Legal
Data Processing Agreement
Effective Date: August 15, 2026
Introduction
This Data Processing Agreement (“DPA”) forms part of the Terms of Service (or other written agreement) between Digital Command (“Processor”, “we”) and the customer organization that subscribes to WinBench (“Controller”, “Customer”).
It applies when we process personal data on Customer’s behalf as a processor in providing the SaaS platform (Customer Content inside workspaces and related subscriber tools). It does not apply where we act as an independent controller (for example, our own account administration, billing, security telemetry we determine, or marketing), as described in our Privacy Policy.
If Customer requires a signed copy, SCCs, or UK Addendum for a procurement package, contact us at the address below.
1. Definitions
“Applicable Data Protection Law” means the EU GDPR, UK GDPR, Swiss FADP, and other data protection laws that apply to the processing of Customer Personal Data under this DPA.
“Customer Personal Data” means personal data contained in Customer Content that we process as processor on Customer’s documented instructions.
“Subprocessor” means a third party engaged by us to process Customer Personal Data in providing the service.
2. Roles and Scope
Customer is the controller (or a processor instructing us as a subprocessor). We are the processor of Customer Personal Data.
Subject matter: hosting and operation of WinBench SaaS features. Duration: the subscription term plus any post-termination retention described herein. Nature and purpose: provide, secure, support, and improve the service as instructed. Types of data and data subjects: as determined by Customer (typically business contact, workspace membership, commercial workflow, and uploaded document content about Customer’s personnel, prospects, or counterparties).
3. Customer Instructions
We will process Customer Personal Data only on Customer’s documented instructions, including configuration of the service and this DPA, unless Required by Applicable Data Protection Law (in which case we will inform Customer unless legally prohibited).
Customer is responsible for the lawfulness of its instructions, its own notices to data subjects, and for not instructing us to process data in violation of Applicable Data Protection Law.
4. Confidentiality and Personnel
We ensure persons authorized to process Customer Personal Data are bound by confidentiality and receive appropriate training.
5. Security
Taking into account the state of the art, costs, and the nature of the processing, we implement appropriate technical and organizational measures to protect Customer Personal Data, including access controls, encryption in transit, tenant isolation practices, logging, and vulnerability management as described at a high level in our Privacy Policy.
Customer may request a reasonable security overview for procurement. We do not publish detailed security controls that would increase risk if disclosed publicly.
6. Subprocessors
Customer authorizes us to engage Subprocessors to deliver the service. We impose data-protection obligations on Subprocessors that are no less protective than this DPA in material respects.
Material Subprocessor categories typically include: cloud hosting and database providers; authentication and email delivery providers; error/monitoring providers; and AI model providers used to power optional or core AI features under contract.
We will maintain a current list of material Subprocessors available on request to Customer administrators, and will provide notice of intended additions or replacements with a reasonable opportunity to object on reasonable data-protection grounds before the new Subprocessor processes Customer Personal Data (urgent security replacements excepted, with prompt notice afterward).
7. International Transfers
Digital Command is established in the United States. Customer Personal Data may be processed in the United States and other countries where we or our Subprocessors operate.
Where Required by Applicable Data Protection Law, the parties will rely on Standard Contractual Clauses (and UK International Data Transfer Addendum where applicable) or another valid transfer mechanism. Upon Customer’s request for EEA/UK transfers, we will execute or make available the applicable SCCs module for processor-to-processor or controller-to-processor transfers as appropriate.
8. Assistance with Data Subject Rights
Taking into account the nature of processing, we will assist Customer by appropriate technical and organizational measures, insofar as possible, to respond to requests to exercise data subject rights under Applicable Data Protection Law. If we receive a request directly relating to Customer Personal Data, we will direct the individual to Customer where feasible and will not respond as controller unless legally required.
9. Breach Notification
We will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably available to us to help Customer meet its notification obligations.
10. Audits
Upon reasonable written request, no more than once per twelve (12) months (unless a breach or competent authority requires otherwise), we will make available information necessary to demonstrate compliance with this DPA, which may include security summaries or third-party reports under NDA. On-site audits are available only where required by Applicable Data Protection Law and subject to reasonable notice, scope, confidentiality, and cost allocation.
11. Return and Deletion
Upon termination of the service, we will make Customer Content reasonably available for export for at least thirty (30) days where technically feasible. Thereafter, we will delete or return Customer Personal Data (at Customer’s choice where return is feasible) and delete existing copies, except where retention is Required by Applicable Data Protection Law or needed for security, dispute resolution, or backup rotation — in which case we will isolate and protect the data and delete it when the exception no longer applies.
12. Liability
Liability under this DPA is subject to the limitations and carve-outs in the Terms of Service or Order, except that nothing limits liability that cannot be limited under Applicable Data Protection Law.
13. Order of Precedence
If this DPA conflicts with the Terms for processing of Customer Personal Data, this DPA controls. Executed SCCs control over this DPA for transfer terms where they conflict.
14. Contact
Digital Command (makers of WinBench)
8120 Torringdon Way, Charlotte, NC