Data Processing Agreement (DPA)

Effective Date: July 10, 2026

This Data Processing Agreement ("DPA") is entered into by and between SiouxTXT Labs ("Processor") and the user of MetaMesh-UGA services ("Controller"). This DPA governs the processing of personal data in connection with the Service and complies with Article 28 of the GDPR.

1. Scope and Subject Matter

This DPA applies to the processing of personal data transmitted by the Controller through the MetaMesh-UGA gateway. Processor acts solely as a data processor for these transit requests.

2. Processor Commitments

Processor agrees to:

• Process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country.
• Ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption in transit (TLS 1.3) and token/API key hashing.
• Respect the conditions for engaging another processor (subprocessor) as detailed in Section 3.
• Assist the Controller by appropriate technical and organizational measures in responding to data subjects exercising their GDPR rights (DSARs).
• Notify the Controller without undue delay after becoming aware of a personal data breach.
• At the choice of the Controller, delete or return all personal data after the end of the provision of services, unless Union or Member State law requires storage.

3. Subprocessors

The Controller provides general authorization for the Processor to engage subprocessors. The current list of subprocessors is available at subprocessors.html. The Processor will inform the Controller of any intended changes concerning the addition or replacement of other subprocessors, giving the Controller the opportunity to object.

4. Audits

Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.