Data Processing Agreement
Version 0.9 review draft
Not an executable agreement. This document is prepared for customer and legal review. The contracting entity, customer, effective date, service description, security measures, subprocessors, transfer mechanism, governing terms, and signatures must be completed and approved before acceptance.
1. Parties and document status
This Data Processing Agreement is intended to form part of the legally approved agreement between the customer identified in an order and the confirmed legal entity that supplies Allocyn. The customer and supplier are each a “party” and together the “parties”.
The final agreement must identify the parties, their roles for each processing activity, the effective date, the services, the order or main terms it supplements, and the person authorized to accept it for each business.
2. Subject matter and duration
The intended subject matter is the processing of personal data needed to provide, secure, support, administer, and end the Allocyn service under the customer’s documented instructions. Processing continues for the subscription and any approved transition, recovery, return, deletion, backup, legal-retention, or dispute period described in the final agreement and annexes.
3. Nature and purpose of processing
Depending on the customer’s configuration, processing may include collecting, receiving, hosting, organizing, displaying, retrieving, connecting, importing, analyzing, reporting, exporting, protecting, restricting, returning, and deleting customer-controlled information. AI-assisted processing may occur only for enabled and supported actions requested by an authorized user.
The final Annex A must describe the selected services and purposes precisely enough to prevent this general description from expanding the customer’s instructions.
4. Categories of data and people
4.1 Possible personal-data categories
Identity, business contact, account, organization, project, portfolio, client, work-item, role, skill, proficiency, schedule, leave, availability, allocation, time, rate, expense, approval, support, integration, audit, security, report, AI prompt, supporting context, output, and feedback information may be processed where selected and authorized.
4.2 Possible categories of people
Customer personnel, workers, contractors, applicants only where lawfully entered for an approved purpose, client contacts, suppliers, prospects, authorized users, administrators, support contacts, and other people represented in customer-controlled records may be concerned.
The customer must remove categories that are not relevant and identify any special-category or sensitive information before execution. Allocyn is not intended for covert monitoring, emotion recognition, or unlawful automated employment decisions.
5. Documented customer instructions
The processor will process customer personal data only on documented instructions contained in the approved agreement, order, configuration, authorized service request, or other written direction, unless applicable law requires processing. Where legally permitted, the processor will inform the customer before legally required processing.
If the processor reasonably considers an instruction to infringe applicable data-protection law, it will inform the customer and may suspend the affected processing while the parties review the instruction. The final agreement must define the operational route for instructions and disputes.
6. Confidentiality and personnel
People authorized to process customer personal data must be subject to appropriate confidentiality obligations, receive access appropriate to their responsibilities, and follow applicable security and privacy procedures. Access must be removed or changed when a responsibility ends or changes.
7. Security of processing
The processor will implement the technical and organizational measures approved in Annex B, taking account of the state of the art, implementation costs, processing nature and scope, and risks to people. Measures must describe verified coverage and must not imply a certification, independent test, recovery objective, location, or control that is not supported by current evidence.
Annex B must address, as applicable, organization separation, roles and permissions, authentication, secret handling, encryption coverage, logging, change management, vulnerability handling, incident response, availability, backup and recovery, deletion, provider management, staff access, and periodic review.
8. Subprocessors
The final agreement must state whether the customer gives specific or general authorization for subprocessors, how advance notice is provided, the reasonable objection route, and the available remedy. Each subprocessor must receive data-protection obligations that provide materially equivalent protection for the relevant service.
Annex C must list the verified legal provider, service purpose, data categories, processing locations, transfer mechanism, and engagement status. A category or proposed provider is not a completed production register.
9. Assistance with individual rights
Considering the nature of processing, the processor will provide reasonable assistance through suitable technical and organizational measures so the customer can respond to requests for access, correction, deletion, restriction, objection, portability, or other applicable rights. The final agreement must define request routing, identity and authorization checks, response information, export boundaries, and fees allowed by law.
If the processor receives a request concerning customer-controlled data, it will normally direct the person to the customer or notify the customer, unless law prevents that step.
10. Security, breach, and impact-assessment assistance
The processor will provide information reasonably available to assist the customer with applicable security duties, personal-data breach assessment, data-protection impact assessments, prior consultation, and regulatory inquiries. The final incident procedure must define monitored contacts, escalation, cooperation, available content, and notification timing without relying on an unsupported fixed promise.
11. Return and deletion
At the end of the service, the processor will return or delete customer personal data as selected in the approved agreement, unless applicable law requires retention. The final annexes must distinguish active workspace information, prepared exports, recovery copies, backups, security evidence, billing and tax records, legal holds, provider-side copies, and records for which the supplier acts as controller.
Deletion from active systems does not imply immediate removal from every backup. The approved schedule must state the relevant cycle or criterion and any restriction on restoring deleted customer information.
12. Information and audit
The processor will make information reasonably necessary to demonstrate the agreed processor obligations available to the customer and support a proportionate review. The final agreement must define evidence scope, confidentiality, frequency, notice, cost, independent reports, on-site conditions, remediation, and safeguards for other customers and service security.
13. International transfers
The parties must not rely on an EU-only location statement unless primary storage, backups, logs, email, support access, integrations, AI processing, administration, and every relevant subprocessor have been verified. Annex D must identify restricted transfers and the lawful mechanism used for each verified flow.
Where required, the approved European Commission Standard Contractual Clauses, module selection, optional clauses, competent supervisory authority, annexes, transfer impact assessment, and supplementary safeguards must be completed and incorporated. This review draft does not attach or execute those clauses.
14. Controller responsibilities
The customer remains responsible for its instructions, purposes, lawful bases, notices, user and workforce transparency, access decisions, data accuracy, retention choices, connected systems, and lawful use of AI-assisted features. The customer must not submit information it is not authorized to process or use Allocyn for prohibited monitoring or decisions.
15. Liability, priority, and changes
Liability, indemnity, governing law, dispute resolution, and document priority must be selected by qualified counsel and aligned with the main agreement and insurance position. If approved terms conflict, the final DPA must state which provision controls for personal-data processing.
Material changes must be versioned, dated, reviewed, and communicated through the procedure agreed with customers. A review draft must not replace an accepted agreement silently.
16. Acceptance and signatures
The final DPA may be accepted through an authorized electronic business process or signed by authorized representatives. The acceptance record must identify the approved version, parties, date, authority, and related order. Version 0.9 cannot be accepted or signed as the operative DPA.
Annex A — Processing details
Status: pending customer scope and legal approval.
- Services and processing purposes
- Duration and processing frequency
- Personal-data and person categories
- Documented special instructions and approved sensitive-data boundaries
- Return, export, retention, and deletion choices
Annex B — Technical and organizational measures
Status: pending production configuration, evidence review, security approval, and completed recovery testing. The public Security page provides qualified buyer information but is not a contractual security schedule.
Annex C — Approved subprocessors
Status: pending verified production provider entities, purposes, locations, contracts, and transfer mechanisms. Review the current Subprocessor Register for the public verification status.
Annex D — Restricted transfers and SCCs
Status: pending complete data-flow mapping, legal role analysis, transfer-impact assessment, SCC module selection, competent authority, and supplementary safeguards.
Version history
Version 0.9 — 4 September 2026. Initial customer and legal review draft. Not approved, effective, executable, or represented as legal advice.