Data Processing Agreement

Parties and scope

This Data Processing Agreement forms part of the agreement between the customer identified in the applicable order or statement of work (Controller) and Lucido LLC, operating Auditbahn (Processor).

It applies when Auditbahn processes personal data on the customer’s documented instructions while delivering managed compliance services.

Processing description

• Activities: GRC configuration and operation, control and evidence workflows, access and vendor reviews, policy administration, remediation follow-up, audit preparation, and related support.
• Duration: The term of the services and any period required to return or delete data.
• Data subjects: Customer personnel, contractors, users, vendor contacts, customer contacts, and people incidentally referenced in compliance records.
• Data: Business contact details, roles, identifiers, review records, vendor information, acknowledgements, support communications, and customer-selected evidence.
• Sensitive data: Not intended unless expressly agreed and documented.

Core processor obligations

Auditbahn processes personal data only for the contracted services and on documented instructions, unless applicable law requires otherwise. Authorised personnel are subject to confidentiality obligations and receive access only where required for the engagement.

Auditbahn assists with data subject requests, security obligations, breach assessment, data protection impact assessments, and regulatory consultations, taking into account the nature of the processing and the information available.

Providers and customer-selected systems

Auditbahn subprocessors are identified in the completed service-provider schedule. Providers contracted directly by the customer, including GRC, identity, ticketing, document, communication, cloud, and AI providers, remain providers to the customer merely because Auditbahn personnel use them under customer instructions.

Security, incidents, and deletion

The baseline security measures are described in the Security and Data Handling document and completed for the engagement.

Auditbahn notifies the customer without undue delay after becoming aware of a personal data breach affecting customer data and provides available information needed for assessment and notification.

At the end of the services, Auditbahn returns or deletes personal data at the customer’s choice unless applicable law requires continued storage. The engagement documents must define deletion mechanics, backup treatment, and any required retention.

International transfers

Auditbahn-controlled systems are hosted in Hetzner’s Falkenstein, Germany location by default. Other locations, including locations outside the EEA, are available on documented customer request.

Where GDPR-regulated personal data is transferred to Lucido LLC in the United States or otherwise processed outside the EEA, the Data Transfer Addendum records the transfer and applicable safeguard. The parties may incorporate the European Commission Standard Contractual Clauses where appropriate. The applicable module, parties, processing details, supervisory authority, providers, locations, and technical measures must be completed for the engagement.

Request an execution copy

Contact [email protected] to review and complete the DPA and, where applicable, the DTA for an engagement.