Data Processing Addendum

 (Updated October 12, 2026)

This Data Processing Addendum (“DPA“) amends the terms and conditions set forth in the Pay Parity® Master Services Agreement and any riders or amendments thereto and the Terms of Service (collectively, “Agreement”) between First Capitol Consulting, Inc. dba Trusaic (“Trusaic”) and the client (“Client”), and shall be effective on the Effective Date of the AGREEMENT and terminate with the term of the Agreement.  In the event of a conflict between the DPA and the Agreement, the DPA shall control.  All capitalized terms not defined in this DPA shall have the meanings set forth in the AGREEMENT. 

Unless otherwise agreed to in writing under the AGREEMENT, Trusaic will periodically update this DPA, located at https://trusaic.com/terms-of-service/.   

 

1. Definitions and Interpretation

1.1 Unless otherwise defined herein, capitalized terms and expressions used in this DPA shall have the following meaning:

1.1.1 “Client Personal Data” means any Personal Data Processed by the Processor on Controller’s behalf pursuant to or in connection with an AGREEMENT;

1.1.2 “Controller” means Client with Client Personal Data for Data Processing;

1.1.3 “Processor” means Trusaic pursuant to an Agreement to Process Client Personal Data;

1.1.4      “GDPR” means EU General Data Protection Regulation 2016/679;

1.1.5 “Data Protection Laws” means EU Directive 95/46/EC, as transposed into domestic legislation of each Member State and as amended, replaced or superseded from time to time, including by the GDPR and laws implementing or supplementing the GDPR, the UK General Data Protection Regulation (UK GDPR), and to the extent applicable, the data protection or privacy laws of any other country;

1.1.6    “EEA” means the European Economic Area;

1.1.7    “Data Transfer” means:

1.1.7.1 a transfer of Client Personal Data from Controller to a Processor; or

1.1.7.2 an onward transfer of Client Personal Data from a Processor to a Subcontracted Processor, if any, or between two establishments of a Processor, in each case, where such transfer would be prohibited by Data Protection Laws (or otherwise restricted under the AGREEMENT);

1.1.8    “Services” means the services identified in the Agreement.

1.1.9    “Subprocessor” means any person appointed by or on behalf of Processor to process Client Personal Data on behalf of Controller in connection with the Agreement.

1.1.10  “Standard Contractual Clauses” or “SCC” means the European Commission’s standard contractual clauses for the transfer of personal data from the European Union to third countries (Module One/Two/Three/Four), as set out in the Annex to Commission Decision (EU) 2021/914.

1.2 The terms, “Commission“, “Data Subject“, “Member State“, “Personal Data“, “Personal Data Breach“, “Processing” and “Supervisory Authority” shall have the same meaning as in the GDPR, and their related terms shall be construed accordingly.

2. Processing of Client Personal Data

2.1 Processor shall:

2.1.1 comply with all applicable Data Protection Laws in the Processing of Client Personal Data on behalf of Client; and

2.1.2 not process Client Personal Data other than on Controller’s documented instructions.

2.2 Controller instructs Processor to process Client Personal Data to provide the services set forth in the AGREEMENT.

3. Processor Personnel

Processor shall take reasonable steps to ensure the reliability of any employee, agent or contractor of any Processor who may have access to Client Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know/access the relevant Client Personal Data, as strictly necessary for the purposes of the AGREEMENT, and to comply with all applicable Data Protection Laws in the context of that individual’s duties to the Processor, ensuring that all such individuals are subject to confidentiality obligations.

4. Data Processing and Security

4.1 Taking into account the industry standard, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Processor shall, in relation to the Client Personal Data, implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR and in Annex II.

4.2 In assessing the appropriate level of security, Processor shall take account in particular of the risks that are presented by Processing, in particular from a Personal Data Breach.

4.3 The Processing performed by the Processor on behalf of the Controller relates to the services under the AGREEMENT. Further details on International Transfers of Personal Data are located at Trusaic’s Privacy Policy at https://trusaic.com/privacy-policy/.

5. Subprocessing

Processor shall not appoint (or disclose any Client Personal Data to) any Subprocessor unless required or authorized by Controller.

