Data Processing Agreement

Effective date: [DATE]

This Data Processing Agreement ("DPA") forms part of the Terms of Service between [LEGAL ENTITY NAME] ("Underpeaks", "Processor", "Operator") and the customer identified in the account ("Customer", "Controller", "Responsible Party").

This DPA applies where Underpeaks processes Personal Data on the Customer's behalf in the course of providing the Service.

1. Definitions

• Applicable Data Protection Law — POPIA, GDPR, UK GDPR, and any other data protection law applicable to the processing.
• Personal Data — personal information or personal data as defined in Applicable Data Protection Law, processed by Underpeaks on the Customer's behalf.
• Data Subject — the individual to whom Personal Data relates, including the Customer's End Users.
• Sub-processor — a third party engaged by Underpeaks to process Personal Data.
• Security Incident — a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.

Terms not defined here have the meaning given in the Terms of Service.

2. Roles

The Customer is the Controller / Responsible Party. Underpeaks is the Processor / Operator.

The Customer determines the purposes and means of processing Personal Data submitted to the Service. Underpeaks processes it only on the Customer's documented instructions.

Where Underpeaks processes personal information as a Controller in its own right — for example account and billing data of the Customer's own staff — that processing is governed by the Underpeaks Privacy Policy, not this DPA.

3. Subject matter and details of processing

Subject matter: Provision of the Underpeaks Studio platform, including data storage, API access, authentication of End Users, media storage and code generation.

Duration: For the term of the Terms of Service, plus the retention periods described in Section 10.

Nature and purpose: Hosting, storage, retrieval, transmission, authentication, backup and deletion of Personal Data as necessary to provide the Service.

Types of Personal Data: Determined by the Customer. Typically includes: names, email addresses, hashed passwords, account identifiers, profile data, IP addresses, and any other data the Customer chooses to store in its data models or that its End Users submit through applications built on the Service.

Categories of Data Subjects: The Customer's End Users, the Customer's own personnel, and any other individuals whose data the Customer chooses to process through the Service.

Special categories: The Service is not designed for special categories of Personal Data. If the Customer processes such data, the Customer is responsible for ensuring an appropriate lawful basis and additional safeguards.

4. Customer obligations

The Customer:

• warrants that it has a valid lawful basis for the processing it instructs
• is responsible for the accuracy, quality and legality of the Personal Data it submits
• will provide any notices and obtain any consents required from its End Users
• will not instruct Underpeaks to process Personal Data in breach of Applicable Data Protection Law
• is responsible for configuring the Service appropriately, including access controls, roles and API key management

5. Underpeaks obligations

Underpeaks will:

• process Personal Data only on the Customer's documented instructions, including as set out in the Terms and this DPA, unless required otherwise by law (in which case, where legally permitted, Underpeaks will inform the Customer before processing)
• ensure that personnel authorised to process Personal Data are bound by confidentiality obligations
• implement and maintain the technical and organisational measures described in Annex A
• assist the Customer, taking into account the nature of processing, in fulfilling its obligations to respond to Data Subject requests
• assist the Customer with data protection impact assessments and consultations with supervisory authorities, where reasonably required
• notify the Customer of Security Incidents in accordance with Section 8
• delete or return Personal Data at the end of the Service in accordance with Section 10
• make available information reasonably necessary to demonstrate compliance with this DPA

6. Sub-processors

The Customer provides general authorisation for Underpeaks to engage Sub-processors.

Current Sub-processors are listed at [SUB-PROCESSOR URL] [CONFIRM: publish and maintain this page — enterprise buyers will ask]. As at the effective date these include:

Underpeaks will:

• impose data protection obligations on each Sub-processor no less protective than those in this DPA
• remain liable for the acts and omissions of its Sub-processors
• give the Customer at least [30] days' notice before adding or replacing a Sub-processor

If the Customer has a reasonable objection to a new Sub-processor on data protection grounds, it may notify Underpeaks within [15] days of the notice. The parties will discuss in good faith. If no resolution is reached, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees.

7. International transfers

Underpeaks may transfer Personal Data outside the Customer's jurisdiction where necessary to provide the Service.

