Data Processing Addendum

The Processor processes personal data for the duration of the underlying agreement, solely to provide and support the Services as instructed by the Controller.

Processing covers hosting, storage, transmission, and analysis necessary to deliver the agreed white-label platforms and related support.

Typically: identification and contact data, account credentials, usage data, and any business records the Controller chooses to upload. Data subjects include the Controller's employees, customers, and prospects.

• Process personal data only on documented instructions from the Controller.
• Ensure persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational measures.
• Assist the Controller in responding to data subject requests.
• Notify the Controller without undue delay of any personal data breach.
• Delete or return personal data at the end of the Services, except where retention is required by law.

The Controller authorises the Processor to engage sub-processors (such as cloud hosting, email, and analytics providers) under written terms that impose equivalent protection. A current list is available on request.

Where personal data is transferred to a country without an adequacy decision, the parties will rely on Standard Contractual Clauses or another lawful transfer mechanism.

The Processor will make available to the Controller information necessary to demonstrate compliance with this DPA and allow for audits on reasonable notice, subject to confidentiality.

Clients who require a counter-signed copy of this DPA can request one by emailing hello@auradynamics.management.