Data Processing Agreement

Application and parties

This Data Processing Agreement (DPA) applies when a written or electronic service agreement expressly incorporates it. It binds the customer identified in that agreement (Customer) and EnigmaCyber LLC, a New Mexico company with principal address 1209 MOUNTAIN ROAD PL NE STE N, ALBUQUERQUE, NM 87110 USA (Enigma). Viewing this page or making an enquiry does not enter into this DPA.

This DPA governs personal data that Enigma processes on the Customer’s behalf to provide the agreed services (Customer Data). The Customer is the controller, or a processor authorised by its controller to appoint Enigma as a subprocessor. In the latter case, references to the Customer’s instructions and choices mean those it is authorised to give on the controller’s behalf. Each party’s actual activities determine its legal role.

The service agreement, agreed scope of work and documented processing instructions form the Engagement Record and are incorporated into this DPA. They identify the Customer and its contact, services, authorised systems and processing particulars. The parties must resolve any insufficiently specified processing before it begins. Enigma’s independent processing of business contacts, billing and enquiries is described in the privacy notice.

Processing description

The subject matter is the handling of Customer Data necessary for the technology, security or support services specified in the Engagement Record. Processing lasts for the agreed service period and any limited period needed for lawful return, deletion or mandatory retention under this DPA.

Processing may involve receiving, accessing, organising, storing, reviewing, analysing, correcting, transmitting, retrieving and deleting Customer Data, solely as necessary to deliver the agreed work and support. Frequency follows the engagement: one-off for a discrete task or ongoing for a continuing service.

The permitted individuals are the Customer’s staff, contractors, business contacts, customers and users whose information is relevant to the agreed work. Ordinary data may include names, professional contact details, roles, account identifiers, correspondence, service records, device and network identifiers, security logs and relevant content in authorised customer systems. The Engagement Record limits these categories to those needed for the actual service; this description does not authorise access to unrelated systems or records.

Special-category or sensitive data, criminal-offence information, children’s data, health records, payment-card data and other regulated information require explicit written agreement on their categories, purpose, lawful handling and additional safeguards before they are supplied or accessed. Where a sector-specific instrument is required, such as a HIPAA business associate agreement, it must also be concluded first. This DPA alone does not establish eligibility to handle every regulated dataset.

Instructions and permitted use

The Customer determines the lawful purposes, data subjects, data categories and scope of processing, gives documented instructions and supplies the notices, permissions and controller authorisations it is responsible for. It must limit access and disclosure to information necessary for the services and tell Enigma about applicable special restrictions.

Enigma will process Customer Data only on documented instructions, including instructions concerning disclosure and international processing. Any departure required by law is limited to what the applicable data-protection regime permits: for GDPR processing, a requirement of Union or Member State law; for UK GDPR processing, a requirement of UK law. Enigma will inform the Customer before that processing unless the applicable law prohibits notice on important public-interest grounds. Enigma will immediately notify the Customer if an instruction appears unlawful, suspend the affected activity while the issue is resolved and not knowingly implement an unlawful instruction.

Enigma will not sell or share Customer Data (as those terms are defined by the CCPA), use it for its own marketing or targeted advertising, or use it to train or fine-tune general-purpose AI models. AI-assisted processing of Customer Data requires instructions covering that use and approval of any relevant subprocessor. Enigma will not retain, use or disclose Customer Data outside the specified service purposes or the direct business relationship, or combine it with information from other customers or its own sources, except where applicable law permits that processing within its processor or service-provider role. Enigma will provide the level of protection required by applicable law and certifies that it understands and will comply with these restrictions.

Confidentiality and security

Enigma will ensure that personnel with access are bound by confidentiality obligations or an equivalent statutory duty, receive appropriate data-protection and security instruction, and process Customer Data only as authorised. Access will be limited to operational need, reviewed and removed when no longer required. Multi-factor authentication is required for access to customer personal data.

Enigma will implement and maintain measures appropriate to the nature, context, purposes and risks of the processing, including:

• controlled user and administrative access, least privilege and separation between customer environments or records;
• protected transmission, appropriate encryption or pseudonymisation of stored information, and controlled handling of credentials and keys;
• secure configuration, vulnerability and patch management, and logging and investigation of relevant access and security events;
• measures for confidentiality, integrity, availability and resilience, with recovery arrangements and testing appropriate to the service;
• incident response, secure return and disposal, and regular assessment of the effectiveness of the measures.

Enigma will provide the Customer with a description of the measures for the agreed service before processing starts and on reasonable request. Additional safeguards agreed in the Engagement Record are binding. Changes must not materially reduce the protection required for that processing. This DPA does not promise a certification, a particular hosting location or a service availability level.

Assistance and incidents

Taking account of the processing and information available, Enigma will assist the Customer with individual rights requests, security obligations, breach notifications, data-protection impact assessments and required regulator consultations. Enigma will promptly forward requests concerning Customer Data and will not independently answer them, except on instructions or where legally required. Assistance must allow the Customer to meet applicable deadlines.

