Version: 6.0 · Effective Date: June 15, 2026 · Last Updated: June 15, 2026
This Data Processing Agreement (“DPA”) forms part of and is incorporated into the brainCloud Terms of Service, any applicable Order Forms, and other agreements governing Customer’s access to and use of the Services (collectively, the “Agreement”).
This DPA governs the Processing of Personal Data by bitHeads Inc., operating as brainCloud (“brainCloud”), on behalf of Customer in connection with the Services.
The purpose of this DPA is to establish the parties’ respective rights and obligations regarding the Processing of Personal Data and to support compliance with applicable Data Protection Laws.
This DPA applies solely to Personal Data processed by brainCloud on behalf of Customer where brainCloud acts as a Processor, service provider, or equivalent role under applicable Data Protection Laws.
This DPA does not apply to Personal Data processed by brainCloud as a Controller, including information processed in connection with:
Such Processing is governed by the brainCloud Privacy Policy.
This DPA shall be read together with:
Each document serves a distinct purpose and shall be interpreted consistently where reasonably possible.
In the event of any conflict relating specifically to the Processing of Personal Data, the following order of precedence shall apply:
1. applicable Order Form or written amendment; 2. this DPA; 3. applicable Service Level Agreement; 4. Terms of Service; 5. Privacy Policy; and 6. remaining incorporated policies.
For avoidance of doubt, this DPA controls solely with respect to Personal Data Processing obligations.
The parties intend that this DPA support compliance with applicable privacy and data protection laws, including where applicable:
This DPA applies solely to the publicly hosted brainCloud Backend-as-a-Service platform and related services made available under the Agreement.
Customer-hosted deployments, private licensed deployments, dedicated environments, professional services engagements, consulting services, and other arrangements may be governed by separate agreements.
For purposes of this DPA:
“AI Inputs” means prompts, instructions, content, files, data, messages, requests, queries, and other materials submitted to AI Services.
“AI Outputs” means responses, recommendations, analyses, summaries, classifications, generated content, code, and other outputs produced through AI Services.
“Controller” includes controller, business, or equivalent role under applicable Data Protection Laws.
“Customer Personal Data” means Personal Data contained within Customer Data or End User Data processed by brainCloud on behalf of Customer.
“Data Protection Laws” means all applicable privacy, data protection, information governance, consumer privacy, and related laws applicable to Processing activities governed by this DPA.
“Data Subject” means an identified or identifiable natural person to whom Personal Data relates.
“End User” means an individual who accesses, uses, or interacts with a Customer Application.
“End User Data” means information relating to End Users processed through the Services on behalf of Customer.
“Personal Data” means personal information, personal data, or similar information relating to an identified or identifiable individual as defined by applicable Data Protection Laws.
“Processor” includes processor, service provider, contractor, or equivalent role under applicable Data Protection Laws.
“Restricted Transfer” means a transfer of Personal Data that is subject to restrictions under applicable Data Protection Laws.
“Security Incident” means unauthorized access to, acquisition of, disclosure of, alteration of, destruction of, loss of, or inability to access Personal Data.
Security Incidents do not include unsuccessful attempts or activities that do not materially compromise the security, confidentiality, integrity, or availability of Personal Data, including routine scans, probes, denial-of-service attempts, firewall blocks, or similar events.
“Services” means the publicly hosted brainCloud Backend-as-a-Service platform, APIs, SDKs, administrative tools, AI Services, infrastructure, and related functionality governed by the Agreement.
“Subprocessor” means a third party engaged by brainCloud to process Personal Data on behalf of brainCloud in connection with providing the Services.
“Supervisory Authority” means any governmental, regulatory, privacy, data protection, consumer protection, or similar authority having jurisdiction over Processing activities governed by this DPA.
Customer acts as Controller with respect to Customer Personal Data processed through the Services.
Customer is solely responsible for:
brainCloud acts as Processor solely with respect to Customer Personal Data processed on behalf of Customer through the Services.
brainCloud shall Process Customer Personal Data only:
If brainCloud reasonably believes that a Customer instruction violates applicable Data Protection Laws, brainCloud may suspend execution of the instruction and notify Customer.
brainCloud shall inform Customer if, in its opinion, an instruction infringes applicable Data Protection Laws.
