Trust Center · Data Processing Agreement
Data Processing Agreement
Our standard DPA aligns with GDPR Article 28 and CCPA service-provider requirements.
DPA highlights
- Customer is data controller; earthmove is data processor
- Confidentiality + appropriate technical & organizational measures (TOMs)
- Subprocessor list with 30-day notice for additions; customer right to object
- Data subject rights assistance within 30 days (Articles 15-22)
- Data breach notification within 72 hours of confirmation
- Standard Contractual Clauses (SCC) included for non-US transfers
- Audit rights: annual SOC 2 report when available + on-request CAIQ Lite
- Data deletion / return at end of services (30 days)
Execute a DPA
For enterprise customers (Pro tier or higher), we execute a DPA at no additional cost.