Data Processing Addendum (DPA) — Summary / Request

Last Updated: [DATE]

A full Data Processing Addendum is available to business customers on request. In summary:

• Roles. For documents you upload, you are the controller and Elevora Holding LLC is the processor. Elevora processes such data only on your documented instructions to provide the Service.
• Sub-processors. As listed on our Sub-Processors page. Elevora remains responsible for its sub-processors' compliance with equivalent obligations.
• Security. Elevora maintains appropriate technical and organizational measures, including encryption in transit and at rest, account-level data isolation, access controls, and audit logging.
• Confidentiality. Personnel with access are bound by confidentiality obligations.
• Breach notification. Elevora will notify you without undue delay, and where applicable within 72 hours of confirmation, of any personal-data breach affecting your data.
• Assistance. Elevora will provide reasonable assistance with data-subject requests and, where applicable, data-protection impact assessments.
• Deletion/return. On termination, Elevora will delete or return your data within a defined period, subject to legal retention requirements.
• International transfers. Where applicable, the parties rely on Standard Contractual Clauses or other lawful transfer mechanisms.

To request the full DPA, contact [CONTACT_EMAIL].