Data Processing Agreement

1. Definitions

This Data Processing Agreement ("DPA") governs the processing of personal data by Arkhived LLC ("Processor") on behalf of users ("Controller") in connection with the ABA Fieldwork Tracker service.

• Personal Data: Any information relating to an identified or identifiable natural person
• Processing: Any operation performed on personal data, including collection, storage, and deletion
• Controller: The entity that determines the purposes and means of processing personal data
• Processor: The entity that processes personal data on behalf of the controller

2. Scope and Purpose

This DPA applies to all personal data processed by Arkhived LLC in providing the ABA Fieldwork Tracker service. The purpose of processing is to enable users to track, manage, and document ABA fieldwork hours in compliance with BACB requirements.

3. Processing Activities

Arkhived LLC processes the following categories of personal data:

• User account information (name, email, credentials)
• Professional information (certification type, supervisor relationships)
• Fieldwork hour entries and documentation
• Usage data and platform interactions
• Technical data (IP address, device information)

4. Processor Obligations

Arkhived LLC agrees to:

• Process personal data only in accordance with Controller's instructions
• Implement appropriate technical and organizational measures to ensure data security
• Maintain confidentiality of personal data
• Assist Controller in responding to data subject requests
• Notify Controller of any data breaches without undue delay
• Allow Controller to audit processing activities
• Delete or return personal data upon termination of services

5. Security Measures

Arkhived LLC implements the following security measures:

• Encryption of data in transit (SSL/TLS) and at rest
• Access controls and authentication protocols
• Regular security assessments and updates
• Backup and disaster recovery procedures
• Employee training on data protection
• Incident response procedures

6. Sub-Processors

Arkhived LLC may engage sub-processors to assist in providing services. All sub-processors are bound by equivalent data protection obligations. Controller will be notified of any new sub-processors and may object within 30 days.

7. Data Subject Rights

Arkhived LLC will assist Controller in responding to data subject requests, including:

• Right of access
• Right to rectification
• Right to erasure
• Right to data portability
• Right to restrict processing
• Right to object to processing

8. Data Retention

Personal data will be retained only for as long as necessary to provide services or as required by law. Upon termination, data will be deleted or returned to Controller within 30 days, unless retention is required by law.

9. International Transfers

If personal data is transferred outside the EEA, appropriate safeguards will be implemented, including Standard Contractual Clauses approved by the European Commission.

10. Contact Information