Data Processing Agreement

1. Definitions

Capitalized terms used but not defined in this Data Processing Agreement (the "DPA") have the meanings given to them in the applicable master services agreement or Statement of Work. "Controller", "Processor", "Personal Data", "Processing", and related terms have the meanings given in applicable data protection laws, including the General Data Protection Regulation.

2. Scope and Processing Instructions

This DPA applies to all Processing of Personal Data performed by AZ12 GROUP LLC, as Processor, on behalf of the client, as Controller, in the course of the professional services provided under the applicable engagement. The client instructs AZ12 GROUP LLC to Process Personal Data solely as necessary to deliver the services and in accordance with this DPA and the applicable Statement of Work.

3. Obligations of Processor

AZ12 GROUP LLC shall:

• Process Personal Data only on documented instructions from the Controller.
• Ensure that authorized personnel are bound by confidentiality obligations.
• Implement appropriate technical and organizational measures to protect Personal Data, taking into account the state of the art and the risks presented.
• Assist the Controller in fulfilling its obligations under applicable law, including data subject rights requests and data protection impact assessments.

4. Sub-processors

AZ12 GROUP LLC may engage sub-processors. A current list of sub-processors is maintained and made available to Controllers upon request. AZ12 GROUP LLC shall impose on each sub-processor contractual obligations substantially equivalent to those set forth herein.

5. International Transfers

Where Personal Data is transferred internationally, the parties shall rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses, which are incorporated into this DPA by reference where applicable.

6. Personal Data Breach Notification

AZ12 GROUP LLC shall notify the Controller without undue delay upon becoming aware of a Personal Data Breach affecting the Controller's Personal Data and shall provide reasonable cooperation and information to assist the Controller in meeting its notification obligations.

7. Audits

Upon reasonable prior written notice, AZ12 GROUP LLC shall make available to the Controller information necessary to demonstrate compliance with this DPA, and shall allow for audits, including inspections, conducted by the Controller or an independent auditor, subject to reasonable confidentiality and security requirements.

8. Return or Deletion of Data

Upon termination of the services, AZ12 GROUP LLC shall, at the Controller's choice, return or delete all Personal Data Processed on the Controller's behalf, unless applicable law requires continued retention.

9. Liability

The liability of each party under this DPA shall be subject to the limitations and exclusions of liability set forth in the applicable master services agreement or Statement of Work.

10. Governing Law

This DPA is governed by the laws specified in the applicable master services agreement or Statement of Work. In the absence of such specification, this DPA is governed by the laws of the State of New Mexico, United States.

11. Annexes

Annex I (Description of Processing), Annex II (Technical and Organizational Measures), and Annex III (Approved Sub-processors) shall be provided in written form as part of the countersigned DPA.

A countersigned copy of this DPA will be provided upon written request following execution of a Master Services Agreement or Statement of Work. Contact: legal@az12group.com.