6. Data Subject Rights

6.1 Taking into account the nature of the Processing, Processor shall assist Controller by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Controller obligations, as reasonably understood by Controller, to respond to requests by Data Subject to Processor to exercise Data Subject rights under the Data Protection Laws.

6.2 Processor shall:

6.2.1 promptly notify Controller if it receives a request from a Data Subject under the Data Protection Laws in respect of Client Personal Data; and

6.2.2 ensure that Processor respond to that request only pursuant to the documented instructions of Controller or as required by the Data Protection Laws to which the Processor is subject, in which case Processor shall to the extent permitted by the Data Protection Laws inform Controller of that legal requirement before the Processor responds to the request.

7. Personal Data Breach

7.1 Processor shall notify Controller of any Personal Data Breach without undue delay and no later than seventy-two (72) hours after becoming aware.  Processor shall notify Controller with sufficient information to allow Controller to meet an obligation to inform Data Subjects of the Personal Data Breach under the Data Protection Laws.

7.2 Processor shall cooperate with Controller and take reasonable commercial steps as are directed by Controller to assist in the investigation, mitigation and remediation of each such Personal Data Breach.

8. Data Protection Impact Assessment and Prior Consultation

Processor shall provide reasonable assistance to Controller with any data protection impact assessments, and prior consultations with Supervising Authorities or other competent data privacy authorities, which Controller reasonably considers to be required by Article 35 or 36 of the GDPR, in each case solely in relation to Processing of Client Personal Data by, and taking into account the nature of the Processing and information reasonably available to, the Processors.

9. Deletion or return of Client Personal Data

9.1 Subject to this section 9, Processor shall promptly and in any event within sixty (60) business days of the date of termination of the AGREEMENT (the “Termination Date”), delete and procure the deletion of all copies of those Client Personal Data that is not subject to the Processor’s legal document retention obligations.

9.2 Upon written request by Controller, Processor shall provide written certification of compliance to Controller.

10. Audit rights

10.1 Subject to this section 10, Processor shall make available to Controller on request all information necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits, including inspections, by Controller or an auditor mandated by Controller in relation to the Processing of the Client Personal Data by the Contracted Processors.

10.2 Information and audit rights of Controller only arise under section 10.1 to the extent that the DPA does not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Laws.

11. Data Transfer

11.1 The Processor may not transfer or authorize the transfer of Data to countries outside the EU and/or the European Economic Area (EEA) without the prior written consent of Controller. Processor and Controller agree that the Personal Data Processed under the AGREEMENT, while physically located in the EU, may be accessed by Processor from its headquarters in Los Angeles. 

11.2 The Parties agree that to the extent the GDPR categorizes such access as an international data transfer and for any other transfer of Personal Data from the EU, the EEA, Switzerland, and/or the United Kingdom (UK), such transfer shall be conducted in reliance upon the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the Swiss-U.S. Data Privacy Framework, and/or the UK Extension to the EU-U.S. DPF (as applicable). Processor represents and warrants that: (a) it is currently self-certified and participating in the DPF program as administered by the U.S. Department of Commerce and (b) its certification covers the scope of Personal Data Processed under the AGREEMENT. 

11.3 For as long as the Processor maintains a valid DPF certification, the Parties agree that the SCCs or the UK Addendum to the SCCs (as applicable) shall not be required to authorize the transfer. The DPF certification provides adequate protection in accordance with the adequacy decisions issued by the European Commission, the Swiss Council, and the UK government. In the event the Processor’s DPF certification is withdrawn, lapses, or the DPF is otherwise not available as a legal transfer mechanism, the Parties agree that the SCC shall automatically be incorporated into the DPA. 

11.4 The SCC published on June 4, 2021, can be found here. https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en.  Should the EU regulatory authority update the language of the SCC after the execution of the DPA, the Parties agree that any amendments to the SCC shall be deemed incorporated into the DPA to the extent necessary to continue to comply with the EU rules regarding data transfers.

12. Governing Law and Jurisdiction

12.1 This DPA is governed by the law of the state of residence of the Controller. Where such law does not allow for third-party beneficiary rights, they shall be governed by the law of another EU Member State that does allow for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.