Nothing in this DPA limits brainCloud’s role as Controller with respect to Personal Data processed for:
Such Processing is governed by the Privacy Policy and applicable laws.
Customer remains solely responsible for:
brainCloud does not determine how Customer Applications collect, use, disclose, or otherwise process Personal Data.
Except where expressly agreed in writing, the parties do not intend to create a joint controller relationship under applicable Data Protection Laws.
Customer instructs brainCloud to Process Customer Personal Data as reasonably necessary to:
Customer’s documented instructions consist of:
Customer shall not instruct brainCloud to Process Personal Data in violation of applicable law.
If brainCloud reasonably believes that a Customer instruction violates Data Protection Laws, brainCloud may suspend execution of the instruction and notify Customer.
Where brainCloud is required by applicable law to Process Customer Personal Data other than as instructed by Customer, brainCloud shall inform Customer before such Processing unless prohibited by law.
The subject matter, duration, categories of Data Subjects, categories of Personal Data, and purposes of Processing are described in Schedule 1 to this DPA.
brainCloud shall not sell Customer Personal Data and shall not Process Customer Personal Data for purposes unrelated to providing the Services except as expressly permitted by this DPA or required by applicable law.
brainCloud may make artificial intelligence, machine learning, large language model, generative AI, recommendation, classification, automation, and other AI-powered functionality (“AI Services”) available as part of the Services.
AI Services may be provided directly by brainCloud or through approved third-party AI providers acting on behalf of brainCloud.
Customer may submit AI Inputs to AI Services in connection with Customer’s use of the Services.
Customer remains solely responsible for:
AI Services may generate AI Outputs based upon AI Inputs.
AI Outputs may be stored, displayed, transmitted, processed, logged, or otherwise handled as necessary to provide the Services.
Customer remains solely responsible for reviewing, validating, and determining the appropriateness of AI Outputs before relying upon them.
Where AI Services are enabled by Customer, Customer instructs brainCloud to Process Customer Personal Data contained within AI Inputs and AI Outputs solely as necessary to:
brainCloud shall not use:
to train artificial intelligence or machine learning models.
This restriction applies to AI Services operated by brainCloud and to AI-related Processing performed on behalf of Customer.
brainCloud may engage approved third-party AI providers as Subprocessors.
Where supported by the applicable provider, brainCloud shall configure such services to prohibit the use of Customer Personal Data, AI Inputs, and AI Outputs for model training purposes.
brainCloud shall not knowingly direct any approved AI provider to use Customer Personal Data, AI Inputs, or AI Outputs for model training unless expressly instructed by Customer.
Customer acknowledges that AI Services are probabilistic technologies and may generate inaccurate, incomplete, misleading, outdated, biased, offensive, or unexpected outputs.
Nothing in this DPA shall be interpreted as creating any guarantee regarding the accuracy, reliability, legality, or suitability of AI Outputs.
To the extent an AI provider Processes Customer Personal Data, such provider shall be considered a Subprocessor and shall be subject to Section 12 (Subprocessors) of this DPA.
brainCloud shall ensure that persons authorized to Process Customer Personal Data are subject to appropriate confidentiality obligations.
Such obligations may arise through:
brainCloud shall limit access to Customer Personal Data to personnel, contractors, Subprocessors, and service providers who have a legitimate business need to access such information in connection with providing the Services.
brainCloud may maintain privacy, security, and confidentiality training programs appropriate to the nature of the Services and Customer Personal Data Processed.
Confidentiality obligations applicable to individuals authorized to Process Customer Personal Data shall survive termination of employment, contractor relationships, or other authorized access arrangements.
Nothing in this DPA prevents brainCloud from disclosing Customer Personal Data where required by applicable law, court order, governmental authority, or regulatory obligation.
