Data Processing Agreement (DPA)

Last updated: July 19, 2026

This Data Processing Agreement (“DPA”) is intended for EU/EEA clients and applies where Bit Apps LLC processes personal data on behalf of a client as a processor under the General Data Protection Regulation (GDPR).

1. Definitions

• GDPR means the General Data Protection Regulation (EU) 2016/679.
• Personal Data means any information relating to an identified or identifiable natural person.
• Processing means any operation performed on Personal Data, including collection, storage, use, transfer, or deletion.
• Data Subject means the individual to whom Personal Data relates.

2. Scope and Purpose

The Processor shall process Personal Data on behalf of the Controller solely for the purpose of providing mobile application development and related IT services as agreed in the Master Services Agreement between the parties.

3. Processor's Obligations

Bit Apps LLC agrees to:

• Process Personal Data only on documented instructions from the Controller
• Ensure confidentiality of all personnel authorized to process Personal Data
• Implement appropriate technical and organizational security measures
• Assist the Controller in responding to Data Subject requests
• Notify the Controller without undue delay upon becoming aware of a Personal Data breach
• Maintain records of all processing activities
• Cooperate with supervisory authorities as necessary

4. Sub-Processing

The Processor may engage third-party sub-processors only with the prior written consent of the Controller. The Processor shall ensure that any sub-processor agrees to obligations equivalent to those in this Agreement and shall remain fully liable for the performance of sub-processors.

5. Data Security Measures

The Processor implements the following security measures:

• Encryption of data in transit and at rest
• Access controls and authentication protocols
• Regular security assessments and audits
• Secure development practices
• Incident response and breach notification procedures

6. Data Subject Rights

The Processor shall assist the Controller in fulfilling Data Subject requests, including access, rectification, erasure, restriction of processing, data portability, and objection.

7. Data Breach Notification

The Processor shall notify the Controller within 72 hours of becoming aware of any Personal Data breach that may affect the Controller's data.

8. International Transfers

Any transfer of Personal Data to a third country shall be subject to appropriate safeguards, including Standard Contractual Clauses (SCCs) or adequacy decisions where applicable.

9. Data Retention and Deletion

Personal Data shall be retained only for as long as necessary to fulfill the purposes for which it was collected. Upon termination of services or upon the Controller's request, the Processor shall delete or return all Personal Data and provide written confirmation of deletion, unless retention is required by law.

10. Audits and Inspections

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this Agreement and shall allow for audits conducted by the Controller or an auditor mandated by the Controller.

11. Governing Law

This Agreement shall be governed by and construed in accordance with applicable law, without reference to any specific jurisdiction's conflict-of-laws rules. GDPR obligations applicable to the processing of personal data of EU Data Subjects shall be observed.

12. Contact

Bit Apps LLC
Attn: Data Protection Officer
Email: contact@bitapps-dev.online