Data Processing Agreement

1. Parties & Roles

The Department is the controller of the personal data it stores in the Service and determines the purposes and means of its processing. RM Ventures is the processor and processes that personal data only on the Department’s behalf. Each party is responsible for complying with the data-protection obligations applicable to it in its role.

2. Subject Matter, Nature & Purpose of Processing

The subject matter of the processing is the personal data contained in the Department’s Customer Data. The nature of the processing includes hosting, storage, organization, retrieval, transmission, and deletion of such data using the Service. The purpose of the processing is to provide the Service to the Department, including managing members, apparatus, attendance, and scheduling; creating and maintaining fire incident records; and transmitting incident data to NERIS at the Department’s direction.

3. Duration

RM Ventures will process personal data for the duration of the Department’s use of the Service and until the data is deleted or returned in accordance with Section 9 below.

4. Categories of Data Subjects & Types of Personal Data

Categories of data subjects

• Department members (including officers, firefighters, and other personnel); and
• persons involved in incidents recorded by the Department (for example, individuals identified in incident reports).

Types of personal data

• identification and contact details (names, addresses, phone numbers, email addresses);
• emergency-contact information;
• certifications, training records, ranks, and roles;
• attendance and scheduling information; and
• incident-related information, which may include locations, times, narratives, and details of persons involved.

5. Processor Obligations

RM Ventures will:

• process personal data only on the documented instructions of the Department, including as set out in the Terms of Service, this DPA, and the Department’s use of the Service, unless required to act otherwise by applicable law;
• ensure that personnel authorized to process personal data are bound by appropriate confidentiality obligations;
• implement and maintain appropriate technical and organizational security measures as described in Section 7; and
• not sell personal data or use it for any purpose other than providing the Service.

6. Sub-processors

The Department authorizes RM Ventures to engage the following sub-processors to support the Service, each bound by data-protection obligations no less protective than those in this DPA:

Sub-processor	Purpose	Location
Microsoft Azure	Cloud hosting and database	United States (Central US region)
Cloudflare	DNS and email routing	United States
NERIS / UL Fire Safety Research Institute (FSRI)	Incident data exchange	United States

RM Ventures will inform the Department of any intended addition or replacement of a sub-processor, giving the Department the opportunity to object on reasonable data-protection grounds. If the Department objects and the parties cannot resolve the concern, the Department may terminate the affected portion of the Service.

7. Security Measures

Taking into account the state of the art and the nature of the data, RM Ventures maintains appropriate technical and organizational measures, including encryption of data in transit, role-based access controls, logical tenant isolation so each Department’s data is segregated, authentication safeguards including two-factor authentication and account lockout, and hosting on infrastructure that maintains industry security certifications.

8. Personal Data Breach Notification

RM Ventures will notify the Department without undue delay after becoming aware of a personal data breach affecting the Department’s Customer Data, and will provide the Department with information reasonably available to assist it in meeting any notification obligations it may have.

9. Assistance with Data-Subject Requests

Taking into account the nature of the processing, RM Ventures will provide reasonable assistance to the Department, through appropriate technical and organizational measures, to help the Department respond to requests from data subjects to exercise their rights, and to meet the Department’s security, breach-notification, and related obligations. Data-subject requests received directly by RM Ventures will be referred to the relevant Department. Requests for assistance may be sent to support@responder-hq.com.

10. Return or Deletion of Data

Upon termination of the Service, the Department may export its Customer Data during the subscription term and for a reasonable period following termination. Thereafter, RM Ventures will, at the Department’s choice, return or delete the Customer Data, except to the extent RM Ventures is required to retain it by applicable law.

11. Audit & Records

RM Ventures will maintain records of its processing activities sufficient to demonstrate compliance with this DPA and will make available to the Department, upon reasonable request, information reasonably necessary to demonstrate such compliance.

12. Governing Law

This DPA is governed by and construed in accordance with the laws of the State of Alabama, United States, without regard to its conflict-of-laws principles. In the event of any conflict between this DPA and the Terms of Service with respect to the processing of personal data, this DPA controls.

13. Contact

RM Ventures LLC
18526 Upper Columbus Rd, Gordo, AL 35466
Data-protection inquiries: support@responder-hq.com