Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement governing the Services between Time Seventeen Inc. (“Time Seventeen”) and the customer identified in that agreement (“Customer”). For purposes of Applicable Data Protection Law, Customer acts as the Data Controller and Time Seventeen acts as the Data Processor, except where the parties’ actual processing roles require otherwise.

1. Definitions

• “Applicable Data Protection Law” means the GDPR (EU) 2016/679 and any other privacy or data-protection law applicable to the Processing.
• “Personal Data” means information relating to an identified or identifiable natural person.
• “Processing” means any operation performed on Personal Data, whether automated or not.
• “Data Subject” means the identified or identifiable person to whom Personal Data relates.
• “Sub-processor” means a third party engaged by Time Seventeen to Process Personal Data on Customer’s behalf.
• “Services Agreement” means the agreement, order, or statement of work under which Time Seventeen provides Services to Customer.

2. Subject Matter

This DPA governs Time Seventeen’s Processing of Personal Data on Customer’s behalf in connection with the Services described in the Services Agreement.

3. Duration

This DPA remains effective for the duration of the Services Agreement and until Personal Data Processed on Customer’s behalf has been returned or deleted as required by this DPA.

4. Nature and Purpose

Processing may include collection, transmission, storage, organization, access, analysis, retrieval, consultation, modification, support, and deletion of Personal Data. The purpose of Processing is to provide, secure, support, and improve the Services and fulfill Time Seventeen’s obligations under the Services Agreement.

5. Data Subjects and Data

Data Subjects may include Customer’s employees, contractors, clients, users, counterparties, or other individuals whose Personal Data Customer provides or makes available through the Services. Personal Data may include names, email addresses, contact information, account identifiers, IP addresses, device and usage information, and other personal identifiers described in the Services Agreement.

Customer will not provide sensitive or special-category Personal Data unless the Services Agreement expressly authorizes it and the parties have agreed on appropriate safeguards.

6. Processor Obligations

Time Seventeen will:

• Process Personal Data only on Customer’s documented instructions, including instructions in the Services Agreement, unless otherwise required by law;
• ensure that personnel authorized to Process Personal Data are subject to appropriate confidentiality obligations;
• implement appropriate technical and organizational security measures;
• reasonably assist Customer in responding to Data Subject requests and meeting applicable security, breach-notification, impact-assessment, and regulatory-consultation obligations;
• maintain records of Processing where required by Applicable Data Protection Law; and
• notify Customer if, in Time Seventeen’s reasonable opinion, a documented instruction infringes Applicable Data Protection Law.

7. Sub-processors

Customer authorizes Time Seventeen to engage Sub-processors necessary to provide the Services. Time Seventeen will require each Sub-processor to protect Personal Data under written obligations materially consistent with this DPA and will remain responsible for the Sub-processor’s performance to the extent required by Applicable Data Protection Law.

Where required by law, Time Seventeen will provide notice of a new Sub-processor and a reasonable opportunity for Customer to object on legitimate data-protection grounds.

8. Data Subject Rights

Taking into account the nature of Processing, Time Seventeen will provide reasonable assistance through appropriate technical and organizational measures to help Customer respond to requests from Data Subjects exercising rights under Applicable Data Protection Law.

9. Data Transfers

Time Seventeen will not transfer Personal Data across borders unless the transfer is permitted by Applicable Data Protection Law. Where required, the parties will use an approved transfer mechanism, such as the European Commission’s Standard Contractual Clauses, together with supplementary measures appropriate to the transfer.

10. Security and Breach Notification

Time Seventeen will maintain commercially reasonable administrative, technical, and physical safeguards appropriate to the nature of the Personal Data and the risks of Processing. Time Seventeen will notify Customer without undue delay after becoming aware of a confirmed Personal Data breach affecting Personal Data Processed under this DPA and will provide information reasonably available to support Customer’s legal obligations.

11. Return or Deletion

Upon termination of the Services Agreement, Time Seventeen will, at Customer’s choice, delete or return Personal Data and delete existing copies unless applicable law requires storage. Data retained in routine backups will remain protected under this DPA and will be deleted in accordance with Time Seventeen’s ordinary retention cycle.

12. Audit Rights

Time Seventeen will make available information reasonably necessary to demonstrate compliance with this DPA. Customer may conduct an audit no more than once annually, unless required by a supervisory authority or following a confirmed Personal Data breach. Audits must be conducted on reasonable notice, during normal business hours, under appropriate confidentiality restrictions, and without unreasonable disruption to Time Seventeen’s operations.

13. Liability and Governing Law

Each party is responsible for damages arising from its violation of this DPA or Applicable Data Protection Law to the extent allocated under the Services Agreement and permitted by law. The governing-law and dispute-resolution provisions of the Services Agreement apply to this DPA unless Applicable Data Protection Law requires otherwise.

14. Miscellaneous

This DPA forms part of the Services Agreement. If there is a conflict regarding the protection of Personal Data, this DPA controls. Except as modified by this DPA, the Services Agreement remains in effect.

Questions about this DPA may be sent to quant@t17.capital.