Where legally permitted, brainCloud shall use commercially reasonable efforts to notify Customer prior to such disclosure.
brainCloud shall maintain administrative, technical, and organizational safeguards designed to protect Customer Personal Data against unauthorized access, disclosure, alteration, destruction, loss, misuse, or other unauthorized Processing.
brainCloud shall implement security measures appropriate to the nature of the Processing, taking into account:
The security measures maintained by brainCloud are described in Schedule 2 to this DPA.
brainCloud may modify security measures from time to time provided that such modifications do not materially reduce the overall level of protection provided to Customer Personal Data.
brainCloud shall maintain controls designed to restrict access to Customer Personal Data to authorized personnel and authorized service providers.
brainCloud may utilize encryption technologies designed to protect Customer Personal Data during transmission and, where appropriate, during storage.
The specific encryption methods utilized may vary depending on operational requirements, deployment models, and technological developments.
brainCloud may maintain monitoring, logging, auditing, and diagnostic systems designed to:
brainCloud may conduct vulnerability assessments, penetration testing, security reviews, audits, and other security evaluation activities designed to assess and improve the security of the Services.
Customer remains responsible for:
brainCloud shall maintain procedures designed to identify, investigate, respond to, mitigate, remediate, and document Security Incidents.
Upon becoming aware of a Security Incident affecting Customer Personal Data, brainCloud shall notify Customer without undue delay and in accordance with applicable legal and contractual requirements.
To the extent reasonably available, notifications may include:
brainCloud may provide information in phases as additional information becomes available.
brainCloud shall provide reasonable cooperation and assistance to Customer regarding investigation, mitigation, remediation, and legally required notifications arising from a Security Incident.
Notification of a Security Incident does not constitute an admission of fault, liability, wrongdoing, breach of contract, or violation of law.
Customer remains responsible for determining whether notifications to:
are required under applicable law.
brainCloud may maintain records relating to Security Incidents for legal, operational, compliance, security, and business continuity purposes.
Customer shall promptly report suspected vulnerabilities, unauthorized access, security weaknesses, or other security concerns affecting the Services upon discovery.
Nothing in this DPA shall restrict disclosures made in accordance with applicable law or an authorized vulnerability disclosure program published by brainCloud.
Following a Security Incident materially affecting Customer Personal Data, brainCloud may preserve logs, records, forensic artifacts, and other relevant information for a reasonable period to support investigation, remediation, legal compliance, and defense of claims.
Taking into account the nature of the Processing and the information available to brainCloud, brainCloud shall provide reasonable assistance to Customer in responding to requests from Data Subjects exercising rights under applicable Data Protection Laws.
Such rights may include:
Customer remains solely responsible for:
Nothing in this DPA transfers Customer’s obligations as Controller to brainCloud.
If brainCloud receives a request directly from a Data Subject relating to Customer Personal Data for which Customer acts as Controller, brainCloud may:
Unless required by applicable law, brainCloud shall not independently respond to such requests without Customer authorization.
Where reasonably available, brainCloud may provide:
designed to assist Customer in responding to Data Subject requests.
brainCloud shall not be required to:
Where Customer requests assistance beyond that reasonably required by applicable law or beyond standard functionality provided through the Services, brainCloud may charge reasonable fees for such assistance.
Where permitted by applicable law, Customer remains responsible for validating the authority of agents, representatives, guardians, or other third parties submitting requests on behalf of Data Subjects.
Taking into account the nature of the Processing and information available to brainCloud, brainCloud shall provide reasonable assistance to Customer in connection with Data Protection Impact Assessments (“DPIAs”) where required by applicable Data Protection Laws.
Such assistance may include:
brainCloud shall provide reasonable cooperation with Customer in connection with lawful inquiries, investigations, audits, inspections, or requests from Supervisory Authorities relating to Customer Personal Data Processed under this DPA.
Where brainCloud receives a legally binding request from a Supervisory Authority relating specifically to Customer Personal Data, brainCloud shall notify Customer without undue delay unless prohibited by law.
brainCloud is not responsible for representing Customer before any Supervisory Authority, court, tribunal, governmental authority, or regulatory body.
Where assistance requested by Customer exceeds assistance reasonably required by applicable law, brainCloud may recover reasonable costs associated with providing such assistance.
brainCloud does not provide legal advice.
