This Data Processing Addendum ("DPA") supplements the agreement between BlueTier Operations LLC ("BlueTier", "we", "us") and the customer identified on the signature page ("Customer", "you") governing your use of the Black_Wall service (the "Service").
Capitalized terms used but not defined in this DPA have the meanings given in the underlying agreement. The following terms have the meanings set forth below:
The parties acknowledge that, with respect to Personal Data contained in Customer Data:
BlueTier will not (a) sell or share Personal Data within the meaning of CCPA/CPRA, (b) Process Personal Data for any purpose other than performing the Service, or (c) combine Personal Data received from Customer with Personal Data received from any other source, except as required by law.
Subject matter: the provision of pre-action risk evaluation (forecast and observe) as a service.
Duration: for the term of the underlying agreement plus any post-termination retention period set out in Section 09.
Nature and purpose: evaluating proposed actions submitted by Customer's agents, returning a structured risk verdict and a cryptographically signed receipt, and recording metadata about the evaluation for Customer's audit trail.
Categories of data subjects: end users of Customer's systems whose information may appear in Customer-submitted action payloads (e.g., email recipients, payment counterparties, database records).
Categories of Personal Data Processed:
The Service is not designed to receive special categories of data (Article 9 GDPR) or payment card data. Customer agrees not to knowingly submit such categories to the Service.
BlueTier implements and maintains appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, or damage. Current measures are documented at blackwalltier.com/security and include:
BlueTier will review and update these measures as the Service evolves and as new threats are identified. Material changes will be reflected at the URL above.
The current list of Sub-processors is published at blackwalltier.com/security and is incorporated into this DPA by reference. Customer authorizes BlueTier to use the Sub-processors listed there.
Changes: BlueTier will provide at least 30 days' notice of any addition or replacement of a Sub-processor, via the security page above or via direct notice to enterprise customers. Customer may object to a proposed Sub-processor on reasonable data protection grounds by emailing security@blackwalltier.com during the notice period; if the parties cannot reach a resolution, Customer may terminate the underlying agreement for the affected portion of the Service.
BlueTier remains responsible for the acts and omissions of its Sub-processors to the same extent as if those acts or omissions were its own.
Where Personal Data subject to GDPR or UK GDPR is transferred to a country outside the EEA or the UK that has not been recognized as providing an adequate level of protection, the parties agree that:
BlueTier will provide appropriate transfer-impact assessments and supplementary measures on request.
BlueTier will, taking into account the nature of the Processing, assist Customer by appropriate technical and organizational measures in fulfilling Customer's obligations to respond to requests from data subjects exercising their rights under Applicable Data Protection Law (access, rectification, erasure, restriction, portability, objection).
Where BlueTier receives a request directly from a data subject, BlueTier will (a) not respond substantively, (b) advise the data subject to contact Customer, and (c) promptly forward the request to Customer.
BlueTier will reasonably assist Customer with data protection impact assessments and prior consultations with supervisory authorities to the extent required under Applicable Data Protection Law.
BlueTier will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer's Personal Data. The notification will, to the extent then known, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it.
Notification is sent to the security contact on file for Customer; Customer is responsible for keeping that contact current.
On termination or expiry of the underlying agreement, and at Customer's choice, BlueTier will return or delete all Personal Data Processed on Customer's behalf, except where storage is required by applicable law or for the limited purpose of resolving outstanding claims.
Default behavior: account deletion (initiated by Customer or upon contract termination) triggers deletion of Customer's account profile, API keys, forecast metadata, and receipt envelopes within 30 days. Upstream Sub-processor retention windows (e.g., Anthropic's up-to-30-day abuse-monitoring window) run concurrently.
Backups containing Personal Data are overwritten in the ordinary course within 90 days; BlueTier will not restore from backup for the purpose of re-creating deleted Personal Data.
BlueTier will make available to Customer information necessary to demonstrate compliance with this DPA, including:
Customer may, no more than once per twelve (12) months and on at least 30 days' prior written notice, conduct or commission a third-party audit of BlueTier's compliance with this DPA, subject to mutually agreed scope, confidentiality, and reasonable cost-recovery terms. Audits will not unreasonably interfere with BlueTier's operations.
Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the underlying agreement.
This DPA survives termination of the underlying agreement for as long as BlueTier Processes Personal Data on Customer's behalf or retains the obligations set out in Section 09.
In the event of any conflict or inconsistency between this DPA and the underlying agreement with respect to Processing of Personal Data, this DPA prevails. The Standard Contractual Clauses prevail over any conflicting terms of this DPA.
This DPA is governed by and construed in accordance with the laws of the State of Nevada, United States, without regard to its conflict-of-laws principles, except that the SCCs are governed by the law of the EU Member State chosen in Clause 17 of the SCCs.
By signing below, the parties acknowledge that they have read and agree to this DPA.
Signature:
Name:
Title:
Date:
Email: security@blackwalltier.com
Signature:
Name:
Title:
Date:
Email: