Data Processing Addendum
Last updated: May 27, 2026
This Data Processing Addendum (“DPA”) template forms part of an agreement between a client (“Controller”) and Native Bridge, LLC (“Processor”) where Native Bridge processes personal data on the Controller’s behalf. It is provided as a starting point and is subject to negotiation and counsel review before execution.
1. Scope and roles
The Controller determines the purposes and means of processing; Native Bridge processes personal data only on documented instructions from the Controller, except where required by law.
2. Subject matter and duration
Processing is limited to what is necessary to provide the agreed services and continues for the term of the underlying agreement, after which data is returned or deleted at the Controller’s election.
3. Security measures
Native Bridge implements appropriate technical and organizational measures, including access controls, encryption in transit, and least-privilege practices, proportionate to the risk.
4. Sub-processors
The Controller authorizes the use of vetted sub-processors under written terms no less protective than this DPA. Native Bridge remains responsible for sub-processor performance and will give notice of intended changes.
5. Data-subject requests and assistance
Native Bridge will assist the Controller in responding to data-subject rights requests and in meeting obligations relating to security, breach notification, and impact assessments (including GDPR Art. 28, CCPA/CPRA service-provider obligations, PIPEDA, and Quebec Law 25).
6. Personal-data breach
Native Bridge will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller’s data and will cooperate on remediation.
7. International transfers
Where personal data is transferred across borders, the parties will implement appropriate transfer mechanisms and safeguards.
8. Return or deletion
On termination, Native Bridge will, at the Controller’s choice, return or delete the personal data unless retention is required by law.
To request an executable DPA for your engagement, contact legal@nativebridge.ai.