Customer remains responsible for obtaining its own legal, privacy, regulatory, and compliance advice regarding Customer’s obligations under applicable Data Protection Laws.
brainCloud shall not be required to disclose trade secrets, source code, proprietary algorithms, confidential security information, information relating to other customers, or information that would materially increase security risks when providing assistance under this Section.
brainCloud shall make available information reasonably necessary to demonstrate compliance with this DPA.
Such information may include:
The parties agree that compliance verification shall proceed in the following order:
Customer shall use lower-impact verification methods before requesting more intrusive audit activities.
Customer may conduct or request an audit no more than once during any twelve (12) month period unless:
Customer shall provide at least thirty (30) days’ prior written notice before conducting an audit.
Audits must:
Any third-party auditor engaged by Customer must:
Customer shall bear its own audit costs.
Customer shall also reimburse brainCloud for reasonable costs incurred in supporting audits except where a material breach of this DPA is identified.
Nothing in this DPA requires brainCloud to disclose:
where such disclosure would materially increase security risks or compromise brainCloud’s confidential information.
Nothing in this DPA grants Customer unrestricted, continuous, unlimited, or real-time audit rights.
Customer hereby grants brainCloud general authorization to engage Subprocessors in connection with providing the Services.
brainCloud shall impose contractual obligations on Subprocessors that are designed to provide protections for Customer Personal Data substantially similar to those required under this DPA.
brainCloud shall remain responsible for the performance of its obligations under this DPA to the extent required by applicable Data Protection Laws.
The Subprocessor List may identify:
brainCloud may add, replace, or remove Subprocessors from time to time.
Where required by applicable law or applicable agreements, brainCloud shall provide notice of material Subprocessor changes.
Where required by applicable law, Customer may object to the appointment of a new Subprocessor on reasonable data protection grounds.
Any objection must:
Upon receipt of a valid objection, the parties shall work in good faith to identify a commercially reasonable resolution.
Potential resolutions may include:
If the parties cannot resolve an objection through reasonable efforts, Customer’s sole remedy shall be to discontinue use of the affected Service and terminate the affected portion of the Services in accordance with the Agreement.
Subprocessors may include:
brainCloud may immediately replace a Subprocessor where reasonably necessary to:
brainCloud shall provide notice of such changes where reasonably practicable.
Customer acknowledges that brainCloud, its Affiliates, and its Subprocessors may Process Customer Personal Data in multiple jurisdictions in connection with providing the Services.
Such jurisdictions may include Canada, the United States, member states of the European Union, the United Kingdom, and other jurisdictions in which brainCloud or its approved Subprocessors operate.
Customer acknowledges that the provision of cloud-based services may require cross-border Processing activities, including storage, transmission, support, security monitoring, backup, disaster recovery, and operational support activities.
Where Customer Personal Data is subject to transfer restrictions under applicable Data Protection Laws, brainCloud shall implement appropriate safeguards designed to support lawful transfers.
Such safeguards shall be appropriate to the nature of the Processing, the applicable legal requirements, and the transfer mechanism relied upon.
Where required by applicable Data Protection Laws, brainCloud may rely upon one or more of the following transfer mechanisms:
The specific mechanism utilized may vary depending upon applicable law, the location of the parties, the nature of the Processing, and operational requirements.
Where the Services permit Customer to select hosting regions, deployment locations, or processing locations, Customer remains responsible for determining whether such selections satisfy Customer’s legal, contractual, regulatory, and compliance obligations.
brainCloud does not provide legal advice regarding jurisdictional requirements, residency obligations, localization requirements, or transfer restrictions applicable to Customer.
Where legally permitted, brainCloud shall use commercially reasonable efforts to notify Customer of governmental requests seeking access to Customer Personal Data before disclosure.
Where notification is prohibited by law, brainCloud shall comply with applicable legal restrictions and may disclose Customer Personal Data only to the extent legally required.
Where required by applicable Data Protection Laws, brainCloud may conduct or support reasonable transfer impact assessments relating to Restricted Transfers.
Such assessments may consider:
Customer acknowledges that approved Subprocessors may participate in Restricted Transfers and may Process Customer Personal Data in jurisdictions different from those selected by Customer.
Such Processing shall remain subject to the safeguards described in this DPA.
The parties acknowledge that applicable transfer mechanisms may evolve over time.
