Effective January 1, 2026

Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Master Services Agreement ("MSA") between deverus, Inc. ("Processor") and Customer ("Controller"). This DPA reflects the parties' agreement regarding the processing of personal data in connection with the Services.

1. Definitions

  • "Personal Data," "Processing," "Controller," "Processor," "Sub-processor," and "Data Subject" have the meanings given in the GDPR or, where applicable, equivalent U.S. state privacy laws.
  • "Customer Personal Data" means Personal Data contained in Customer Data that deverus processes on behalf of Customer.
  • "Data Protection Laws" means all laws applicable to the processing of Personal Data, including the GDPR, UK GDPR, CCPA/CPRA, and the FCRA where it applies to Customer's use of the Services.

2. Roles and Scope

With respect to Customer Personal Data, Customer is the Controller and deverus is the Processor. deverus will process Customer Personal Data only on documented instructions from Customer, including those reflected in the MSA and applicable Order Forms, and as necessary to provide and improve the Services.

3. Subject Matter and Duration

  • Subject matter: provision of the Services, including coordination, automation, and execution of CRA operational workflows.
  • Duration: the term of the MSA and any post-termination period during which deverus retains Customer Personal Data in accordance with the MSA.
  • Nature and purpose: hosting, processing, and transmitting Customer Personal Data to deliver the Services and any associated support.
  • Categories of Data Subjects: Customer's applicants, employees, end users, and any individuals whose Personal Data is included in Customer Data.
  • Categories of Personal Data: identifiers, contact information, employment and education history, criminal records, motor vehicle records, credit data (where ordered by Customer), and other data necessary for background screening workflows.

4. Customer Obligations

  • Customer warrants that it has obtained all necessary consents, notices, and lawful bases required to provide Customer Personal Data to deverus and to instruct the processing.
  • Customer is responsible for FCRA-required adverse action procedures, dispute handling, and consumer disclosures.

5. Confidentiality and Personnel

deverus will ensure that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and receive training on data protection.

6. Security Measures

  • deverus implements and maintains appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, and unauthorized access.
  • Measures include: encryption in transit and at rest, role-based access controls, audit logging of administrative actions, segregation of customer environments, regular vulnerability scanning, and an incident response program.
  • deverus's Human-in-the-Loop architecture ensures that automated proposals are reviewed by authorized personnel before sealed workflow outputs are produced.

7. Sub-processors

  • Customer authorizes deverus to engage Sub-processors to provide the Services, including cloud hosting, email delivery, and infrastructure providers.
  • deverus maintains a current list of Sub-processors available on request and will provide reasonable notice of any new Sub-processor before authorizing it to process Customer Personal Data.
  • deverus remains responsible for Sub-processor performance and will impose data protection obligations on Sub-processors no less protective than those in this DPA.

8. Data Subject Rights

deverus will reasonably assist Customer in responding to verifiable Data Subject requests to exercise rights under applicable Data Protection Laws (access, correction, deletion, restriction, portability, and objection), to the extent Customer cannot fulfill such requests through the Services itself.

9. Personal Data Breach Notification

deverus will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide information reasonably necessary to enable Customer to meet its breach notification obligations.

10. Data Protection Impact Assessments

deverus will provide Customer with reasonable cooperation and information to support Customer's data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of processing and the information available to deverus.

11. International Transfers

Where Customer Personal Data originating in the EEA, UK, or Switzerland is transferred to deverus in the United States or another third country, the parties agree to rely on the European Commission's Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA) as applicable, which are incorporated into this DPA by reference.

12. Audits

deverus will make available to Customer information reasonably necessary to demonstrate compliance with this DPA. Where required by Data Protection Laws, Customer may, on at least thirty (30) days' written notice and no more than once per year (except for cause), conduct an audit at its expense, subject to deverus's reasonable security and confidentiality requirements.

13. Return or Deletion

Upon termination of the MSA, deverus will, at Customer's option, return or delete Customer Personal Data within ninety (90) days, except to the extent retention is required by law or for legitimate compliance purposes (e.g., audit trails, dispute records).

14. Governing Terms

This DPA is incorporated into and forms part of the MSA. In the event of any conflict between this DPA and the MSA with respect to processing of Personal Data, this DPA controls.

15. Contact

Data protection inquiries: privacy@deverus.com. deverus, Inc., 4833 Spicewood Springs Rd., Suite 102, Austin, TX 78759.

Questions? Contact us at legal@deverus.com.

Privacy PolicyFair Use PolicyMaster Services AgreementData Processing Addendum