This Data Processing Addendum ("DPA") forms part of the agreement between On Your Terms, Inc. ("Processor") and the customer ("Controller"). It applies to processing of Personal Data by the Processor on behalf of the Controller in connection with the Service.
1. Definitions
Capitalized terms not defined here have the meaning in GDPR Art. 4.
2. Subject matter and duration
The Processor will process Personal Data only as needed to provide the Service for the term of the agreement and for up to 30 days after termination for deletion.
3. Nature, purpose, categories
- Nature/purpose: providing AI-assisted legal infrastructure, including site scanning, AI policy generation, drift detection, audit logging.
- Data subjects: Controller's employees, contractors, end users.
- Categories of personal data: identifiers (name, email), account credentials, business context submitted to AI, usage data, IP, device.
- Special categories: none expected; Controller agrees not to submit special categories.
4. Processor obligations (Art. 28)
The Processor will:
- process Personal Data only on documented instructions from the Controller;
- ensure personnel are bound by confidentiality;
- implement appropriate technical and organizational measures (Annex II);
- respect conditions for engaging Sub-Processors (Section 6);
- assist the Controller in responding to data subject requests;
- assist the Controller with security, breach notification, DPIAs and consultations;
- delete or return Personal Data on termination at Controller's choice;
- make available all information necessary to demonstrate compliance and contribute to audits (Section 8).
5. Security
The Processor implements measures appropriate to the risk, including those described in Annex II.
6. Sub-processors
The Controller authorizes the Processor to engage Sub-Processors listed at /trust. The Processor will provide 30 days' notice of new Sub-Processors. The Controller may object; if the objection cannot be resolved, the Controller may terminate the affected portion of the Service.
7. International transfers
For transfers from the EEA, UK or Switzerland, the parties incorporate the EU Standard Contractual Clauses (2021/914) and the UK Addendum, with the Controller as data exporter and the Processor as data importer; Module Two applies (controller-to-processor).
8. Audits
Once per 12-month period (or more often if required by an authority or following a breach), the Controller may audit the Processor's compliance, with 30 days' notice, during business hours, and subject to confidentiality. The Processor may satisfy this through SOC 2, ISO 27001 reports or equivalent.
9. Breach notification
The Processor will notify the Controller without undue delay (and in any event within 72 hours) of becoming aware of a Personal Data breach, with the information required by Art. 33(3).
10. Deletion/return
On termination, the Processor will delete or return all Personal Data within 30 days, except where law requires retention.
11. Liability
Liability under this DPA is subject to the limitations in the underlying agreement.
12. Order of precedence
In a conflict, this DPA prevails for matters of personal-data protection.
Annex I — Parties and processing
- Data exporter / Controller: the customer entity that accepted the agreement.
- Data importer / Processor: On Your Terms, Inc., [STREET ADDRESS], Delaware, USA.
- Competent supervisory authority: the Member State where the Controller has its main establishment or its appointed EU representative.
Annex II — Technical and organizational measures (TOMs)
- TLS 1.2+ in transit, AES-256 at rest.
- Least-privilege access controls; MFA for staff.
- Audit logging and monitoring of administrative actions.
- Vulnerability and dependency scanning on every deploy.
- Backups encrypted and tested.
- Incident response plan reviewed annually.
- Security training for staff.
Annex III — Sub-Processors
See /trust for the current list.
Important Notice
This DPA is provided for On Your Terms' service. Use the platform to generate one for your own service.