Data Processing Addendum

1. Roles, scope and instructions

The customer is controller (or processor for its controller); the operator is processor (or sub-processor). Processing lasts for the service term and covers hosting, storing, retrieving and transmitting account, repository, prompt, session and integration data to deliver requested engineering tasks. Data subjects may include customer personnel, collaborators and people whose data the customer submits.

The operator processes personal data only on documented customer instructions, including transfer instructions, unless applicable law requires otherwise. The operator informs the customer of a legal requirement unless prohibited and flags instructions it believes infringe data-protection law.

2. Confidentiality and security

Authorized personnel must be subject to confidentiality obligations. The operator implements appropriate technical and organizational measures, with the technical baseline described at Security. The parties must assess those measures against the data and risks; no certification is implied.

3. Sub-processors and changes

The customer authorizes the providers listed at Sub-processors, subject to confirmed contracts and locations. The operator must impose equivalent data-protection duties and remains responsible for its sub-processors.

Proposed change process: give at least 30 days’ written notice before adding or replacing a sub-processor and allow reasonable data-protection objections. Parties must agree a remedy or termination of affected processing before the change if an objection cannot be resolved. This is an operator obligation, not an automated product workflow.

4. Assistance and incidents

Taking account of the nature of processing, the operator assists with data-subject requests, security obligations, impact assessments and supervisory-authority consultations. It forwards requests to the customer and does not respond on the customer’s behalf without instruction unless required by law.

The operator notifies the customer/controller without undue delay and within 72 hours of becoming aware of a personal data breach, providing available details of the nature, affected data, likely consequences, mitigation and contact point, with updates as information becomes available.

5. Return, deletion and audits

At the customer’s choice at service end, return or delete personal data and delete copies unless law requires retention. Backups expire according to the disclosed retention schedule; any retained data remains protected and is not used for new processing.

The operator makes information necessary to demonstrate compliance available and allows and contributes to reasonable audits, including inspections by the customer or its mandated auditor, under agreed confidentiality and scheduling safeguards.

6. International transfers

Where required for restricted transfers, the parties must execute the applicable EU Standard Contractual Clauses (SCCs), complete their annexes, assess transfer risks and adopt supplementary safeguards. Confirm the exporter, importer, modules, jurisdictions, locations and mechanisms before processing. This template does not assert that SCCs are already executed.