Data Processing Agreement

Document ID: NSS-LEGAL-DPA-001 · Version: 1.0 — May 2026 · Classification: Confidential · Contact: legal@northstarshowsystems.com

1. PARTIES
2. SCOPE AND PURPOSE
3. DETAILS OF PROCESSING
4. PROCESSOR OBLIGATIONS
5. CONTROLLER OBLIGATIONS
6. SECURITY MEASURES
7. SUB-PROCESSORS
8. AUDITS
9. DATA BREACH NOTIFICATION
10. INTERNATIONAL TRANSFERS
11. TERM

1. PARTIES

This Data Processing Agreement (“DPA”) is entered into between the Customer identified in the applicable service agreement (“Controller” or “Customer”) and Northstar Show Systems, LLC (“Processor” or “Northstar”), and supplements the Terms of Service (NSS-LEGAL-TOS-001) and Privacy Policy (NSS-LEGAL-PP-001).

2. SCOPE AND PURPOSE

This DPA applies when Northstar processes Personal Data on behalf of Customer in connection with providing Northstar products and services. “Personal Data” means any information relating to an identified or identifiable natural person, as defined under the EU General Data Protection Regulation (GDPR), UK GDPR, or other applicable data protection laws.

3. DETAILS OF PROCESSING

Element	Description
Subject Matter	Provision of show control products, customer portal, and support services
Duration	Duration of the service agreement plus data retention periods
Nature and Purpose	Account management, support delivery, device telemetry, portal access
Types of Personal Data	Names, email addresses, phone numbers, job titles, IP addresses, login timestamps, support correspondence
Categories of Data Subjects	Customer employees, contractors, and authorized portal users

4. PROCESSOR OBLIGATIONS

Process Personal Data only on documented instructions from Controller, including transfers outside the EEA.
Ensure that persons authorized to process Personal Data are bound by confidentiality obligations.
Implement appropriate technical and organizational security measures (TLS 1.2+, bcrypt hashing, MFA, RBAC, WAF, encryption at rest).
Not engage another processor (sub-processor) without prior written authorization from Controller. See Section 7 for sub-processor terms.
Assist Controller in responding to data subject rights requests (access, rectification, erasure, portability, restriction, objection).
Assist Controller with data protection impact assessments and prior consultations with supervisory authorities, where required.
Delete or return all Personal Data upon termination of the service agreement, unless retention is required by law.
Make available all information necessary to demonstrate compliance and allow for audits (see Section 8).

5. CONTROLLER OBLIGATIONS

Ensure that there is a lawful basis for processing Personal Data and that data subjects have been informed.
Provide documented processing instructions to Processor.
Notify Processor promptly of any data subject requests that require Processor assistance.

6. SECURITY MEASURES

Northstar implements the following technical and organizational measures:

Category	Measures
Encryption	TLS 1.2+ for all connections; HSTS with 1-year max-age; JWT signed with RS256
Authentication	bcrypt (cost 12) password hashing; TOTP/WebAuthn MFA; 15-min access tokens
Access Control	Role-based (13 roles); maximum 3 concurrent sessions; 8-hour inactivity timeout
Network Security	Cloudflare WAF (OWASP Top 10); DDoS protection; rate limiting; CSP headers
Data Protection	Parameterized queries (SQL injection prevention); input validation; XSS protection
Audit	Immutable audit logs; 7-year retention; impersonation logging; login tracking
Infrastructure	Cloudflare global edge (300+ DCs); D1 database replication; 99.9% uptime target
Key Management	RS256 signing keys rotated quarterly

7. SUB-PROCESSORS

Northstar uses the sub-processors listed in the Subprocessor List (NSS-LEGAL-SUBPROC-001). Controller may object to a new sub-processor within 30 days of notification. If the objection cannot be resolved, Controller may terminate the affected services.

Northstar will: (a) notify Controller before adding or replacing a sub-processor; (b) impose data protection obligations on each sub-processor that are no less protective than this DPA; (c) remain liable for the acts and omissions of its sub-processors.

8. AUDITS

Controller may audit Northstar’s compliance with this DPA once per year with 30 days’ written notice, during business hours, at Controller’s expense. Northstar may satisfy audit requests by providing: (a) SOC 2 Type II report (when available); (b) third-party penetration test results; (c) completed security questionnaires. On-site audits require a mutual NDA and reasonable scope limitations.

9. DATA BREACH NOTIFICATION

Northstar will notify Controller without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data breach. Notification will include: (a) nature of the breach; (b) categories and approximate number of data subjects affected; (c) likely consequences; (d) measures taken or proposed to mitigate; (e) contact point for further information.

10. INTERNATIONAL TRANSFERS

Northstar processes data primarily in the United States. For transfers of Personal Data from the EEA/UK to the United States, the Parties agree to the Standard Contractual Clauses (SCCs) adopted by the European Commission (Module 2: Controller to Processor), which are incorporated into this DPA by reference. A copy of the executed SCCs is available upon request.

11. TERM

This DPA is effective for the duration of the service agreement and shall automatically terminate when Northstar no longer processes Personal Data on behalf of Controller. Sections 4(g), 6, and 9 survive termination.

DOCUMENT CROSS-REFERENCES:

Privacy Policy (NSS-LEGAL-PP-001)
Terms of Service (NSS-LEGAL-TOS-001)
Subprocessor List (NSS-LEGAL-SUBPROC-001)

NORTHSTAR SHOW SYSTEMS (PROCESSOR)

Authorized Signature

Printed Name

Title

Date

CUSTOMER (CONTROLLER)