DATA PROCESSING ADDENDUM
My Record Locker
This Data Processing Addendum ("DPA") forms part of the Terms of Service ("Agreement") between Kryptomneme LLC, doing business as My Record Locker ("Processor"), and the organization identified in the Agreement ("Controller"), and governs the processing of Personal Data by Processor on behalf of Controller in connection with the My Record Locker platform (the "Service").
1. Definitions
"Applicable Data Protection Law" means all laws and regulations relating to the processing of Personal Data that apply to the processing described in this DPA, including, where applicable, the EU General Data Protection Regulation (Regulation 2016/679) ("GDPR"), the UK General Data Protection Regulation, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and any implementing or supplementary legislation.
"Controller" means the Customer organization that determines the purposes and means of the processing of Personal Data through the Service.
"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
"Personal Data" means any information relating to a Data Subject that is processed by Processor on behalf of Controller through the Service.
"Processing" means any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, disclosure, combination, restriction, erasure, or destruction.
"Processor" means Kryptomneme LLC, which processes Personal Data on behalf of Controller.
"Sub-processor" means any third party engaged by Processor to process Personal Data on behalf of Controller.
"Security Incident" means a confirmed unauthorized access to, or unauthorized acquisition, disclosure, or use of, Personal Data processed under this DPA.
2. Scope and Roles
2.1. Controller is the controller of Personal Data submitted to or generated within its Tenant Workspace. Processor processes Personal Data solely on behalf of Controller and in accordance with Controller's documented instructions as set forth in this DPA and the Agreement.
2.2. This DPA applies to all Personal Data processed by Processor in connection with the Service, including learner names, email addresses, employer references, training-session event data, and Completion Records.
3. Details of Processing
| Element | Description |
|---|---|
| Subject matter | Provision of the My Record Locker platform, including training-module delivery, session-event recording, Completion Record issuance, record storage, record verification, and record export. |
| Duration | For the term of the Agreement plus the applicable data-retention period described in Section 8. |
| Nature and purpose | Processing Personal Data to deliver training modules, perform sampled identity verification, record training-session events in an append-only event chain, issue cryptographically signed Completion Records, enable record verification, and provide data export to Controller. |
| Categories of Data Subjects | Learners (employees or other individuals invited by Controller to complete training); Controller's administrators. |
| Categories of Personal Data | Full name, email address, employer reference or employee identifier, training-session events (quiz responses, navigation actions, timestamps, completion status), identity-verification method and result, session duration, IP address, browser user-agent. |
4. Controller's Instructions
4.1. Processor shall process Personal Data only in accordance with Controller's documented instructions, which are deemed to include the processing described in the Agreement, this DPA, and any configuration selections made by Controller within the Service.
4.2. If Processor believes that an instruction from Controller infringes Applicable Data Protection Law, Processor shall promptly notify Controller and may suspend the relevant processing until Controller issues a revised instruction.
4.3. Processor shall not process Personal Data for any purpose other than providing the Service as described in the Agreement and this DPA, and shall not sell, rent, or otherwise commercially exploit Personal Data.
5. Confidentiality
5.1. Processor shall ensure that all persons authorized to process Personal Data are bound by appropriate obligations of confidentiality, whether contractual or statutory.
5.2. Processor shall not disclose Personal Data to any third party except as permitted under this DPA (including to authorized Sub-processors) or as required by applicable law. If Processor receives a legally binding request from a governmental or regulatory authority to disclose Personal Data, Processor shall promptly notify Controller before making such disclosure, unless prohibited by law from doing so.
6. Security Measures
6.1. Processor shall implement and maintain reasonable administrative, technical, and organizational measures to protect Personal Data against unauthorized access, alteration, disclosure, or destruction. These measures include:
(a) Cryptographic signing of Completion Records using Ed25519 digital signatures, with signing keys held solely by Processor.
(b) Hash-chained, append-only event storage to maintain record integrity and detect tampering.
(c) Encryption of data in transit using TLS, and encryption of data at rest, including infrastructure snapshots.
(d) Encrypted off-site backups (AES-256-GCM) stored on Backblaze B2, with decryption keys held solely by Processor.
(e) Logical tenant isolation — each Controller's data is stored and accessed within a scoped Tenant Workspace, with technical controls designed to prevent cross-tenant data access.
(f) Sampled identity verification of learners using one-time-password codes delivered via email; codes are not retained after verification.
6.2. No system can be guaranteed secure against every threat, and Processor does not represent that the Service is impervious to unauthorized access. Processor will notify Controller of material changes to the measures described in this Section.
6.3. Processor shall periodically review and update its security measures to reflect changes in technology, industry practice, and the nature and sensitivity of the Personal Data processed.
7. Sub-processors
7.1. Controller grants Processor general authorization to engage Sub-processors to assist in providing the Service, subject to the requirements of this Section 7.
7.2. As of the effective date of this DPA, Processor uses the following Sub-processors:
| Sub-processor | Processing Activity | Location |
|---|---|---|
| Stripe, Inc. | Payment processing (hosted checkout; Processor never receives raw payment-card data) | United States |
| Resend | Transactional email delivery (invitations, one-time-password codes) | United States |
| Render | Cloud hosting and persistent storage for the Platform and its database | United States |
| Backblaze, Inc. | Encrypted off-site backup storage (receives only encrypted backup artifacts; does not hold decryption keys) | United States |
7.3. Before engaging a new Sub-processor or replacing an existing one, Processor shall notify Controller at least thirty (30) days in advance by email to Controller's registered account address. The notice shall identify the new Sub-processor, describe the processing it will perform, and state its location.
7.4. Controller may object to a new Sub-processor by notifying Processor in writing within fifteen (15) days of receiving notice. If Controller raises a reasonable objection and the parties cannot resolve the objection within thirty (30) days, Controller may terminate the Agreement with respect to the affected processing activity without penalty.
7.5. Processor shall enter into a written agreement with each Sub-processor that imposes data-protection obligations no less protective than those in this DPA. Processor remains fully liable to Controller for the acts and omissions of its Sub-processors.
8. Data Retention, Return, and Deletion
8.1. Processor shall retain Personal Data for the duration of the Agreement and for the applicable retention period thereafter. Retention periods are configured by Controller at the time of record issuance based on Controller's own regulatory or business requirements. Controller is responsible for determining the retention period appropriate to its use and configuring the Service accordingly.
8.2. Because the Service uses an append-only data store, deletion of issued records in the conventional sense is not performed. Upon receiving a valid deletion request:
(a) Personally identifiable information (learner name, employer reference) is removed from the affected record.
(b) A redaction event is appended to the event chain, documenting that redaction occurred.
(c) The cryptographic chain (hashes) is preserved — the existence of the record remains visible, but identifying information is removed.
(d) This process is irreversible once executed.
8.3. Upon termination of the Agreement, Processor shall, at Controller's election:
(a) Provide Controller with a complete export of Controller's Tenant Workspace data in CSV or JSON format; and/or
(b) Anonymize Personal Data in Controller's Tenant Workspace in accordance with Section 8.2.
Controller shall communicate its election within sixty (60) days of termination. If Controller makes no election within that period, Processor shall anonymize the Personal Data in accordance with Section 8.2 after the expiration of the applicable retention period.
9. Data Subject Rights
9.1. Processor shall assist Controller in responding to requests from Data Subjects to exercise their rights under Applicable Data Protection Law, including rights of access, rectification, deletion, restriction, portability, and objection.
9.2. If Processor receives a request directly from a Data Subject, Processor shall promptly redirect the request to Controller, unless Processor is required by applicable law to respond directly.
9.3. Controller acknowledges that, due to the append-only nature of the Service, rectification of data within issued Completion Records is accomplished by appending corrective events rather than retroactively modifying prior entries, and deletion is accomplished through anonymization as described in Section 8.2.
