Customer Data Processing Agreement

#

Three kinds of processing happen on the Platform, and the parties have a different role for each. This DPA deals with each separately.

Equatorium’s own processing of personal data for its business (for example, billing records, the security of the Platform, vetting sign-ups, and the operation of the Data Services) is described in the Privacy Policy and is not processing on the Agency’s behalf.

#

Capitalised terms not defined here have the meaning given in the Terms of Use. In this DPA:

• “Adequate Jurisdiction” means a country or territory that the European Commission, the UK Secretary of State or the Swiss Federal Data Protection and Information Commissioner (as relevant) has found to provide an adequate level of protection for personal data, or that is otherwise recognised as adequate under the Data Protection Laws that apply to the transfer.
• “Customer Content” means personal data that the Agency or its Users submit to, upload to or create on the Platform, other than Data Services Data, as listed in Section 1.
• “Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data covered by this DPA, and any similar term defined in Data Protection Laws.
• “Data Protection Laws” means every law on privacy or the protection of personal data that applies to a party’s processing under the Agreement, including, where applicable, the EU General Data Protection Regulation 2016/679 (“EU GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (“CCPA”) and other U.S. state privacy laws, and the data protection laws of the Agency’s country and of any other country whose law applies to the processing, each as amended or replaced. Country-Specific Privacy Information explains how to ask which local laws apply.
• “Data Services Data” means personal data contained in or derived from the device and location data Equatorium licenses from Data Partners, as displayed on the Platform or released through a Disclosure.
• “Data Subject”, “controller”, “processor”, “personal data” and “processing” have the meanings given in the applicable Data Protection Laws; where those laws use other terms for the same concepts (for example “business”, “service provider”, “personal information” or “data handler”), those terms are included.
• “Disclosure” means a disclosure request made, approved and released under the Disclosure Policy, and “Release” means the package of Data Services Data made available to the Agency when a Disclosure is approved.
• “Quant Data” has the meaning in Section 1.
• “SCCs” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914, together with, for transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner (the “UK Addendum”), and, for transfers from Switzerland, the SCCs as adapted under Section 8.
• “Sub-processor” means any third party Equatorium engages to process Customer Content or Quant Data on its behalf.
• “User” means an individual authorised by the Agency to use the Platform under its account, in any role available in the Platform.

#

Each party will:

• comply with the Data Protection Laws that apply to its own processing under the Agreement;
• process personal data only for the purposes allowed by the Agreement and this DPA;
• make sure that its personnel who access personal data are bound by appropriate confidentiality obligations and are trained in the handling of personal data;
• implement appropriate technical and organisational measures to protect personal data, taking into account its nature and the risks involved; Equatorium’s measures are described in Schedule 2;
• unless prohibited by law, tell the other party without undue delay about any regulatory inquiry, complaint or Data Subject request it receives that concerns the other party’s processing under the Agreement; and
• give the other party reasonable cooperation when it needs to respond to a regulator, a court or a Data Subject about processing under the Agreement.

#

4.1 Roles

Equatorium and the Agency are each an independent controller of Data Services Data. Equatorium decides how Data Services Data is collected from Data Partners, analysed, retained and made available on the Platform, and is responsible for that processing under its Privacy Policy. Once Data Services Data is displayed to the Agency’s Users or released to the Agency, the Agency decides for itself how it uses that data, and its processing is governed by the law that applies to the Agency and by the legal basis it relied on. Nothing in this DPA makes the parties joint controllers.

4.2 The Agency’s obligations

For Data Services Data it receives, the Agency will:

• Have a lawful basis. Use Data Services Data only for the licensing, spectrum management and enforcement functions the Agency is legally mandated to perform, and, for any Disclosure, only for the case type, legal basis and justification stated in the approved request.
• Provide transparency where required. Give any notice to Data Subjects that the law applicable to the Agency requires, or rely on an exemption that applies to it (for example for law enforcement, national security or regulatory functions), and keep a record of the exemption it relies on.
• Handle rights requests. Respond to requests from Data Subjects about data the Agency holds, under the law that applies to the Agency. Equatorium handles requests about data Equatorium holds, as described in Your Privacy Choices.
• Not re-identify beyond the approved scope. Not combine Data Services Data with other information to identify an individual, a household or a device user, and not attempt to reverse hashed emails or other pseudonymous identifiers, except to the extent a Disclosure released those identifiers to the Agency for the stated case and the Agency’s law permits that step.
• Respect the terminal focus. Treat terminal-level data (locations, sites, activity levels, device lists) as information about a satellite terminal, and not use it to track, profile or monitor an individual outside an approved Disclosure.
• Limit onward transfers. Not sell, rent, publish or otherwise make Data Services Data available to any third party, including another public body, except (a) to a court, prosecutor or other authority where required for the case for which a Disclosure was approved, or (b) where required by the Agency’s law, and in each case only the minimum necessary. Any recipient must be bound to protect the data at least as strictly as this DPA requires.
• Secure the data. Protect exported files and Releases with measures at least as protective as those in Schedule 2, and restrict access to Users with a need to know.
• Delete when done. Delete or destroy Data Services Data it has exported or copied from a Release when the case for which it was released is closed, or when its own retention law requires, whichever is sooner, unless the law that applies to the Agency requires it to keep the data as evidence.
• Respect the Disclosure Policy and the Responsible Use Policy. Not use the Platform or any Data Services Data for any purpose prohibited by the Disclosure Policy or the Responsible Use & Platform Enforcement Policy, including any purpose concerning journalists, conflict areas or other protected activity.