Where an existing transfer mechanism becomes unavailable, invalid, or legally insufficient, the parties shall cooperate in good faith to implement an alternative legally recognized transfer mechanism reasonably necessary to support continued Processing activities.
Except where expressly agreed in writing, nothing in this DPA shall be interpreted as creating a commitment that Customer Personal Data will remain exclusively within any particular jurisdiction, region, country, or geographic area.
Upon termination or expiration of the Agreement, brainCloud shall, at Customer’s election and subject to the terms of the Agreement:
Such actions shall occur within a commercially reasonable period following termination, subject to applicable retention obligations and operational requirements.
Customer is responsible for exporting, retrieving, or otherwise obtaining Customer Personal Data before termination of the Services.
brainCloud is not responsible for Customer’s failure to retrieve Customer Personal Data during any applicable transition, retention, or export period.
Where deletion is requested, brainCloud shall delete Customer Personal Data from active production systems within a commercially reasonable period, subject to:
brainCloud may retain Customer Personal Data where reasonably necessary to:
Customer Personal Data may continue to exist within:
for reasonable periods following deletion from active systems.
brainCloud shall continue to protect such information in accordance with applicable obligations until such information is deleted, overwritten, or otherwise removed through ordinary operational processes.
Nothing in this DPA prevents brainCloud from retaining aggregated, anonymized, statistical, or de-identified information that no longer constitutes Personal Data under applicable Data Protection Laws.
Such information may be used for:
Where Customer Personal Data is subject to:
brainCloud may retain such information until the applicable obligation no longer applies.
Any Customer Personal Data retained pursuant to this Section shall remain subject to the confidentiality, security, and access control obligations applicable under this DPA until such information is deleted.
Except where expressly required by applicable law or separately agreed in writing, brainCloud shall not be required to provide certificates of deletion, destruction attestations, or similar documentation.
The provisions of this Section shall survive termination or expiration of this DPA for so long as brainCloud retains Customer Personal Data pursuant to applicable legal, operational, security, or regulatory obligations.
The liability provisions contained in the Agreement apply to this DPA and all claims arising out of or relating to this DPA.
The parties acknowledge that this DPA forms part of the Agreement and does not constitute a separate agreement for liability purposes.
Except as otherwise expressly provided in the Agreement, the aggregate liability of each party arising out of or relating to this DPA shall be subject to the limitations, exclusions, disclaimers, and liability caps contained in the Agreement.
All liabilities arising under this DPA shall be aggregated with liabilities arising under the Agreement for purposes of calculating applicable liability limitations.
Nothing in this DPA shall be interpreted as:
established under the Agreement unless expressly agreed in writing by the parties.
For clarity, this DPA does not create an independent or additional liability regime separate from the Agreement.
Each party shall remain responsible for fines, penalties, sanctions, damages, liabilities, and regulatory consequences arising from its own acts, omissions, or violations of applicable Data Protection Laws.
Neither party shall be responsible for penalties arising solely from the other party’s violations of applicable law.
Where liability arises from the acts or omissions of both parties, responsibility shall be allocated between the parties according to:
Except to the extent expressly required by applicable law, neither party shall be liable to the other for indirect, incidental, consequential, special, exemplary, punitive, or similar damages arising from this DPA.
Each party shall use commercially reasonable efforts to mitigate damages arising from Security Incidents, privacy events, regulatory actions, or other matters governed by this DPA.
The liability framework contained in the Agreement and this DPA constitutes the exclusive allocation of risk between the parties with respect to Processing activities governed by this DPA.
This DPA is governed by the governing law provisions specified in the Agreement.
The jurisdiction and venue provisions contained in the Agreement shall apply to disputes arising under this DPA.
If any provision of this DPA is determined to be invalid, illegal, or unenforceable, the remaining provisions shall remain in full force and effect.
The parties shall replace any invalid provision with a valid provision that most closely reflects the original intent of the parties.
brainCloud may update this DPA from time to time to reflect:
Material changes shall be communicated in accordance with the Agreement.
This DPA shall bind and benefit the parties and their respective permitted successors and assigns.
No assignment shall relieve either party of obligations arising prior to the effective date of assignment.