12.2 Any dispute arising in connection with this DPA, which the Parties will not be able to resolve amicably, will be submitted to the exclusive jurisdiction of the courts of Ireland.

 

 

 

ANNEX I

1.   LIST OF PARTIES

Data exporter(s): 

Name: As set forth in the Master Services Agreement.

Address: As set forth in the Master Services Agreement.

Contact person’s name, position and contact details: As set forth in the Master Services Agreement; absent designation therein, Client’s notices contact under the Agreement.

Activities relevant to the data transferred under these Clauses: Please see processing operations set forth in the Master Services Agreement.

Role (controller/processor): Controller 

Data importer(s): 

Name: First Capitol Consulting, Inc. d.b.a. Trusaic

Address: 520 S Grand Ave, Suite 200, Los Angeles, CA 90071

Contact person’s name, position and contact details: Trusaic Information Security team, [email protected]

Activities relevant to the data transferred under these Clauses: Please see processing operations set forth in the Pay Parity® Master Services Agreement.

Role (controller/processor): Processor

1.   DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred

• Client’s global employees

Categories of personal data transferred

• First & Last Name; Alias; Postal Address; Telephone number; Unique personal identifier; Social Security number (or equivalent); Financial information; Geolocation data; Professional or employment-related data; Compensation; Date of Birth; Gender; additional personal or position data.

Sensitive data transferred (if applicable).

• To the extent applicable racial or ethnic origin; sexual orientation; trade-union membership.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

• Client Personal Data is transferred on a continuous basis.

Nature of the processing

• Nature of the processing includes but is not limited to receiving Client Personal Data, storing Client Personal Data, using Client Personal Data, for analyzing, consultation, and testing purposes, and returning Client Personal Data to Client.

Purpose(s) of the data transfer and further processing

• To provide and receive services under the Master Services Agreement between Trusaic and Client.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

• Client Personal Data is retained for the period necessary for such Data to be used in connection with the relevant services, or as otherwise required under applicable law.

For transfers to Subprocessors, also specify subject matter, nature and duration of the processing

• Subprocessor Name: Microsoft Azure
• Subject Matter: Client’s global employees
• Nature of the Processing: Storage
• Duration of the Processing: Client Personal Data is processed for the period necessary for such Data to be used in connection with the relevant services, or as otherwise required under applicable law.

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

EXPLANATORY NOTE:

The technical and organisational measures must be described in specific (and not generic) terms. See also the general comment on the first page of the Appendix, in particular on the need to clearly indicate which measures apply to each transfer/set of transfers.

Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

Examples of possible measures:

Measures of pseudonymisation and encryption of personal data

• Trusaic stores data (archives and disk and data system backups) using strong encryption techniques with a minimum of Advanced Encryption Standard with a 256-bit key size (AES-256).
• Trusaic encrypts data and confidential information prior to moving and/or using encrypted connections (HTTPS, TLS, FTPS, etc.) to protect the information in transit.
• Trusaic encrypts all devices to meet Bitlocker or equivalent disk encryption solution for all devices used to handle Client Personal Data.
• Trusaic does not use Client Personal Data in development or test environments unless no alternative exists, in which case Client Personal Data is anonymized.

Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services

• Trusaic implements appropriate back-up, disaster recovery and business resumption plans that are aligned to ISO 22301 to enable recovery from events that impact Trusaic’s ability to perform in accordance with the Agreement.  These plans include defined criteria to determine if a system is critical to the operation of Trusaic’s business and its prioritization for recovery.  Trusaic regularly (and no less than annually) tests these plans and makes changes as needed based on its risk assessments and testing to ensure that they are up to date and effective. 
• Trusaic logs data restoration efforts, including the person(s) responsible, the description of the restored data and where applicable, the person(s) responsible and which Client Personal Data were input manually in the data recovery process.

Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

• Trusaic enforces data backups using an automated system, with full-system backups performed at least on a daily basis. Backups are replicated to a secondary server daily, and data stored on the Trusaic platform is configured to be geo-redundant backup storage.
• Backup verification is configured to be performed on all backups, and failed verification test notifications are sent to Trusaic’s IT provider for monitoring.
• Trusaic’s redundancy solutions replicate production systems and data in real-time, helping Trusaic meet system and data recovery commitments.

Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing

• Trusaic undertakes and documents network assessments, change logs and scan results.
• Trusaic performs annual penetration tests on Trusaic’s systems and infrastructure and facilities in accordance with Trusaic’s policies and industry-leading cybersecurity.
• Trusaic performs weekly scanning of operating systems, databases, server applications and network devices for vulnerability and configuration compliance.  Trusaic agrees to share with Client the information related to these tests to the extent applicable to the Services
• Trusaic reviews the security of applications processing Client Personal Data including automated and manual testing for common vulnerabilities.
• Trusaic maintains a policy for its mobile devices containing Client Personal Data that, at a minimum, enforces device encryption and prohibits use of blacklisted applications and enrollment of mobile devices that have been “jail broken.”

Measures for user identification and authorisation

• Trusaic has strict and granular access control, identification and lockout procedures.
• Trusaic has an established process to review user access to Client Personal Data, including clearly defined user roles and procedures to approve and justify roles.  Trusaic enforces access and confidentiality restrictions through disciplinary measures.
• Trusaic has documented password management practices designed to maintain the confidentiality and integrity of passwords when they are assigned and distributed; monitor repeated attempts to gain access to its information systems using an invalid password; deactivate authentication credentials upon notification that access is no longer needed (e.g. employee termination, project reassignment, etc.); deactivate passwords that are corrupted or inadvertently disclosed; ensure that de-activated or expired identifiers and/or passwords are not granted to other individuals; deactivate authentication credentials when not used for a period not to exceed 90 days; and ensure that where more than one individual has access to its systems containing Client Personal Data, the individuals have unique identifiers/log-ins (i.e., no shared ids).
• Trusaic enforces “least privilege” by restricting access to Client Personal Data to those individuals who require access to perform their job functions and supporting segregation of duties between its environments so that no individual person has access to perform tasks that create a security conflict of interest (e.g., developer/ reviewer, developer/tester).
• Trusaic instructs its personnel to disable administrative sessions when leaving premises or when computers are otherwise left unattended.

Measures  for the  protection of data during transmission and storage

• Trusaic encrypts all Client Personal Data both at rest and in transit. Data at rest is encrypted using AES-256, and encryption keys are managed securely by Microsoft. Data in transit is encrypted using TLS 1.2 or higher. All scoped data sent or received electronically is encrypted in transit, including when outside the network, using a minimum of TLS 1.2+. Communication is authorized, and all personal data is encrypted during transmission and at rest. Email communications utilize gateway-to-gateway encryption (TLS). Data integrity checks are implemented to prevent data manipulation or corruption.

Measures  for  ensuring  physical  security of  locations  at  which personal  data  are processed

• Trusaic maintains commercially-reasonable security systems and processes  at all Trusaic facilities at which information systems that use or store Client Personal Data are located, such as allowing only authorized individuals to access its facilities; maintaining records of the incoming and outgoing media containing Client Personal Data, including the kind of media, the authorized sender/recipients, date and time, the number of media and the types of Client Personal Data they contain.

Measures for ensuring events logging

• Trusaic utilizes AD Audit+ for log management and SIEM tools to aggregate and consolidate events. Trusaic also employs Datadog logging and SIEM tools for security-related logs from in-scope servers, applications, network devices, and security tooling. Trusaic maintains SIEM and logging tools for continuous monitoring and detection of potential vulnerabilities and threats.

Measures for ensuring system configuration, including default configuration

• Trusaic maintains secure, baseline configurations for hardware and network devices, including firewalls, switches, routers, and wireless access points. These configurations are documented and backed up to ensure disaster recovery and facilitate hardware replacement or reconfiguration. Additionally, enforcement through Group Policy objects helps dictate user environments and security standards, such as password policies and account lockout policies.