4.3 Equatorium’s obligations

For Data Services Data, Equatorium will:

• obtain Data Services Data from Data Partners that are contractually bound by the Data Partner Requirements, including requirements on notice, consent and opt-out signals;
• publish and maintain its Privacy Policy, the Retention Schedule and the regional notices that describe its processing;
• honour opt-out and deletion requests it receives from Data Subjects, and stop including opted-out devices in future displays and Releases; where the law requires, Equatorium will tell the Agency about an opt-out or deletion that affects data the Agency still holds from a Release so that the Agency can decide what its own law requires;
• release identity-linked data only through the process in the Disclosure Policy, and apply the controls in Schedule 2; and
• keep the audit trail described in Schedule 2, available to the Agency’s administrators.

4.4 Data Breaches involving Data Services Data

Each party will notify the other without undue delay after becoming aware of a Data Breach affecting Data Services Data received from the other party, where the breach is likely to result in material loss, alteration, disclosure of or access to that data, and will cooperate in responding to it. Each party remains responsible for any notifications to regulators or Data Subjects that the law applicable to it requires.

4.5 CCPA and U.S. state laws

To the extent U.S. state privacy laws apply to the Agency’s receipt of Data Services Data: (a) Equatorium makes Data Services Data available to the Agency only for the limited and specified purposes of satellite terminal detection, spectrum licensing enforcement and, for Releases, the approved case; (b) the Agency will process that data only for those purposes and will provide the level of privacy protection the CCPA requires; (c) Equatorium may take reasonable and appropriate steps to stop and remediate any unauthorised use; and (d) the Agency will tell Equatorium if it can no longer meet these obligations.

#

5.1 Instructions

Equatorium processes Customer Content only on the Agency’s documented instructions. The Agreement, this DPA and the Agency’s use and configuration of the Platform (for example, inviting Users, uploading a document, creating a workflow, generating an export, or opening a support ticket) are the Agency’s complete instructions. Equatorium will tell the Agency if it believes an instruction breaks Data Protection Laws, and may suspend the affected processing until the instruction is changed. Equatorium may process Customer Content otherwise only where the law that applies to it requires; in that case, it will tell the Agency first unless the law forbids it.

5.2 Confidentiality

Equatorium will ensure that every person it authorises to process Customer Content is bound by a duty of confidentiality and accesses Customer Content only as needed to provide the Platform, give support, keep the Platform secure or comply with law. Equatorium staff access to Agency accounts is restricted by role, and staff changes to Agency accounts are logged.

5.3 Security

Equatorium will implement and maintain the technical and organisational measures in Schedule 2. Equatorium may update those measures as long as the update does not materially reduce the overall protection of Customer Content.

5.4 Sub-processors

• The Agency gives Equatorium general authorisation to engage Sub-processors. The current list is available on request from legal@equatorium.com, as described in Sub-processors & Data Partners.
• Equatorium will give at least thirty (30) days’ notice before adding or replacing a Sub-processor, by email to the Agency’s administrators.
• The Agency may object on reasonable grounds relating to data protection within that notice period by writing to privacy@equatorium.com. The parties will discuss the objection in good faith. If Equatorium cannot offer a reasonable alternative, the Agency may terminate the affected part of the Services and receive a pro-rata refund of prepaid, unused subscription fees for the terminated part. Unused credits are handled as set out in the Terms of Use.
• Equatorium will impose on each Sub-processor written data protection obligations no less protective than those in this DPA, and remains responsible to the Agency for each Sub-processor’s performance.

5.5 Assistance

Taking into account the nature of the processing, Equatorium will help the Agency, by appropriate technical and organisational measures, to respond to Data Subject requests about Customer Content, and to meet its obligations on security, breach notification, data protection impact assessments and prior consultation with regulators. Much of this is self-service: administrators can manage Users, change roles, read the audit log and export records. Equatorium may charge reasonable fees for assistance that goes beyond the Platform’s features, where the law allows.

5.6 Data Breach notification

Equatorium will notify the Agency without undue delay, and in any event within seventy-two (72) hours after becoming aware of a Data Breach affecting Customer Content. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Equatorium will supplement the notice as more information becomes available. Notice of a Data Breach is not an admission of fault or liability. Notices go to the Agency’s administrators by email and in the Platform.

5.7 Deletion and return

During the term, administrators can export Customer Content through the Platform’s export features. For ninety (90) days after the Agreement ends, the Agency may still export its Customer Content through those features. Within thirty (30) days after that export window closes, Equatorium will delete Customer Content, except for (a) billing and audit records it must keep under law or for the periods in the Retention Schedule, and (b) any residual copies, which are deleted in the ordinary course and are not restored to active use. Quant conversations are deleted as described in Section 6.

5.8 Records and audits

Equatorium will make available the information reasonably necessary to show its compliance with this Section 5. It will do this primarily by answering a reasonable security and privacy questionnaire once a year. If that is not enough to meet a requirement of Data Protection Laws or a regulator’s order, the Agency (or an independent auditor it appoints and that is bound by confidentiality) may audit Equatorium’s relevant processing on thirty (30) days’ notice, during business hours, no more than once a year, at the Agency’s cost, and in a way that does not compromise the security or confidentiality of other customers’ data or of the Data Services.

5.9 CCPA service-provider terms

Where the CCPA or a similar U.S. state law applies to Customer Content, Equatorium is a “service provider” or “processor”. Equatorium will not: (a) sell or share Customer Content; (b) retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, or outside the direct business relationship with the Agency; or (c) combine it with personal information it receives from others, except as the law permits for service providers. Equatorium certifies that it understands and will comply with these restrictions, and will tell the Agency if it can no longer meet them.

#

Quant is the Platform’s AI assistant. It is described in full in Quant, the AI Assistant. For the purposes of this DPA:

• Questions a User asks, the parts of the Agency’s Platform data Quant reads to answer them, and Quant’s replies are processed by Equatorium as part of Customer Content under Section 5. Where Quant reads Data Services Data, Equatorium remains the controller of that data under Section 4.
• Quant uses an AI model provider acting as Equatorium’s Sub-processor. Quant Data is sent to that provider, which may process it in the United States.
• Under its commercial terms with Equatorium, the provider does not use Quant Data to train its models.
• Equatorium keeps Quant conversations for 90 days after their last message and then deletes them. A User can delete a conversation at any time in Quant, and it is deleted at once.
• Only the User who had a conversation can see it. The Agency’s administrators cannot.
• Quant never acts on its own. A suggestion takes effect only when a User presses Confirm, and confirmed suggestions are recorded in the Agency’s audit log.
• Quant is not used to make decisions that produce legal or similarly significant effects on any individual, and Quant cannot approve or release a Disclosure.

#

If Equatorium receives a request from a court, government authority or other third party (other than the Agency) for Customer Content, it will, unless legally prohibited, redirect the requester to the Agency and promptly notify the Agency so that it can seek a protective order or other remedy. Equatorium will disclose Customer Content only to the extent it is legally compelled to and will challenge requests it considers unlawful or overbroad. Equatorium’s approach is set out in Requests from Authorities & Third Parties.

#

8.1 Where data goes

Equatorium and its Sub-processors process personal data in the United States and in other countries where they operate. The current locations are available on request from legal@equatorium.com. Data Services Data released to an Agency is transferred to the Agency’s country.

Data residency. Equatorium hosts the Platform and Customer Content in the United States. In-country hosting is available only where agreed in an Order Form and may carry additional fees. The Agency is responsible for confirming that its national cybersecurity and government-data rules allow its Customer Content to be hosted outside its country.

8.2 SCCs

Where a transfer of personal data under this DPA is restricted under EU, UK or Swiss Data Protection Laws and is not to an Adequate Jurisdiction, the SCCs are incorporated into this DPA and apply as follows:

For each Module: Clause 7 (docking clause) applies; in Clause 9, Option 2 (general authorisation) applies with the notice period in Section 5.4; the optional language in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland; Annex I is completed by Schedule 1; Annex II by Schedule 2; and the competent supervisory authority is set out in Schedule 3.

For transfers from the United Kingdom, the UK Addendum applies: Table 1 is completed with the parties’ details in Schedule 1; Table 2 refers to the Modules above; Table 3 refers to Schedules 1 and 2; and in Table 4 either party may end the UK Addendum as allowed by its Section 19. For transfers from Switzerland, references to the GDPR include the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner is the competent authority, and “Member State” must not be read so as to exclude Data Subjects in Switzerland from bringing claims in their place of habitual residence.

8.3 Transfers under other laws

Where the Data Protection Laws of the Agency’s country require a transfer mechanism, approval or registration for transfers abroad, the parties will use the mechanism required by that law, which may include standard clauses issued by the local regulator, adequacy decisions or regulator approval. Equatorium’s legal team confirms the applicable requirements for each Agency on request at legal@equatorium.com.

8.4 Transfers to and between public bodies

A Release made to an Agency is a transfer to a public authority. The Agency is responsible for ensuring that its own law allows it to receive and use the data for the stated case. Where the Agency passes data to another public body (for example a prosecutor or court), the Agency is responsible for the lawfulness of that onward transfer and for applying any safeguards its law requires, including any government-to-government arrangement. Equatorium does not make Releases to any authority other than the Agency that made the approved request.

8.5 U.S. bulk data rules

The Agency will not sell, give access to or otherwise transfer Data Services Data to any “country of concern” or “covered person” as defined in 28 CFR Part 202, and will notify Equatorium immediately if it knows or suspects such access has occurred.

#

• Order of precedence. If there is a conflict, the following order applies: (i) the SCCs and any other transfer mechanism incorporated under Section 8; (ii) a signed Order Form or data processing terms individually agreed with the Agency, to the extent they expressly override this DPA; (iii) this DPA; (iv) the rest of the Agreement.
• Liability. Each party’s liability under or in connection with this DPA is subject to the exclusions and limitations of liability in the Terms of Use or the applicable Order Form, except where those limitations are not permitted under the SCCs or Data Protection Laws.
• Sovereign immunity. Nothing in this DPA waives any immunity of the Agency beyond what the Agency has agreed in writing.
• Term. This DPA takes effect when the Agreement does and ends automatically when the Agreement ends, except that obligations on deletion, confidentiality and the protection of data still held by either party survive for as long as that party holds the data.
• Governing law. This DPA is governed by the law that governs the Agreement, except where Data Protection Laws or the SCCs require otherwise.
• Changes. Equatorium may update this DPA to reflect changes in Data Protection Laws, regulator guidance or the Platform. Material changes that reduce the protection of personal data will be notified at least thirty (30) days in advance, unless a shorter period is required by law.

#

Questions about this DPA, Sub-processor objections and audit requests should be sent to privacy@equatorium.com. Legal notices under the Agreement go to legal@equatorium.com. Requests and notices to Equatorium are made by email.

#

Parties

Description of processing

#

Equatorium maintains the following measures and may update them as long as the overall level of protection is not reduced. Further detail is available to an Agency under confidentiality on request from legal@equatorium.com.

Access control and authentication

• Every User signs in individually, and two-step verification is available.
• Role-based permissions limit what each User can see and do.
• Each Agency’s data is kept separate from every other Agency’s data.
• Equatorium staff access to Agency accounts is restricted by role, and staff changes to Agency accounts are logged.

Logging and accountability

• Changes made on the Platform and disclosure activity are recorded in the Agency’s audit log.
• Logs are protected against unauthorised access and kept for the periods in the Retention Schedule.

Data protection by design

• Identity-linked data is released only under the Disclosure Policy.
• Releases can be checked for authenticity on the Check a release page.
• Card payments are handled by our payment processor.

Infrastructure

• Data is encrypted in transit.
• Changes to the Platform are reviewed before release.
• Systems are monitored, and failures are alerted to staff.

Organisational measures

• Personnel with access to personal data are bound by confidentiality obligations.
• Sub-processors are assessed before they are engaged and are bound by written data protection terms.
• Equatorium follows an incident response process that meets the notification commitments in Section 5.6.

#

• EU transfers: where Equatorium has appointed a representative under Article 27 GDPR, the supervisory authority of the Member State in which that representative is established; otherwise, the supervisory authority of the Member State in which the Data Subjects concerned are located.
• UK transfers: the Information Commissioner’s Office.
• Swiss transfers: the Federal Data Protection and Information Commissioner.
• Other jurisdictions: the data protection authority of the relevant country, as confirmed on request (see Country-Specific Privacy Information).