Data Processing Agreement (DPA)

1. Introduction and Scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between MockAPI Inc. ("MockAPI," "we," "us," or "our") and you ("Customer," "you," or "your") and governs the processing of personal data by MockAPI on behalf of Customer.

This DPA applies when MockAPI processes personal data on behalf of Customer in the course of providing our mock API services, and Customer acts as the data controller and MockAPI acts as the data processor.

2. Definitions

For the purposes of this DPA:

• "Data Controller" means the entity that determines the purposes and means of processing personal data
• "Data Processor" means the entity that processes personal data on behalf of the data controller
• "Data Subject" means an identified or identifiable natural person
• "Personal Data" means any information relating to an identified or identifiable natural person
• "Processing" means any operation performed on personal data, including collection, storage, use, and deletion
• "Sub-processor" means any third party engaged by MockAPI to process personal data on behalf of Customer
• "Supervisory Authority" means an independent public authority responsible for monitoring GDPR compliance
• "Data Protection Laws" means all applicable laws relating to data protection and privacy, including GDPR, CCPA, and other relevant regulations

3. Data Processing Details

3.1 Subject Matter and Duration

MockAPI will process personal data to provide mock API services as described in our Terms of Service. Processing will continue for the duration of the service agreement and any applicable retention periods.

3.2 Nature and Purpose of Processing

MockAPI processes personal data for the following purposes:

• Providing and maintaining mock API services
• User account management and authentication
• Customer support and technical assistance
• Service monitoring and performance optimization
• Billing and payment processing
• Compliance with legal obligations

3.3 Types of Personal Data

MockAPI may process the following categories of personal data:

• Account Data: Name, email address, username, password (hashed)
• Profile Data: Company name, job title, profile picture
• Usage Data: API usage statistics, access logs, feature usage
• Technical Data: IP addresses, browser information, device identifiers
• Communication Data: Support tickets, chat messages, email correspondence
• Billing Data: Payment information, billing addresses, transaction records

3.4 Categories of Data Subjects

Personal data may relate to the following categories of data subjects:

• Customer's employees and authorized users
• Customer's contractors and consultants
• Customer's customers (if included in mock data)
• Other individuals whose data is processed through the service

4. Customer Obligations

4.1 Lawful Basis

Customer warrants that:

• It has a lawful basis for processing personal data under applicable data protection laws
• It has obtained all necessary consents and authorizations for data processing
• It has provided appropriate privacy notices to data subjects
• The processing instructions comply with applicable data protection laws

4.2 Processing Instructions

Customer agrees that:

• This DPA and the Terms of Service constitute Customer's complete and final instructions for processing
• Additional instructions must be agreed upon in writing
• MockAPI may refuse instructions that violate applicable laws
• Customer is responsible for ensuring instructions are lawful and appropriate

5. MockAPI Obligations

5.1 Processing Compliance

MockAPI agrees to:

• Process personal data only in accordance with Customer's documented instructions
• Ensure personnel processing personal data are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Not process personal data for its own purposes without Customer's consent

5.2 Security Measures

MockAPI implements the following security measures:

• Encryption: Data encryption in transit (TLS 1.2+) and at rest (AES-256)
• Access Controls: Role-based access controls and multi-factor authentication
• Network Security: Firewalls, intrusion detection, and network monitoring
• Vulnerability Management: Regular security assessments and patch management
• Incident Response: Documented procedures for security incident handling
• Data Backup: Regular backups with encryption and access controls

6. Sub-processing

6.1 Authorized Sub-processors

Customer provides general authorization for MockAPI to engage sub-processors, subject to the conditions in this section.

