Data Processing Agreement

Version 1.2 · Last updated: September 29, 2026

This Data Processing Agreement (“DPA”) forms part of the Master Services Agreement (the “Agreement”) between Migna Safety Solutions LLC(“Processor,” “Migna”) and the customer identified on the Order Form (“Controller,” “Customer”). Capitalized terms not defined here have the meaning given in the Agreement.

1. Roles & scope

1.1 For personal information contained in worker and safety records that Customer and its Users submit to the Service (“Customer Personal Data”), Customer is the controller and Migna is the processor, processing only on Customer’s documented instructions.

1.2 Customer’s instructions are: (a) this DPA and the Agreement; (b) Customer’s use and configuration of the Service; and (c) any further written instructions Customer gives that are consistent with the Service. Migna will inform Customer if, in its reasonable opinion, an instruction violates applicable data-protection law.

1.3 This DPA applies to the extent Migna processes Customer Personal Data subject to applicable data-protection laws.

2. Processor obligations

Migna will:

2.1 Purpose limitation. Process Customer Personal Data only to provide and support the Service and per Customer’s instructions, and not for its own purposes, not sell it, and not use it to train AI models.

2.2 Confidentiality. Ensure personnel authorized to process Customer Personal Data are bound by confidentiality obligations and access it only as needed.

2.3 Security. Implement and maintain the technical and organizational measures described in Annex II, appropriate to the risk.

2.4 Sub-processors. Use only the sub-processors listed in Annex III or others engaged under Section 4.

2.5 Assistance. Taking into account the nature of the processing, provide reasonable assistance to Customer for: (a) responding to data-subject requests (Section 3); (b) security, breach notification, and data-protection impact assessments; and (c) demonstrating compliance under Section 5.

2.6 Breach notification. Notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, with the information reasonably available to help Customer meet its own notification obligations.

2.7 Return or deletion. On termination or expiration, make Customer Personal Data available for export for thirty (30) days, then delete it, except where retention is required by law or reasonably needed for backups, security, or dispute resolution (with continued protection until deleted).

3. Data-subject requests

If Migna receives a request from a data subject (e.g., a worker) to exercise rights of access, correction, deletion, or restriction, Migna will refer the request to Customer and, taking into account the nature of the processing, reasonably assist Customer in responding. Customer, as controller, is responsible for responding to data-subject requests.

4. Changes to sub-processors

4.1 Customer authorizes Migna to engage the sub-processors listed in Annex III.

4.2 Migna will give Customer notice (to account admins and/or by updating the sub-processor list) before adding or replacing a sub-processor, at least 15 days in advance where practicable. Customer may object on reasonable data-protection grounds within 15 days; if the parties cannot resolve the objection, Customer may terminate the affected subscription and receive a pro-rata refund of prepaid, unused fees.

4.3 Migna remains responsible for its sub-processors’ performance of the obligations in this DPA.

5. Audits

Migna will make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits by Customer or an auditor Customer mandates, no more than once per year (or after a breach), on reasonable prior notice, during business hours, subject to confidentiality and without unreasonably disrupting Migna’s operations. Migna may satisfy audit requests by providing its security documentation and sub-processors’ certifications where available.

6. International transfers

Customer Personal Data is stored in the United States (see Annex I). If Migna transfers Customer Personal Data across borders in a way that requires a transfer mechanism under applicable law, the parties will put an appropriate mechanism in place.

7. Liability & precedence

This DPA is subject to the limitation-of-liability provisions of the Agreement. For data-protection matters, this DPA controls over any conflicting term of the Agreement.

Annex I — Details of processing

Annex II — Technical & organizational measures

Migna maintains administrative and technical safeguards appropriate to the Service, including:

• Tenant isolation — each Customer’s data in its own single-tenant database.
• Authentication — passwords stored using salted scrypt hashing; signed, HTTP-only session cookies; enforced session secrets in production.
• Access control — role-based access (admin vs. member); least-privilege access to production systems by Migna personnel.
• Abuse protection — rate limiting on authentication and AI endpoints; security headers and Content-Security-Policy.
• Encryption — TLS in transit; encryption at rest provided by the hosting and database sub-processors.
• Logging — audit-log of sensitive actions; operational logs for security and reliability.
• Backups & recovery — point-in-time restore enabled on the Customer database.
• Monitoring — uptime monitoring and error monitoring on production.
• Deletion — data export on termination and deletion after the retention window per Section 2.7.

Annex II.a — Demonstration instances

A public demonstration instance is a separate installation with its own database, containing generated sample data only. It processes no Customer Data and is out of scope of this Agreement. Visitors share one limited account and the instance is wiped and reseeded daily; anything a visitor enters is visible to other visitors until then, and the demo states this on every screen.

Annex III — Approved sub-processors

Migna Safety Solutions LLC · Miami, FL · info@mignasafetysolutions.com