security

Malo maintains appropriate technical and organizational measures to protect personal data, including encryption in transit and at rest and access controls scoped to organization membership.

4. Data subject requests & breach

Malo will assist the Customer in responding to data-subject requests and will notify the Customer without undue delay after becoming aware of a personal-data breach affecting the Customer's data.

5. International transfers

Where personal data is transferred across borders, Malo relies on lawful transfer mechanisms as required by applicable law.

6. Deletion

On termination, Malo will delete or return the Customer's personal data in line with the Terms, except where retention is required by law.

7. Contact

To request a signed DPA or the current subprocessor list, email privacy@heymalo.com.