Contractual safeguards for personal data processed by 10 Seconds on behalf of a Customer under GDPR Article 28.
This Data Processing Agreement ("DPA") is between Sterling and Pierce Holding L.L.C-FZ, Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates (the "Provider"), and the Customer identified in Annex 1 (the "Customer").
This DPA applies only to personal data that the Provider processes on the Customer's behalf in supplying the 10 Seconds service ("Customer Personal Data"). It forms part of the service agreement identified in Annex 1 once accepted by both parties through signature or a binding electronic-acceptance process.
Publication of this document does not, by itself, establish an executed agreement with every website visitor or subscriber. The parties must complete the applicable annexes before the relevant processing or restricted transfer begins. Enterprise Customers subject to GDPR requiring a signed copy may request one by writing to contact@10seconds.io.
The parties' roles depend on their actual activities. Ordinarily, the Customer determines the purposes and essential means of processing and acts as controller, while the Provider acts as processor for Customer Personal Data.
Where the Customer acts as processor for another controller, the Provider acts as its sub-processor. The Customer must have authority to appoint the Provider and issue the relevant instructions.
Purchasing an individual subscription or an Enterprise pack does not, by itself, make the purchaser a controller of other users' data or grant access to their private communications.
"Applicable Data Protection Law" means the data-protection and privacy laws applicable to the relevant processing, including, where applicable, the EU General Data Protection Regulation ("GDPR"), UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection and its implementing measures, and applicable United States state privacy laws.
Processing undertaken by the Provider for its own independently determined purposes — such as its legally required accounting or handling of its own legal correspondence — is outside this DPA's processor instructions. Such processing requires its own lawful basis and is described in the Privacy Policy. This distinction does not permit repurposing Customer Personal Data.
Annex 1 specifies the subject matter, purposes, nature, duration, data categories, and categories of data subjects. Processing includes temporary transmission and handling where applicable, even where no persistent storage occurs.
End-to-end encryption and the absence of retained message history do not automatically remove information from the scope of Applicable Data Protection Law.
The Customer remains responsible for the lawfulness of its instructions, necessary notices and legal bases, and any professional or sector-specific restrictions applicable to its use of the service. This does not remove the Provider's own statutory or contractual responsibilities.
The Provider shall process Customer Personal Data only on the Customer's documented instructions, including instructions concerning transfers, unless processing is required by a law binding on the Provider. Where legally permitted, the Provider shall inform the Customer of that legal requirement before the processing. A foreign request does not, by itself, establish a lawful basis for disclosure under every applicable legal regime.
Initial instructions consist of the service agreement, this DPA, its completed annexes, and the Customer's lawful service settings. Further instructions must be documented and within the agreed service scope, unless separately agreed.
The Provider shall immediately inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. The affected processing may be suspended while the parties resolve the issue. The Provider is not required to carry out an unlawful instruction.
Customer Personal Data shall not be used by the Provider for advertising, independent profiling, sale, unrelated product development, or training general-purpose artificial-intelligence models.
The Provider shall ensure that persons authorised to process Customer Personal Data are bound by appropriate confidentiality obligations and receive access only as necessary for their duties.
The Provider shall implement and maintain technical and organisational measures appropriate to the risks, taking into account the nature of the service, the state of the art, and the circumstances of processing. The agreed measures are specified in Annex 2.
Measures shall be reviewed and tested at appropriate intervals. Changes shall not materially reduce the overall protection of Customer Personal Data during the agreement. Security and availability measures shall respect the agreed ephemeral design. This DPA does not require the creation of message archives or chat backups as a routine security measure.
The Customer grants general written authorisation for the sub-processors identified in the completed Annex 3. No unnamed infrastructure provider is authorised merely by publication of this DPA.
The Provider shall give at least 30 days' prior written notice of an intended addition or replacement, identifying the entity, processing activities, locations, and relevant safeguards. The Customer may object during that period on reasonable data-protection grounds.
The parties shall seek a reasonable solution to an objection. The proposed sub-processor shall not process the affected Customer Personal Data while the objection remains unresolved. If no solution is available, the Customer may terminate the affected service without an early-termination penalty and receive reimbursement of the unused prepaid portion.
Each sub-processor shall be bound by a written agreement imposing substantially equivalent data-protection obligations. The Provider remains responsible to the Customer for performance of those obligations as required by applicable law.
Payment providers are not automatically sub-processors under this DPA. Their status depends on their actual role in the relevant processing (processing a payment on the Customer's behalf vs. acting as independent controller under their own terms).
Processing locations and permitted remote-access locations are identified in Annex 3. Hosting in the European Union does not, by itself, resolve the legal requirements associated with access from another country.
The Provider shall not undertake a restricted international transfer without an applicable lawful transfer mechanism and any necessary supplementary safeguards.
Where EU Standard Contractual Clauses are the appropriate mechanism, the parties shall execute or validly incorporate the applicable clauses, select the correct module and options, and complete all required annexes before the transfer. Eligibility to use the selected clauses must be assessed.
