1. Roles and Definitions

The B2B Enterprise Client acts as the strict Data Controller. CapsuLabs Dynamics Ltd (Co. No. 517329447) acts as the Data Processor, analyzing telemetry and generating data via CapsuleAI.

2. Subprocessor Authorization

The Controller yields general authorization for CapsuLabs to engage secure subprocessors (e.g., AWS, Azure, third-party PCR labs). CapsuLabs will provide 14 days' written notice of any subprocessor changes.

3. Israeli Data Security Obligations

The Processor shall maintain a security posture strictly aligned with the Israeli Privacy Protection Regulations (Data Security) 2017 (Level: Medium/High Security tier), including annual penetration testing, strict RBAC (Role-Based Access Control), and hardware encryption.

4. Breach Notification Protocol

Upon detecting a confirmed data breach impacting the Controller's data, the Processor shall notify the Controller without undue delay, and no later than 48 hours, providing actionable mitigation data to fulfill GDPR and Israeli law mandates.

5. Post-Contract Deletion Rules

Upon termination of the Master Service Agreement, CapsuLabs will cryptographically wipe all Personal Data attributable to the Controller within 60 days. Exception: CapsuLabs indefinitely retains an irrevocable right to perpetually keep aggressively anonymized, non-identifiable environmental data for AI training.

6. Governing Language

This DPA is published in English and Hebrew. For Controllers ordinarily resident in Israel or where Hebrew was elected as the contract language, the Hebrew version controls; for all other Controllers, the version corresponding to the language of execution controls. Where any inconsistency arises, both versions will be read together to give reasonable effect to the parties' intent and to mandatory data-protection law.

Data Processing Agreement (DPA)