-
Introduction
This Data Processing Addendum (this “Addendum” or “DPA”) forms part of the Terms of Use (the “Agreement”) between Pam Terminal (“Pam Terminal”) and the customer identified in the applicable account or order form (“Customer”).
This DPA applies where and to the extent Pam Terminal processes Personal Data on behalf of Customer as a Processor or service provider in connection with the Services.
Scope. Pam Terminal’s Licensed Software is self-hosted by Customer. Session recordings, vault secrets, and audit logs that remain solely in Customer’s environment are not processed by Pam Terminal under this DPA. This DPA applies when Customer transmits Personal Data to Pam Terminal—for example support diagnostics packages, contact and support correspondence, or other Customer Content uploaded to Account Services.
If there is a conflict between this DPA and the Agreement regarding Personal Data processing, this DPA controls.
-
Definitions and Interpretation
In this Addendum:
“Affiliate” means an entity that controls, is controlled by, or is under common control with a party.
“Applicable Privacy Laws” means data protection and privacy laws applicable to the Personal Data, including where applicable the GDPR, UK GDPR, LGPD, CCPA/CPRA, and similar laws.
“Customer Personal Data” or “Data” means Personal Data processed by Pam Terminal on behalf of Customer in providing the Services within the scope described in Section 1.
“Personal Data” has the meaning given in Applicable Privacy Laws.
“Security Incident” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
“Subprocessor” means a third party engaged by Pam Terminal to process Customer Personal Data in connection with the Services.
Terms such as Controller, Processor, Data Subject, and processing have the meanings in Applicable Privacy Laws (or the GDPR if not defined).
-
Processing of Personal Data
Customer is the Controller (or Business) and Pam Terminal is the Processor (or Service Provider) with respect to Customer Personal Data. Pam Terminal will:
- (a) process Data only for the Permitted Purpose of providing, securing, and supporting the Services (including support intake and diagnostics review), and according to Customer’s documented instructions;
- (b) not retain, use, or disclose Data for any purpose other than the Permitted Purpose, except as required by law;
- (c) not “sell” or “share” Data as those terms are defined under the CCPA, or combine Data with other personal information except as permitted by Applicable Privacy Laws to provide the Services;
- (d) promptly inform Customer if it believes an instruction infringes Applicable Privacy Laws (without obligation to monitor Customer’s compliance).
Customer warrants that it has a lawful basis for processing and for instructing Pam Terminal, and that its instructions are lawful and technically feasible. Customer should avoid including unnecessary secrets or special-category data in support uploads.
-
International Transfers
Where Pam Terminal transfers Customer Personal Data internationally, it will ensure an appropriate transfer mechanism under Applicable Privacy Laws, which may include:
- transfers to countries with an adequacy decision;
- Standard Contractual Clauses (and UK addenda where applicable); and/or
- other lawful transfer tools.
Upon request, Pam Terminal will provide information reasonably needed for Customer’s transfer impact assessments, subject to confidentiality.
-
Confidentiality of Processing
Pam Terminal will ensure that persons authorized to process Customer Personal Data are bound by confidentiality obligations and process Data only as instructed.
-
Security
Pam Terminal will implement appropriate technical and organizational measures to protect Customer Personal Data against Security Incidents, taking into account the state of the art, costs, and the nature of the processing. A non-exhaustive description is set out in Annex II.
-
Subprocessing
Customer authorizes Pam Terminal to engage Subprocessors to process Customer Personal Data for the Permitted Purpose. Pam Terminal will impose data-protection obligations on Subprocessors no less protective than those in this DPA.
Pam Terminal remains responsible for Subprocessor performance. Subprocessors and service providers include Site hosting providers, email delivery providers, and tools used to receive or store support materials. Payment processing for Customer’s own purchases is performed by Lemon Squeezy as an independent controller/merchant of record for payment data, not as Pam Terminal’s subprocessor of Customer session data.
