Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Ekayana ("Processor") and you ("Controller") for the processing of personal data.

Definitions

• Personal data means any information relating to an identified or identifiable natural person.
• Processing means any operation performed on personal data, such as collection, storage, or retrieval.
• Data subject means the individual whose personal data is being processed.
• Sub-processor means any third party engaged by Ekayana to process personal data.

Scope of Processing

This DPA applies to all personal data processed through the Ekayana platform. That includes the following.

• Researcher identification data, such as names, email addresses, and ORCID IDs.
• Research participant data uploaded by the Controller.
• Usage and access logs.
• Authentication credentials.

Obligations of Ekayana as Processor

• Process personal data only on documented instructions from the Controller.
• Ensure that everyone authorized to process data is bound by confidentiality.
• Implement appropriate technical and organizational security measures.
• Assist the Controller in responding to data subject requests.
• Delete or return all personal data when the services end.
• Make available all information needed to demonstrate compliance.

Obligations of the Controller

• Ensure there is a lawful basis for processing personal data.
• Provide clear instructions for data processing.
• Ensure data subjects are informed about the processing.
• Maintain records of processing activities.
• Conduct Data Protection Impact Assessments where required.
• Notify Ekayana of any data subject requests or complaints.

Ekayana engages the following categories of sub-processors.

Infrastructure Providers

Service Providers

Sub-processor Management

• We maintain an up-to-date list of sub-processors.
• Controllers are notified of any new sub-processor 30 days in advance.
• Controllers may object to a new sub-processor within 14 days.
• All sub-processors are bound by equivalent data protection obligations.

Transfer Mechanisms

Personal data may be transferred outside the EEA under one of the following safeguards.

• Standard Contractual Clauses approved by the European Commission for transfers to third countries.
• Adequacy decisions for countries with adequate data protection, such as the United Kingdom and Switzerland.
• Binding Corporate Rules for transfers within a corporate group.

Decentralized Storage

The IPFS storage layer has the following properties.

• Data is replicated across the peers of the cluster.
• Content addressing preserves data integrity regardless of location.
• Data is encrypted before it is distributed, which protects it in transit and at rest.

Transfer Impact Assessment

We conduct a Transfer Impact Assessment for every international transfer. It considers the following.

• The laws and practices of the destination country.
• The supplementary measures in place.
• The effectiveness of the safeguards.

Retention Periods

Deletion Procedures

On termination or at the Controller's request, deletion proceeds as follows.

• Active data is marked for deletion within 24 hours.
• Data is removed from primary storage within 7 days.
• Backup copies are purged within 90 days.
• Confirmation of deletion is provided to the Controller.

IPFS

• Every upload is sealed with AES-256-GCM before it reaches the IPFS cluster.
• The cluster is private and never joins the public IPFS network.
• Deletion unpins the content on every cluster peer, and blocks leave disk at the next garbage collection.
• A copy a recipient already fetched cannot be recalled, but it is an envelope only the service can open.

Technical Measures

• Encryption at rest with AES-256 and in transit with TLS 1.3.
• Content addressed storage with cryptographic verification.
• UCAN capability authorization.
• Multi-factor authentication for administrative access.
• Independent security audits and penetration testing, to be commissioned before general availability. No component has been externally audited yet.

Organizational Measures

• Staff training on data protection.
• Access controls based on least privilege.
• Incident response procedures.
• Business continuity planning.

Breach Notification

In the event of a personal data breach, the following applies.

• Ekayana notifies the Controller within 24 hours of becoming aware of the breach.
• The notification includes the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to address it.
• The Controller is responsible for notifying supervisory authorities within 72 hours and data subjects as required.