Data Processing & Digital Preservation Agreement

📅 Effective Date: 2024-10-15 🔄 Last Updated: 2024-12-01 🔗 Hash: 0x8f3a9c2e1d...

01. Preamble & Parties

This Data Processing and Digital Preservation Agreement ("Agreement") is entered into between 1990 Web Archive, Inc. ("Processor") and the entity or individual submitting, accessing, or licensing web content for archival preservation ("Data Controller" / "Client").

The purpose of this Agreement is to establish the legal, technical, and operational framework governing the collection, storage, preservation, and controlled access to digital web assets, ensuring compliance with applicable data protection regulations (including GDPR, CCPA, and sector-specific archival standards).

02. Definitions

  • Archival Asset: Any HTML, CSS, JavaScript, media file, metadata, or associated resource submitted to or crawled by the Archive.
  • Processing: Any operation performed on Personal Data or Archival Assets, including collection, structuring, storage, preservation, formatting, and retrieval.
  • Personal Data: Any information relating to an identified or identifiable natural person contained within submitted or crawled web content.
  • Preservation Format: WARC (Web Archive Resource CDN), IIIF-compliant derivatives, and cryptographically hashed static renders.

03. Scope of Processing & Preservation

1990 Web Archive processes data strictly in accordance with the Client's documented instructions. Processing activities include:

  1. Ingestion & Crawling: Automated capture of URLs, DOM trees, and linked resources using RFC-compliant HTTP/1.1, HTTP/2, and legacy protocol handlers.
  2. Normalization & Fingerprinting: Content deduplication, hash generation (SHA-256/BLAKE3), and metadata extraction.
  3. Long-Term Storage: Geographically distributed, air-gapped tape backup systems and encrypted object storage (AES-256-GCM).
  4. Access & Derivative Generation: On-demand rendering, IIIF image serving, and restricted API endpoints for research use.
Note: Content ingested without explicit Controller instructions is classified as "Public Domain / Orphaned" and governed by the Archive's Public Access Policy, not this Agreement.

04. Security & Integrity Measures

The Processor implements technical and organizational measures to ensure an appropriate level of security:

Control Category Implementation Certification/Audit
Encryption TLS 1.3 in transit, AES-256-GCM at rest, key rotation every 90 days SOC 2 Type II (Annual)
Access Control Zero-trust architecture, RBAC, hardware-backed MFA, just-in-time privileges ISO 27001:2022
Integrity Verification Merkle tree validation, WARC checksums, immutable append-only logs NSA/CSSV Compliance
Incident Response 24/7 SOC, 72-hour breach notification SLA, automated containment playbooks GDPR Art. 33/34 Ready

05. Data Subject Rights & Access Controls

1990 Web Archive facilitates Data Subject requests in accordance with applicable law. Upon receipt of a verified request, the Processor will:

  • Assist the Controller in locating affected records within the Archive's searchable index.
  • Apply preservation-safe redaction techniques that maintain archival integrity while obscuring personally identifiable information (PII).
  • Support Right to Erasure only where legally permissible and technically feasible without compromising historical chain-of-custody. Where erasure conflicts with legal preservation mandates, content will be access-restricted rather than destroyed.
Researcher Access: Academic and institutional researchers may request controlled access via the Archive's IRB-aligned portal. All access logs are retained for 10 years for audit purposes.

06. International Transfers & Sub-processors

Processing occurs primarily within the United States and European Union data centers. Cross-border transfers are governed by EU Standard Contractual Clauses (SCCs) and/or adequacy decisions. Sub-processors providing storage, rendering, or analytics services are contractually bound to equivalent data protection standards.

Current sub-processor list and change notifications are available at archive.1990web.io/subprocessors. The Client may object to a new sub-processor within 14 days of notification.

07. Term, Termination & Data Return

This Agreement remains in effect until terminated by either party with 30 days' written notice. Upon termination:

  • The Processor shall cease processing and securely delete/return Client data within 45 days, unless retention is required by law or archival mandate.
  • Certification of destruction will be provided in writing, signed by an authorized officer.
  • Publicly archived content submitted under the Archive's Open Preservation License remains accessible under the original licensing terms.

08. Acceptance & Contact

By submitting content, integrating via API, or accessing restricted archival endpoints, you acknowledge and agree to the terms outlined in this Agreement. 1990 Web Archive reserves the right to update this document to reflect technological or regulatory changes. Continued use constitutes acceptance.

For legal inquiries, DPA execution, or data protection officer contact:
dpo@1990webarchive.io | +1 (800) 555-1990

Agree to process under these terms?

"}