10. Security Incident Notification
10.1. Processor shall notify Controller of a Security Incident without undue delay and in any event within seventy-two (72) hours of becoming aware of the incident.
10.2. Notification shall include, to the extent known at the time:
(a) A description of the nature of the Security Incident, including the categories and approximate number of Data Subjects and records affected.
(b) The likely consequences of the incident.
(c) The measures taken or proposed to address the incident and mitigate its effects.
(d) The name and contact details of the point of contact for further information.
10.3. Processor shall cooperate with Controller in investigating and remediating the Security Incident and shall provide reasonable assistance to Controller in fulfilling Controller's own breach-notification obligations under Applicable Data Protection Law.
10.4. Notification of a Security Incident under this Section shall not be construed as an acknowledgment of fault or liability by Processor.
11. Data Protection Impact Assessments and Consultations
11.1. Processor shall provide reasonable assistance to Controller in conducting data protection impact assessments and prior consultations with supervisory authorities, to the extent required by Applicable Data Protection Law and to the extent that such assessments relate to the processing performed by Processor under this DPA.
12. International Data Transfers
12.1. The Service is hosted in the United States. If Controller or its Data Subjects are located outside the United States, Personal Data may be transferred to and processed in the United States.
12.2. Where such transfer requires a lawful transfer mechanism under Applicable Data Protection Law, the parties agree to execute the Standard Contractual Clauses approved by the European Commission (or the UK International Data Transfer Addendum, as applicable) as an appendix to this DPA. In such case:
(a) Controller is the "data exporter" and Processor is the "data importer."
(b) The details of processing in Section 3 of this DPA shall serve as Annex I to the Standard Contractual Clauses.
(c) The technical and organizational measures in Section 6 of this DPA shall serve as Annex II to the Standard Contractual Clauses.
(d) The Sub-processor list in Section 7.2 shall serve as Annex III to the Standard Contractual Clauses.
12.3. Processor shall not transfer Personal Data to any country or territory outside the scope of the original transfer unless it has taken measures necessary to ensure the transfer complies with Applicable Data Protection Law.
13. Audits
13.1. Processor shall make available to Controller, upon reasonable request and subject to reasonable confidentiality obligations, information necessary to demonstrate compliance with this DPA.
13.2. Controller (or a qualified third-party auditor appointed by Controller and bound by confidentiality obligations) may conduct an audit of Processor's processing activities under this DPA no more than once per twelve-month period, upon at least thirty (30) days' prior written notice. Audits shall be conducted during normal business hours, shall not unreasonably interfere with Processor's operations, and shall be at Controller's expense.
13.3. If an independent third-party audit report or certification covering the processing activities under this DPA becomes available, Processor may provide such report or certification to Controller in satisfaction of an audit request under this Section.
14. Liability
14.1. Each party's liability under this DPA is subject to the limitations and exclusions of liability set forth in the Agreement.
14.2. This DPA does not create any rights or remedies for any third party, including any Data Subject.
15. Term and Termination
15.1. This DPA takes effect on the effective date of the Agreement and remains in effect for so long as Processor processes Personal Data on behalf of Controller.
15.2. The obligations in Sections 5, 6, 8, 9, 10, and 13 survive termination or expiration of this DPA to the extent necessary to fulfill their purposes.
16. Conflict
16.1. In the event of a conflict between this DPA and the Agreement, this DPA shall prevail with respect to the processing of Personal Data.
17. Governing Law
17.1. This DPA is governed by the same law that governs the Agreement (the laws of the State of California; exclusive jurisdiction in the state and federal courts located in Contra Costa County, California).
18. Acceptance
This DPA is incorporated by reference into the Agreement and takes effect automatically upon Controller's acceptance of the Agreement, without requirement of a separate signature, consistent with Section 2 (Acceptance of Terms) of the Terms of Service. Where an enterprise Controller requires a countersigned copy or negotiated terms, Processor will provide an executable version of this DPA (or the Standard Contractual Clauses referenced in Section 12) upon request.