Data Processing Addendum

1. Scope and Roles

• You are the Controller of personal data your end users and customers provide to you; we process that data only on your documented instructions.
• We are the Controller of our own business-contact and website-visitor data (see our Privacy Policy).
• Where the GDPR/UK GDPR applies to you as a Controller, we act as your Processor for project data.

2. Processing Details

• Subject matter: delivery of the software, AI, cloud and consulting services described in your Statement of Work.
• Duration: for the term of the engagement, plus a 30-day grace period for export, then deletion or return.
• Nature and purpose: storage, transmission, analysis (including AI-assisted processing — including via the AI chat assistant, which runs on the open-source Meta Llama model hosted on Cloudflare Workers AI —) and support.
• Data types: the categories of end-user data your application or project handles — typically contact details, account data and usage events. Special-category data is processed only where your SOW expressly requires it, with additional safeguards.
• Data subjects: your customers, prospects, employees and other individuals your systems describe.

3. Your Instructions and Our Confidentiality

• We process personal data only on your documented instructions, including transfers, unless required by law — in which case we inform you first (unless the law forbids).
• Every person with access to personal data is bound by confidentiality obligations that survive the engagement.
• If we believe an instruction infringes the GDPR/UK GDPR or other data-protection law, we will inform you immediately.

4. Security Measures

We implement the technical and organizational measures described in our Security page — encryption in transit and at rest, least-privilege access, secure development practices, and incident response with breach notification — appropriate to the risk of the processing.

5. Sub-Processors

• You give general authorization for us to engage sub-processors listed on our Sub-processors page.
• We give each sub-processor data-protection obligations no less protective than this DPA.
• We will notify you at least 30 days before adding or replacing a sub-processor; you may object on reasonable data-protection grounds within that period.
• We remain fully liable to you for the performance of each sub-processor. Online payments under this DPA are processed exclusively through Razorpay — we never handle full card numbers.

6. International Transfers

• Where we transfer personal data outside the EEA/UK, we rely on the European Commission's Standard Contractual Clauses (Modules 2 and 3 as applicable) and, for UK data, the UK International Data Transfer Addendum.
• Supplementary measures — encryption, access limitation and purpose restrictions — accompany every transfer — including transfers of chat messages to the Cloudflare Workers AI API (see our Sub-processors page) — as described in our Privacy Policy Section 9.
• On request, we will provide information reasonably necessary to demonstrate compliance with the transfer safeguards.

7. Assisting Data Subjects

Taking into account the nature of the processing, we will assist you — through appropriate technical and organizational measures — in fulfilling your obligations to respond to data-subject requests (access, rectification, erasure, restriction, portability, objection). If we receive a request directly, we will forward it to you and await your instruction.

8. Personal Data Breaches

We will notify you without undue delay, and in any case within 48 hours of becoming aware, of any personal data breach affecting your data, with sufficient information for you to meet your own notification obligations (including the GDPR Article 33 72-hour window). We will cooperate in investigating and mitigating the breach.

9. Audit and Records

On reasonable notice, we will make available the information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an independent auditor bound by confidentiality — subject to security and other-client confidentiality constraints (remote questionnaire-based audits are the default).

10. Return and Deletion

At the end of the engagement, you may export your data using the tools provided, and we will delete personal data within 30 days — including active copies and, within 180 days, backups on their normal rotation — unless law requires continued storage, in which case the data is quarantined from further processing.

11. How to Sign

Email contact@druptoconsultants.com with your company name and the engagement reference, and we will return a countersigned DPA (typically with the SCC annexes pre-filled from your SOW) within 3 business days.