Where required, the parties shall assess relevant destination-country laws and practices (Transfer Impact Assessment) and implement supplementary measures. UAE cross-border requirements and other applicable restrictions must also be addressed.
A reference to "SCCs", encryption, or a provider's privacy policy does not, on its own, complete these requirements. Mandatory transfer clauses prevail over conflicting provisions of this DPA or the service agreement.
Taking account of the nature of processing, the Provider shall assist the Customer through appropriate technical and organisational measures with requests to exercise applicable access, correction, deletion, restriction, objection, portability, and other privacy rights.
Requests received directly by the Provider concerning Customer Personal Data shall be forwarded to the Customer without undue delay. The Provider shall not respond substantively on the Customer's behalf unless instructed or legally required.
Assistance shall be provided in time to enable the Customer to meet applicable deadlines (notably the GDPR one-month deadline, extensible by two months for complex requests). The Provider shall explain relevant technical limitations, including where requested information is no longer available (notably ephemeral chat content).
This assistance does not require reconstructing deleted conversations or collecting additional identifiers solely to identify a person where applicable law does not require it.
The Provider shall notify the Customer without undue delay — and in any event within 72 hours of becoming aware (GDPR Art. 33) — of a personal data breach affecting Customer Personal Data. Notification shall not be postponed until an investigation is complete.
The initial notification shall contain available information about the nature of the breach, affected data and persons, likely consequences, mitigation measures, and a contact for follow-up. Missing information shall be supplied progressively without undue further delay.
The Provider shall take appropriate containment and remediation measures, preserve relevant evidence where lawful and necessary, and reasonably assist the Customer with its assessment and notification obligations.
The Customer determines notifications made in its capacity as controller. This does not prevent the Provider from making notifications independently required by law.
Taking into account the nature of processing and the information available, the Provider shall assist the Customer with security obligations, data protection impact assessments (DPIAs), relevant privacy assessments, and prior consultation with competent authorities where required.
The Provider shall cooperate with competent supervisory authorities in accordance with applicable law. Confidentiality obligations between the parties do not prevent legally required regulatory cooperation.
The Provider shall make available information necessary to demonstrate compliance and allow and contribute to audits, including inspections, by the Customer or an independent auditor mandated by it.
Routine audits shall ordinarily be arranged on 30 days' written notice. Shorter notice is permitted where reasonably necessary because of a personal data breach, credible evidence of material non-compliance, or a competent authority's requirement.
Audits shall use proportionate safeguards for security, confidentiality, and other customers' information. Existing independent assurance material may be considered but shall not eliminate a legally required inspection right.
The Customer ordinarily bears its external auditor's costs. Additional assistance charges must be reasonable, agreed in advance, and must not make mandatory audit or assistance rights ineffective. The Provider bears its own remediation costs.
The Customer instructs the Provider to operate the ephemeral deletion settings described in Annex 1 throughout the service. These instructions do not require retaining messages until the end of the subscription.
At the end of the relevant services, the Provider shall, at the Customer's choice, return or delete remaining Customer Personal Data and delete existing copies, unless applicable law requires retention. Return is possible only for information still available; the Provider cannot return conversations already deleted under the agreed instructions.
Information retained under a legal requirement (notably invoices for 10 years under tax law) shall be limited to what is required, protected, and used only for the permitted purpose, and deleted when that requirement ends. On request, the Provider shall confirm completion of deletion and identify lawful exceptions to the extent permitted.
This section applies where Customer Personal Data is subject to a US state privacy law requiring contractual safeguards for processors, service providers, or contractors. Statutory terms have the meanings given by the applicable law.
For California personal information, the Provider shall:
The Customer may take reasonable and appropriate steps to verify compliant use through the review and audit procedures in this DPA. The Provider certifies that it understands these restrictions and will comply with them.
Applicable assistance, confidentiality, subcontracting, assessment, and deletion requirements under other US state privacy laws (VCDPA, CPA, CTDPA, UCPA, TDPSA, OCPA, and comparable) also apply. This DPA is not a HIPAA Business Associate Agreement and is not a substitute for another mandatory sector-specific agreement (SOC 2 report, GLBA, FERPA, PCI-DSS attestation, etc.).
Requests concerning Customer Personal Data shall be assessed under applicable law, including relevant jurisdiction, confidentiality, and international-transfer requirements (notably GDPR Art. 48 for requests from third-country authorities).
Where permitted, the Provider shall notify the Customer before disclosure and provide reasonable assistance in seeking clarification or appropriate protection. Disclosure shall be limited to information lawfully required or permitted and actually available.
The Law Enforcement Guidelines provide operational information but do not override this DPA, mandatory law, or binding international-transfer safeguards.
This DPA prevails over conflicting provisions of the service agreement concerning processing on the Customer's behalf. Mandatory law and applicable mandatory transfer clauses take precedence.
The service agreement's governing-law provisions apply only insofar as they are compatible with mandatory data-protection rules and applicable transfer instruments.