A list of Subprocessors is available on request at [email protected]. Where required by law, Pam Terminal will give Customer notice of new Subprocessors and a reasonable opportunity to object on reasonable grounds related to data protection. If Customer objects and the parties cannot resolve the objection, Customer may terminate the affected Services as its sole remedy.
-
Cooperation and Data Subject Rights
Taking into account the nature of processing, Pam Terminal will assist Customer by appropriate technical and organizational measures, insofar as possible, for Customer to respond to Data Subject requests under Applicable Privacy Laws.
If Pam Terminal receives a request directly relating to Customer Personal Data, it will, where legally permitted, redirect the request to Customer or notify Customer without undue delay.
-
DPIAs and Prior Consultation
Upon reasonable request, Pam Terminal will provide assistance reasonably required for Customer’s data protection impact assessments and prior consultations with supervisory authorities, to the extent such information is available to Pam Terminal and relates to processing of Customer Personal Data. Customer will bear reasonable costs for disproportionate assistance.
-
Security Incidents
Pam Terminal will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data, and will provide information reasonably available to help Customer meet its notification obligations. Pam Terminal will take reasonable steps to mitigate and remediate the incident.
Notification is not an admission of fault or liability.
-
Deletion or Return of Data
Upon termination of the Services that involve processing of Customer Personal Data, or upon Customer’s written request regarding a specific support submission, Pam Terminal will, at Customer’s choice and subject to technical feasibility, delete or return Customer Personal Data, except where retention is required by law or needed for secure backup cycles that are deleted on a rolling basis.
-
Audit Rights
Upon reasonable written notice, Pam Terminal will make available information necessary to demonstrate compliance with this DPA and, where required by Applicable Privacy Laws, allow audits by Customer or an independent auditor bound by confidentiality, no more than once per year (unless a Security Incident or regulatory request requires more). Audits must avoid unreasonable disruption and protect other customers’ confidential information. Customer may accept third-party audit reports or certifications in lieu of on-site audit where reasonable.
-
Prohibited Data Types
Customer will not instruct Pam Terminal to process special categories of data or data relating to children unless the Services expressly support such processing and the parties agree in writing. Customer remains responsible for classifying data it submits and for redacting unnecessary sensitive content from diagnostics.
-
Processing Duration
Processing continues for the term of the Agreement and any post-termination period needed for deletion, return, or legal retention, and for the period needed to handle individual support tickets containing Customer Personal Data.
-
Modifications to this DPA
Pam Terminal may update this DPA to reflect changes in law, subprocessors, or the Services. Material adverse changes will be notified as described in the Agreement. Continued use after the effective date constitutes acceptance, unless Customer terminates the affected Services as permitted in the Agreement.
-
Annex I – Processing Description
Subject matter and nature
Processing of Personal Data contained in materials Customer submits to Pam Terminal Account Services for support, licensing administration, or related account operations.
Duration
As set out in Section 14.
Types of Personal Data
May include names, usernames, email addresses, company names, IP addresses, device/browser metadata, license and machine identifiers, error-log excerpts, and—only if included by Customer in uploads—session metadata or other operational details from Customer’s Pam Terminal deployment.
Categories of Data Subjects
Customer’s employees, contractors, and other authorized users whose information appears in account, support, or diagnostics materials.
Purpose
Providing and securing support and Account Services as instructed by Customer; not operating Customer’s self-hosted privileged sessions.
-
Annex II – Security Measures
Measures may include, as applicable to Account Services and support handling:
- access control and least-privilege administration;
- encryption of data in transit (TLS) where supported;
- network isolation and firewalling for hosted Site components;
- logging and monitoring of administrative access;
- vulnerability management and dependency updates;
- backup and recovery procedures for hosted Account Services;
- personnel confidentiality and security awareness;
- incident response processes.
Customer is responsible for complementary measures in its environment for Licensed Software deployments (patching, IdP hardening, network segmentation, vault controls, and recording storage controls).