Data Processing Agreement

1. Who This Is For

This agreement (the "DPA") is part of the Terms of Service between BOL Group LLC ("we") and each business using the Platform ("you"). It covers the personal data inside the data you upload, store or connect ("your data"). For that data you are the controller and we are your processor. Need a signed copy? Email support@bolgroupglobal.com.

2. What We Do With Your Data

• We process your data only to provide the Platform, and only on your documented instructions (using the Platform is one).
• We never sell it, use it for advertising, or use it to train AI models.
• Everyone at BOL Group LLC and every consultant who can reach it is bound to keep it confidential.
• Kinds of data: whatever your files and tools contain, usually customer, sales, employee and financial records. Whose: your customers, staff and contacts. How long: while your account is open, unless you delete it sooner.

3. Security

We keep the safeguards described on our Security page (the Annex to this DPA), including encryption in transit and at rest, access limited by role, two-step sign-in for staff, and checks on every change. We may improve them, but never lower their overall level.

4. Service Providers (Sub-processors)

You allow us to use the providers listed on Service Providers. Each is bound by terms at least as protective as this DPA. We'll tell you at least 30 days before adding one; if you object for a reasonable data protection reason and we can't solve it, you may end the affected service and get a refund of what you prepaid for it.

5. Helping You Meet Your Duties

• People's requests (to see, correct or delete their data): the Platform lets you download, change and delete your data yourself; we help with anything else, and pass on any request sent to us by mistake.
• Breaches: we tell you without undue delay, and within 48 hours of confirming a breach of your data, with what we know, so you can meet your own deadlines (72 hours under GDPR). We keep you updated and work to contain it.
• Assessments and audits: we give you the information you reasonably need, including our providers' audit reports, and answer security questionnaires once a year.

6. Moving Data Between Countries

We are in the United States and so are our main servers. For data from the EU, EEA or Switzerland, the European Commission's Standard Contractual Clauses (2021/914; Module Two, controller to processor, and Module Three, processor to processor) are part of this DPA, with you as the data exporter and us as the importer; for the UK, the UK International Data Transfer Addendum applies too. Where another country requires its own approved clauses, those apply in the same way.

7. When It Ends

You can download your data at any time, and delete it yourself. When your account is closed we delete your data within 30 days, except what the law makes us keep (such as billing records), which stays protected by this DPA.

8. Everything Else

If this DPA and the Terms disagree about personal data, this DPA wins (and the Standard Contractual Clauses win over both). Limits of liability in the Terms apply to this DPA. Healthcare businesses storing patient information also sign a separate Business Associate Agreement.