Enigma will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Data, using the Customer’s designated privacy or incident contact in the Engagement Record. The notice will describe, as information becomes available, the incident, affected data and individuals, likely consequences, measures taken or proposed, and a contact for follow-up. Enigma will supply information in stages if necessary, preserve relevant evidence, investigate and cooperate in containment and remediation. An incomplete investigation will not delay the initial notice. Enigma will not notify affected individuals or a regulator on the Customer’s behalf without instructions unless the law requires it.

Subprocessors

Enigma may appoint another organisation, including another Enigma group company, to process Customer Data only with the Customer’s prior written authorisation. Before seeking authorisation, Enigma will provide the organisation’s identity, processing function, relevant locations and safeguards. No organisation is authorised merely because it appears in the website privacy notice or provides services to another Enigma company.

Unless the Engagement Record expressly grants general written authorisation and specifies an agreed list, authorisation is specific to each subprocessor. Where general authorisation is agreed, Enigma will give at least 30 days’ advance written notice of additions or replacements and an opportunity to object on reasonable data-protection grounds. Enigma will not use the proposed subprocessor for the affected Customer Data while a timely objection remains unresolved. The parties will agree a compliant alternative or end the affected processing if no suitable alternative is available.

Enigma will bind each authorised subprocessor by a written agreement imposing the data-protection obligations required for its work, assess the assurances it provides and remain responsible to the Customer for its performance. Enigma will maintain the authorised list, provide it on request and notify the Customer of material failures affecting Customer Data. Where the Customer is itself a processor, its controller’s authorisation requirements also apply.

Locations and international transfers

Enigma will process Customer Data only in locations authorised in the Engagement Record, including remote access and subprocessor locations. A location listed for website enquiries is not automatic authorisation for customer service data.

Before a restricted transfer, the parties must ensure that the applicable lawful mechanism covers the exporter, importer, data, purpose and onward processing. Where contractual transfer clauses are needed, the parties will conclude the appropriate official clauses, completed annexes and any required additional measures before the transfer begins. Applicable transfer assessments and continuing safeguards must be maintained. Enigma will notify the Customer if it can no longer meet those requirements and suspend the affected transfer until a lawful solution is available.

This DPA is not itself an international-transfer instrument and does not claim that EU, UK, DIFC or other standard transfer clauses have been executed. Mandatory transfer clauses prevail over inconsistent terms. Enigma will refer legally binding disclosure demands concerning Customer Data to the Customer where permitted, assess their validity, challenge them where legally justified and disclose only what it is legally required to disclose.

Information and audits

Enigma will make available the information necessary to demonstrate compliance and allow and contribute to audits and inspections by the Customer or its independent auditor. Reasonable confidentiality, notice and security arrangements may protect other customers and systems, but must not prevent an effective audit, urgent investigation or regulator access. Existing independent assurance reports may assist a review but do not replace audit rights required by law.

Enigma will promptly tell the Customer if it can no longer comply with this DPA or applicable processor requirements. The Customer may take reasonable steps to verify, stop and remedy unauthorised use and may suspend affected processing. Material or persistent non-compliance that cannot be remedied permits the Customer to terminate the affected processing, without limiting mandatory remedies.

Return and deletion

At the Customer’s choice, Enigma will return or delete Customer Data without undue delay when the services end or on a lawful instruction, and delete remaining copies, unless retention is required by the law recognised for that purpose under the applicable data-protection regime, including Union or Member State law for GDPR processing and UK law for UK GDPR processing. Enigma will assist with a secure return in a reasonably usable format and confirm completion on request. The obligation extends to authorised subprocessors and backup copies; the website’s general retention periods do not override the Customer’s instructions or applicable law.

Where legally permitted technical arrangements require a limited backup deletion cycle, that cycle and its safeguards must be agreed in writing. Residual copies must remain isolated from ordinary use, protected and deleted on that cycle, with deletions reapplied before any restored data returns to use. A backup cycle does not extend a statutory deletion deadline. Where the law requires retention, Enigma will identify the requirement where permitted, retain only the necessary information for that requirement and continue to protect it until deletion. This DPA remains applicable while Enigma holds Customer Data.

Applicable law and priority

Applicable data-protection law includes applicable United States federal and state privacy laws, including New Mexico law, and other mandatory privacy or sector rules to the extent they govern the processing. This DPA does not waive protections under the EU GDPR, UK, DIFC, US state or other applicable law. Terms such as controller, processor, personal data and breach have the meanings given by the relevant law.

New Mexico law and applicable United States federal law govern this DPA and the competent state or federal courts in New Mexico have jurisdiction, subject to mandatory law and the separate law and jurisdiction of any required transfer clauses. In a conflict concerning Customer Data, mandatory law and applicable transfer clauses take priority, then this DPA over general service terms. A separately agreed processing amendment may provide more specific protections without reducing mandatory requirements. Contract terms cannot remove an individual’s or regulator’s statutory rights or liabilities that cannot lawfully be limited.

Contact and versions

Privacy and incident coordination: privacy@getenigmalabs.com. Service support: support@getenigmalabs.com.

The version incorporated into the service agreement applies to that engagement. A later website update does not automatically amend an existing DPA. Changes require agreement in writing or another valid change mechanism in the service agreement that preserves mandatory protections. Existing signed agreements and historical responsibilities are not transferred by the domain migration.