Data Processing Agreement (DPA)

Last updated: 9/29/2026


This Data Processing Agreement (“Agreement”) forms part of the Terms of Service between Veritas Software, located at Scottsdale, AZ, USA (“Processor”), and the customer (“Controller”) who uses the services provided through Automated-Agent (“Services”).

This Agreement governs the processing of Personal Data as required under applicable privacy laws, including the EU General Data Protection Regulation (“GDPR”), the California Privacy Rights Act (“CPRA”), and any similar data protection legislation (“Applicable Law”).

1. Definitions

  • “Controller” means the entity that determines the purposes and means of processing Personal Data.
  • “Processor” means Veritas Software, which processes Personal Data on behalf of the Controller.
  • “Personal Data” means any information relating to an identified or identifiable natural person.
  • “Services” means the software, platform, and related services provided by Veritas Software.
  • “Sub‑processor” means any third party engaged by the Processor to assist in processing Personal Data.

2. Roles and Responsibilities

The Controller determines the nature, purpose, and legal basis for processing Personal Data. The Processor processes Personal Data only on documented instructions from the Controller.

3. Scope of Processing

The Processor may process Personal Data for the following purposes:

  • account creation and authentication;
  • service functionality and platform operations;
  • customer support and communication;
  • security, fraud prevention, and system integrity;
  • data storage and backup;
  • other purposes explicitly authorized by the Controller.

The Processor will not process Personal Data for any purpose other than those documented by the Controller.

4. Processor Obligations

The Processor agrees to:

  • process Personal Data only on documented instructions from the Controller;
  • ensure personnel authorized to process Personal Data are bound by confidentiality;
  • implement appropriate technical and organizational security measures;
  • assist the Controller with data subject requests under Applicable Law;
  • notify the Controller of any Personal Data breach without undue delay;
  • maintain records of processing activities as required by law;
  • delete or return Personal Data upon termination of Services, unless retention is required by law.

5. Sub‑processors

The Controller authorizes the Processor to engage Sub‑processors as necessary to provide the Services. The Processor will ensure Sub‑processors are bound by data protection obligations equivalent to those in this Agreement.

A current list of Sub‑processors is available upon request from our contact us page.

6. International Transfers

If Personal Data is transferred outside the Controller’s jurisdiction, the Processor will ensure appropriate safeguards are in place, including Standard Contractual Clauses or other lawful transfer mechanisms.

7. Security Measures

The Processor will implement industry‑standard security measures appropriate to the risk, including:

  • encryption in transit and at rest;
  • access controls and authentication;
  • audit logging and monitoring;
  • regular security assessments;
  • data backup and recovery procedures.

8. Personal Data Breach

In the event of a Personal Data breach, the Processor will notify the Controller without undue delay and provide relevant information to support the Controller’s legal obligations.

9. Assistance with Compliance

The Processor will assist the Controller in meeting obligations under Applicable Law, including:

  • responding to data subject access requests;
  • conducting data protection impact assessments;
  • consultations with supervisory authorities.

10. CPRA Service Provider Requirements

For California residents, the Processor agrees:

  • not to sell or share Personal Data;
  • not to use Personal Data for cross‑context behavioral advertising;
  • not to retain, use, or disclose Personal Data outside the scope of the Services;
  • to comply with all CPRA service provider obligations.

11. Term and Termination

This Agreement remains in effect as long as the Processor processes Personal Data on behalf of the Controller. Upon termination of Services, the Processor will delete or return Personal Data unless retention is required by law.

12. Governing Law

This Agreement is governed by the laws of contact us, without regard to conflict‑of‑law principles.

13. Contact Information

For questions regarding this Agreement, please contact us.