Where Personal Data originating in the EEA or UK is transferred to a country without an adequacy decision, the parties agree that the European Commission's Standard Contractual Clauses (Module Two: Controller to Processor) are incorporated into this DPA by reference, with:

• Clause 7 (docking clause): included
• Clause 9 (sub-processors): Option 2, general written authorisation, with [30] days' notice
• Clause 11 (redress): the optional independent dispute resolution body is not included
• Clause 17 (governing law): the law of [CONFIRM — commonly Ireland]
• Clause 18 (forum): the courts of [CONFIRM]
• Annex I, II and III: as set out in Annexes A and B of this DPA

For UK transfers, the UK International Data Transfer Addendum applies to the Standard Contractual Clauses.

Where Personal Data originating in South Africa is transferred outside South Africa, the transfer is made in accordance with section 72 of POPIA on the basis of the contractual protections in this DPA.

8. Security incidents

Underpeaks will notify the Customer without undue delay, and in any event within [48] hours, after becoming aware of a Security Incident affecting the Customer's Personal Data.

The notification will include, to the extent known:

• the nature of the incident and categories and approximate number of Data Subjects and records affected
• the likely consequences
• measures taken or proposed to address the incident and mitigate its effects
• a contact point for further information

Underpeaks will take reasonable steps to contain and remediate the incident and will cooperate with the Customer in its own notification obligations to supervisory authorities and Data Subjects.

Notification is not an acknowledgement of fault or liability.

9. Data subject requests

If Underpeaks receives a request from a Data Subject relating to Personal Data processed on the Customer's behalf, it will not respond directly except to confirm that the request should be directed to the Customer, and will forward the request to the Customer without undue delay.

Underpeaks will provide the Customer with the tools within the Service to access, correct, export and delete Personal Data. Where the Customer cannot fulfil a request using those tools, Underpeaks will provide reasonable assistance at the Customer's cost where the assistance requires significant effort.

10. Deletion and return

On termination or expiry of the Service, Underpeaks will:

• make Personal Data available for export by the Customer for [30] days
• thereafter delete Personal Data from active systems within [30] days
• delete Personal Data from backups within [35] days of the backup rotation cycle

Underpeaks may retain Personal Data where required by law, in which case it will continue to protect it in accordance with this DPA and process it only to the extent required.

11. Audit

Underpeaks will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, including relevant certifications and security documentation where available.

Where the Customer reasonably requires further assurance, the Customer may, no more than once per twelve months and on at least [30] days' written notice, conduct an audit limited to information relevant to the processing of its Personal Data. Audits must:

• be conducted during normal business hours
• not unreasonably disrupt operations
• be subject to confidentiality obligations
• be at the Customer's cost, unless the audit reveals material non-compliance

Where a supervisory authority requires an audit, the parties will cooperate as required by law.

12. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service.

13. General

This DPA is incorporated into and forms part of the Terms of Service. In the event of conflict between this DPA and the Terms of Service in relation to data protection, this DPA prevails. In the event of conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

Annex A — Technical and organisational measures

Access control

• Role-based access control within the application (viewer, editor, admin)
• Tenant isolation enforced at the database layer, including row-level security
• Production system access restricted to authorised personnel and reviewed periodically
• Multi-factor authentication on administrative accounts [CONFIRM you have this]

Encryption

• TLS for all data in transit
• AES-256-GCM encryption for stored credentials and integration secrets
• bcrypt password hashing
• Encryption at rest for database and object storage, as provided by our infrastructure providers

Authentication and session management

• Session tokens issued as signed JWTs with limited lifetime
• Tokens stored in httpOnly cookies for browser sessions
• API access controlled by scoped, revocable API keys

Resilience and recovery

• Automated backups with [DAILY] frequency and [35] day retention [CONFIRM]
• Infrastructure hosted on providers with redundancy and failover
• Documented restore procedure

Monitoring and logging

• Application error monitoring
• Access and security event logging
• Rate limiting on public API endpoints

Organisational

• Confidentiality obligations in personnel contracts
• Access granted on a least-privilege basis
• Security review of changes affecting authentication or data access
• Incident response process with defined notification timelines

[CONFIRM each of these against what you actually do. Do not claim measures you have not implemented — this Annex is contractually binding and is the first thing a security reviewer checks.]

Annex B — Standard Contractual Clauses details

Data exporter: The Customer Data importer: [LEGAL ENTITY NAME], [ADDRESS], South Africa Contact: [PRIVACY EMAIL]

Categories of Data Subjects, categories of Personal Data, frequency, nature and purpose of processing, retention: As set out in Section 3 of this DPA.

Competent supervisory authority: As determined under Clause 13 of the Standard Contractual Clauses.