Data Processing Addendum
Business/team customers processing customer data through our service, once a business product is offered. No B2B processing occurs today.
Draft for legal review
This document is an implementation draft written to match how the product actually behaves. It has not been reviewed by a qualified lawyer and must not be relied on as legal advice. Items marked or are unresolved.
1. Status — placeholder, not a contract
We do not currently sell a product that requires a DPA. This page describes the draft structure only and must not be presented or signed as an executed contract. Do not onboard business data until the DPA is finalised and signed.
2. Draft structure (to be finalised with counsel)
- Subject matter, duration, nature/purpose, types of data, categories of data subjects (Annex I).
- Controller/processor roles; processor acts only on documented instructions; confidentiality; assistance with data-subject rights.
- Subprocessors: general/specific authorisation + objection + flow-down terms (Annex III).
- International transfers: 2021/914 SCCs (Modules 2/3 as applicable) + UK IDTA/Addendum + TIA (Annex matching transfer-register.md).
- Security (Art.32): measures in the Security Statement + audit rights; breach notification without undue delay with Art.33(3) details; DPIA assistance.
- Retention/deletion at termination (Art.28(3)(g)); audit/log cooperation; liability allocation with the MSA.
3. What blocks B2B launch
[LEGAL REVIEW REQUIRED — blocking] Finalise SCCs/IDTA, subprocessor list, TIAs, audit mechanics, breach SLAs, and retention/deletion exhibits. Then publish version 1.0.0 with effective date and re-acceptance decision. Version 0.9.0-draft, last updated 2026-10-02.
Sources
This document is derived from the following entries in our legal source registry: EU-GDPR, INT-SCC, UK-GDPR. See for the full citations and the date each source was last verified.