6.2 Current Sub-processors

6.3 Changes to Sub-processors

MockAPI will:

• Provide 30 days' notice before adding or changing sub-processors
• Maintain an updated list of sub-processors on our website
• Allow Customer to object to new sub-processors on reasonable grounds
• Work with Customer to resolve objections or allow service termination

7. Data Subject Rights

7.1 Assistance with Data Subject Requests

MockAPI will assist Customer in responding to data subject requests by:

• Providing access to personal data in MockAPI's systems
• Implementing corrections or updates as instructed by Customer
• Deleting personal data when requested and legally permissible
• Providing data in a portable format when technically feasible
• Restricting processing when required by law

7.2 Response Timeframes

MockAPI will respond to Customer requests for assistance within:

• Urgent requests: 24 hours
• Standard requests: 5 business days
• Complex requests: 15 business days

8. Data Breach Notification

8.1 Incident Response

In the event of a personal data breach, MockAPI will:

• Notify Customer without undue delay and within 24 hours of becoming aware
• Provide all available information about the breach
• Take immediate steps to contain and mitigate the breach
• Cooperate with Customer's breach response efforts
• Provide regular updates on investigation and remediation

8.2 Breach Information

Breach notifications will include:

• Description of the nature of the breach
• Categories and approximate number of data subjects affected
• Categories and approximate number of personal data records affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact information for further information

9. Data Transfers

9.1 International Transfers

Personal data may be transferred to and processed in countries outside the EEA, including the United States.

9.2 Transfer Safeguards

For transfers outside the EEA, MockAPI implements appropriate safeguards:

• Standard Contractual Clauses: EU-approved SCCs for data transfers
• Adequacy Decisions: Transfers to countries with adequacy decisions
• Certification Schemes: Participation in approved certification programs
• Additional Safeguards: Technical and organizational measures as required

10. Data Retention and Deletion

10.1 Retention Periods

Personal data will be retained:

• For the duration of the service agreement
• For additional periods as required by law
• As necessary for legitimate business purposes
• In accordance with Customer's retention instructions

10.2 Data Deletion

Upon termination of services or Customer request, MockAPI will:

• Delete or return all personal data within 30 days
• Provide certification of deletion upon request
• Retain data only as required by applicable law
• Ensure sub-processors also delete personal data

11. Audits and Compliance

11.1 Audit Rights

Customer may audit MockAPI's compliance with this DPA:

• Upon reasonable notice (minimum 30 days)
• During normal business hours
• No more than once per year unless required by law
• At Customer's expense unless material non-compliance is found

11.2 Third-Party Audits

MockAPI undergoes regular third-party security audits and maintains:

• SOC 2 Type II certification
• ISO 27001 certification
• Regular penetration testing
• Vulnerability assessments

12. Liability and Indemnification

12.1 Limitation of Liability

Each party's liability under this DPA is subject to the limitation of liability provisions in the Terms of Service.

12.2 Data Protection Indemnification

MockAPI will indemnify Customer against claims arising from:

• MockAPI's material breach of this DPA
• MockAPI's violation of applicable data protection laws
• Unauthorized processing by MockAPI or its sub-processors

12.3 Customer Indemnification

Customer will indemnify MockAPI against claims arising from:

• Customer's violation of applicable data protection laws
• Unlawful processing instructions from Customer
• Customer's failure to obtain necessary consents

13. Term and Termination

13.1 Term

This DPA will remain in effect for the duration of the Terms of Service.

13.2 Termination

This DPA may be terminated:

• Upon termination of the Terms of Service
• By mutual agreement of the parties
• By either party for material breach after 30 days' notice

13.3 Effect of Termination

Upon termination:

• MockAPI will cease processing personal data
• Personal data will be deleted or returned as instructed
• Confidentiality obligations will survive termination
• Data subject rights assistance will continue as required

14. Amendments and Updates

This DPA may be updated from time to time to reflect changes in applicable laws or our practices. We will provide notice of material changes and obtain Customer consent where required by law.

15. Governing Law and Jurisdiction

This DPA is governed by the same law and jurisdiction provisions as specified in the Terms of Service, except where data protection laws require otherwise.

16. Contact Information

For questions about this DPA or data protection matters, please contact:

• Data Protection Officer: dpo@mockapi.com
• Legal Department: legal@mockapi.com
• Security Team: security@mockapi.com
• Address: MockAPI Inc., 123 Tech Street, San Francisco, CA 94105