Data processing agreement

This Data processing agreement (“DPA”) forms part of the agreement between [Danphe Council legal entity] (“Processor”) and the customer organisation (“Controller”) for the Danphe Council Service. A signed copy is available on request from legal@danphe.ai.

1. Subject matter and duration

The Processor processes Customer Content and user account data to provide the Service, for the duration of the agreement and the deletion period that follows it.

2. Nature and purpose

Storage, retrieval, analysis by AI models, generation of answers, verification and audit records, as instructed by the Controller through its use of the Service.

3. Processor obligations

• Process personal data only on the Controller's documented instructions.
• Ensure that personnel with access are bound by confidentiality.
• Apply the technical and organisational measures described on the security page, including per-tenant encryption and row-level isolation.
• Not use Customer Content to train AI models.
• Assist the Controller with data-subject requests, security, breach notification and impact assessments.
• Notify the Controller of a personal-data breach without undue delay, and within 72 hours of becoming aware of it.

4. Sub-processors

The Controller authorises the sub-processors listed on the sub-processors page. The Processor gives 30 days' notice of new sub-processors, and the Controller may object on reasonable grounds.

5. Deletion and return

At the end of the agreement the Processor makes Customer Content available for export for 30 days and then deletes it, including by destroying the tenant's encryption key, unless the law requires retention.

6. Audits

The Processor makes available the information needed to demonstrate compliance. Until independent audit reports exist, this is provided through written answers to reasonable security questionnaires.

7. International transfers

[To be completed: Standard Contractual Clauses / UK addendum as applicable.]