Measures for internal IT and IT security governance and management

• Trusaic maintains a Network Security Program as part of its Information Security Management System (ISMS), aligned with SOC 2 Type II and ISO 27001 standards. The program is governed through the IT Security Plan, reviewed annually by the Security/Privacy Officer, and approved by management. Network and system security are primarily enforced through Microsoft Azure’s compliant infrastructure, which provides secure connectivity controls. Trusaic supplements these with internal reviews, third-party penetration testing, and continuous monitoring via Azure Defender for Cloud and Datadog SIEM to ensure compliance and proactive risk management.

Measures for certification/assurance of processes and products

• Trusaic is US/EU Data Privacy Framework Certified. Additionally, Trusaic maintains SOC 2 Type 2 Certification and ISO 27001 Certification. Trusaic performs annual Penetration Testing to identify any security flaws.

Measures for ensuring data minimisation

• Trusaic conducts Data Protection Impact Assessments (DPIA) as part of its commitment to implementing a standard security framework, specifically ISO 27001. The process includes periodic assessments overseen by the Security/Privacy Officer, utilizing a Risk Assessment/Risk Treatment Tracker. The scope covers Data Protection Impact Assessments (DPIA), Privacy Impact Assessments (PIA), and other privacy risk assessments. The assessment process involves evaluating factors such as the nature and extent of data involved, unauthorized access, circumstances of incidents, and mitigation measures

Measures for ensuring data quality

• Trusaic provides guidance on validation and cleaning of data to ensure a clean accurate analysis as part of the implementation process. Trusaic’s system is designed to flag unusual data patterns or outliers that might indicate a data entry error or an underlying compliance issue.

Measures for ensuring limited data retention

• Trusaic purges personal data within sixty (60) days after client termination unless deletion is required sooner by written request or contract.

Measures for ensuring accountability

• Trusaic has a comprehensive data governance program in place, which includes a designated body accountable for defining and implementing administrative, technical, and physical safeguards for the protection of client-scoped data. Trusaic’s Third Party Risk Management Program ensures ongoing monitoring and risk assessment processes for third parties accessing its data.

Measures for allowing data portability and ensuring erasure

• Trusaic has formal data retention and disposal procedures to ensure the secure disposal of Client Personal Data.
• Trusaic maintains enforcement mechanisms to address privacy inquiries, complaints, disputes, and recourse for violations of privacy compliance. These procedures are designed to ensure that requests from individuals, including subject access, do not sell, rectification, erasure or deletion (the right to be forgotten), portability, and the right to restrict or object to certain processing, are appropriately addressed.

For transfers to Subprocessors, also describe the specific technical and organisational measures to be taken by the Subprocessor to be able to provide assistance to the controller

• The only Subprocessor engaged by Trusaic is Microsoft Azure, which serves as its cloud hosting provider. Trusaic has conducted impact or risk assessments regarding the transfer of data to subprocessors. To ensure Subprocessors comply with their data protection obligations, Trusaic’s contracts with Subprocessors require compliance with all applicable Data Protection Laws, mandate that the processor implements appropriate technical and organizational measures as outlined in Article 32(1) of the GDPR, and prohibits the use of personal data for the Subprocessor’s own purposes. Additionally, Trusaic’s processing agreements incorporate Standard Contractual Clauses for international transfers, and it maintains a process to conduct country or transfer impact assessments prior to enabling international transfers of personal data.

ANNEX III

LIST OF SUB-PROCESSORS

EXPLANATORY NOTE:

The Client has authorised the use of the following sub-processors:

Name: Microsoft Azure

Address: One Microsoft Way, Redmond, WA 98052, United States

Location of Processing:

• United States: Compute services are deployed in South Central US Azure Region (Texas), and the database resides in Central US (Iowa). The database is configured with geo-redundant backup replication to East US 2 Azure Region (Virginia).
• European Union: Compute and database resources are hosted in Germany West Central Azure region (Frankfurt). The database is configured with geo-redundant backups, paired with Germany North Azure Region (Berlin).

Contact person’s name, position and contact details: David Sheaffer, Digital Cloud Solution Architect, Small, Medium & Corporate; Email: [email protected]; Phone: (469) 775-0685.

Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorized): Storage of Client’s personal data.