This DPA, together with the Agreement and incorporated documents, constitutes the entire agreement between the parties regarding Processing activities governed by this DPA.
Except as expressly required by applicable law, this DPA does not create rights for any third party.
No failure or delay by either party in exercising any right under this DPA shall constitute a waiver of that right.
Any waiver must be in writing and signed by the party granting the waiver.
Headings are included for convenience only and shall not affect interpretation.
References to laws include amendments, replacements, and successor legislation unless the context requires otherwise.
The words “including,” “includes,” and similar terms shall be interpreted to mean “including without limitation.”
Where execution is required, this DPA may be executed electronically and electronic signatures shall be deemed equivalent to original signatures to the fullest extent permitted by applicable law.
Where execution is required, this DPA may be executed in one or more counterparts, each of which shall be deemed an original and all of which together constitute a single instrument.
Provisions relating to:
shall survive termination or expiration of this DPA.
This DPA becomes effective upon the earliest of:
This DPA shall remain in effect for so long as brainCloud Processes Customer Personal Data on behalf of Customer.
This DPA is automatically incorporated into the Agreement and does not require separate execution unless expressly required by applicable law or agreed by the parties.
Termination or expiration of the Agreement automatically terminates this DPA except to the extent that provisions survive pursuant to this DPA or applicable law.
Where brainCloud continues to Process Customer Personal Data following termination solely for purposes permitted under this DPA, such Processing shall remain subject to the applicable provisions of this DPA until deletion or destruction occurs.
Where the parties enter into a replacement DPA, the replacement DPA shall supersede this DPA as of its effective date except with respect to matters arising before such replacement.
The parties acknowledge that privacy and data protection laws may evolve over time.
The parties shall cooperate in good faith to implement modifications reasonably necessary to maintain compliance with applicable Data Protection Laws
SCHEDULE 1
DETAILS OF PROCESSING
This Schedule forms part of the Data Processing Agreement and describes the Processing activities conducted by brainCloud on behalf of Customer.
The subject matter of Processing is the provision of the brainCloud Backend-as-a-Service platform and related Services, including:
Processing activities may include:
Processing may be performed through automated and manual means.
Customer Personal Data may be Processed for purposes including:
Where enabled by Customer:
Customer Personal Data may be Processed:
Data Subjects may include:
Individuals authorized by Customer to access or administer the Services.
Players, users, customers, community members, and other individuals who interact with Customer Applications.
Individuals involved in support, billing, compliance, or administrative activities.
Any other individuals whose information Customer elects to Process through the Services.
Depending upon Customer’s implementation, Customer Personal Data may include:
brainCloud does not intentionally require or request the Processing of special categories of Personal Data.
If Customer elects to Process such information through the Services, Customer remains solely responsible for:
Customer acknowledges that Customer Personal Data may be Processed in multiple jurisdictions as described in the DPA.
SCHEDULE 2
SECURITY MEASURES
brainCloud maintains administrative, technical, and organizational safeguards designed to protect Customer Personal Data.
The specific controls implemented may evolve over time provided that the overall level of protection is not materially reduced.
brainCloud may maintain:
brainCloud may implement:
brainCloud may utilize encryption technologies designed to protect Customer Personal Data:
brainCloud may maintain:
brainCloud may maintain:
brainCloud may maintain processes relating to:
brainCloud may maintain:
brainCloud may maintain governance processes designed to oversee:
brainCloud may maintain procedures designed to:
brainCloud may maintain plans and procedures designed to support:
brainCloud may periodically evaluate, review, test, modify, improve, or replace security measures in response to:
SCHEDULE 3
SUBPROCESSOR LIST
brainCloud maintains its current Subprocessor List through the brainCloud Trust Center at https://getbraincloud.com/subprocessors/.
The Subprocessor List may identify:
The online Subprocessor List, as updated from time to time, governs for purposes of the DPA.
SCHEDULE 4
INTERNATIONAL TRANSFER MECHANISMS
Where required by applicable Data Protection Laws:
The parties shall cooperate in good faith to implement replacement transfer mechanisms where existing mechanisms become unavailable, invalid, or legally insufficient.
We’ll get back to you as soon as we can.