Nothing in this DPA excludes a party's own statutory duties, restricts a competent authority's powers, or removes non-waivable rights or remedies of individuals. Any contractual allocation of liability between the parties remains subject to those requirements.
| Subject matter and purpose | Supplying the Customer's authorised users with the agreed end-to-end encrypted ephemeral text-communication service (10 Seconds Enterprise pack). |
|---|---|
| Nature of processing | Temporary receipt, routing, and transmission of encrypted communications; handling of technical data strictly necessary to operate the agreed sessions; account administration (creation, renaming, password reset) for sub-accounts under the Enterprise master's control. |
| Data subjects | Authorised users (sub-accounts under the Enterprise pack), their intended communication counterparties, and persons whose information is included in their communications. |
| Personal data categories |
Account: username (pseudonym), bcrypt password hash, encrypted private-key blob (AES-GCM / PBKDF2-SHA256 600 000, not decryptable server-side), NaCl Curve25519 public key, account status/dates, last-login timestamp. Encrypted content: ciphertext of messages during transient relay (never persistently stored). Billing (if applicable): name, email, address, country, company/VAT identifiers — encrypted at rest with Fernet (AES-128-CBC + HMAC-SHA256). Technical: IP addresses in logs within rotation window, user-agent in consent records. |
| Special categories | None processed by the Provider in a readable form. Any special-category data contained within end-to-end encrypted messages is unknown to and inaccessible by the Provider. Customer confirms that its use of the service for special-category data (health, biometric, political, etc.) complies with its own obligations under Applicable Data Protection Law. |
| Frequency and contractual duration | Processing occurs when authorised users operate the service during the agreed subscription term (standard 12 months, renewable). This is not a retention period for individual messages. |
| Ephemeral operation (verified technical facts) |
Chat room lifetime: hard maximum of 30 minutes (1 800 seconds), destroyed server-side on expiry. Early purge: within 30 seconds after all participants leave. Message visibility: 10, 15, or 20 seconds (configurable at room creation; default 10 s), then removed from the chat interface. Server-side storage: volatile memory only; no persistent message database, no chat archive, no chat backup. |
| Deletion events | Chat ciphertext purged from volatile memory on session end (30 min max or 30 s after empty). Account records: on account deletion by Customer or on Customer request. Billing records: retained for 10 years under tax law, then deleted. Legal consent records: retained 5 years, then deleted. |
The Provider implements the following measures, verified against the current production implementation as of the effective date of this DPA:
max-age=31536000; includeSubDomains; preload.HttpOnly, SameSite=Lax, Secure in production.app.log (100 KB rotation, 1 backup), security.log (10 MB rotation, 10 backups), affiliate.log (10 MB rotation, 20 backups). No chat message content is ever written to any log.Written agreements with sub-processors imposing substantially equivalent obligations. Administrative correspondence handled separately from chat processing. See Annex 3 for the current sub-processor list.
TOMs schedule reference and version: 2026.14 (effective 2026-10-22). Next review: within 12 months.
| Sub-processor | Processing activity | Data categories | Hosting / access countries | Transfer mechanism (where applicable to EU data) |
|---|---|---|---|---|
| Stripe, Inc. San Francisco, CA, USA |
Card payment processing (hosted checkout, PCI-DSS) | Card data (not received by Provider), billing name/email transmitted at checkout, transaction references | USA (processing); global edge network | EU Standard Contractual Clauses (Module 1 / Module 2 as applicable); Stripe DPA |
| CoinPayments.net Inc. Vancouver, Canada |
Cryptocurrency payment processing (USDT TRC-20) | Transaction reference and status (no wallet balance or KYC file received by Provider) | Canada (adequacy under GDPR Art. 45 for EU data) | Canadian adequacy decision + CoinPayments standard terms |
| Confidential private hosting provider Identity disclosed to Customer upon signature of this DPA under NDA, and to competent authorities on valid legal request |
Infrastructure hosting (compute, storage, network) | Encrypted blobs, logs within rotation window, ciphertext in transit | European Union and Meydan Free Zone, Dubai (UAE), with encrypted backup replication between those two regions | For UAE portion of EU data: EU Standard Contractual Clauses (Module 2) + Transfer Impact Assessment, supplementary measures (encryption at rest, access control) |
Provider's own processing and remote-access locations: primary operations from the UAE (Dubai) with legally authorised remote access by senior technical personnel; no third-country government access authorised outside the mechanisms described above.
Applicable transfer instrument and completed annexes: EU Standard Contractual Clauses (Decision (EU) 2021/914), to be executed between Provider and Customer for Customer's EU/EEA data transferred outside the EEA. Separate SCCs are in place with each named sub-processor as applicable.
Version 2026.14 · Effective 2026-10-22.
Published by Sterling and Pierce Holding L.L.C-FZ, Meydan Free Zone, Dubai (UAE).
Contact: contact@10seconds.io — single point of contact for DPA signature and all matters.