Data Processing Agreement template

1. Parties and scope

This Data Processing Agreement (DPA) supplements [service agreement / order reference] between the customer, [full legal name, registration number and address] (Customer), and the YProbe service provider, [full legal name, registration number and address] (Provider), from [effective date].

For personal data processed on the Customer's behalf (Customer Personal Data), the Customer acts as controller and the Provider as processor. If the Customer is itself a processor, its instructions must be authorised by the relevant controller and the Provider acts as subprocessor. GDPR terms retain their meanings. Applicable law: [EU GDPR and any other applicable data-protection law].

This DPA covers only the processing in Schedule A. The parties document separately any independent controller activities, including account administration, billing, abuse prevention or website analytics. Confidential design information remains subject to the service agreement even when it contains no personal data. In a conflict about Customer Personal Data, this DPA prevails over the service agreement; mandatory transfer clauses prevail over both.

2. Instructions and permitted use

The Provider processes Customer Personal Data only to deliver the agreed services under documented Customer instructions, including instructions on transfers. The service agreement, completed schedules and authorised service settings form those instructions. The Provider promptly flags an instruction it considers unlawful. If legislation requires other processing, it informs the Customer before processing unless legally prohibited.

The Provider will not sell Customer Personal Data or use it for advertising, general model training or unrelated product improvement. Any additional purpose requires a separately agreed lawful arrangement. The Customer supplies lawful instructions, gives required notices and minimises submitted data. Special-category data, criminal-offence data and unnecessary personal information are outside scope unless expressly agreed in Schedule A.

Scope-guide processing is enabled only for guides the Customer is authorised to disclose. General hosted-AI permission does not substitute for the separate programming-guide upload permission. Schedule A identifies whether guide processing is included.

3. Confidentiality and security

The Provider limits access to authorised personnel who need it to deliver the services and are bound to confidentiality. It implements risk-appropriate technical and organisational measures under Article 32 GDPR, recorded in Schedule B, and periodically evaluates their effectiveness. Changes must not materially reduce the agreed protection during the term.

4. Subprocessors

The Customer authorises only the subprocessors listed in completed Schedule C. For additions or replacements, the Provider gives at least [notice period] prior written notice describing the processing and locations, allowing the Customer to object on reasonable data-protection grounds before the change takes effect. The parties resolve objections through an alternative or cessation of the affected processing, with termination consequences stated in [service agreement clause].

The Provider imposes equivalent data-protection obligations on each subprocessor in writing and remains responsible to the Customer for that subprocessor's performance. A named AI brand alone is insufficient: Schedule C must specify the contracting entity, service, locations, retention and applicable processing terms.

5. International transfers

Processing and remote-access locations are limited to Schedule C. A transfer requiring Chapter V GDPR safeguards may occur only on documented instructions and with a valid transfer mechanism, any necessary assessment and supplementary measures. Where required, the parties complete and attach the applicable European Commission international-transfer clauses, identify the correct module and fill their annexes. UK or other jurisdictional addenda are attached where applicable. This template does not itself establish a transfer safeguard.

6. Rights requests and compliance assistance

The Provider promptly forwards requests concerning Customer Personal Data to [Customer privacy contact] and responds only on Customer instructions unless legally required. Taking account of the processing and information available, it assists with data-subject rights, security duties, breach notifications, impact assessments and supervisory-authority consultations under Articles 32–36 GDPR.

7. Personal data breaches

The Provider notifies the Customer at [incident email and escalation contact] without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Any additional contractual notification target: [agreed target, if any]. This does not extend the statutory duty.

It shares available details of the incident, affected data and individuals, likely consequences, mitigation and contact point, with updates as the investigation proceeds. It contains the incident, preserves relevant evidence and cooperates with the Customer. The Customer determines notifications to individuals and authorities unless law requires otherwise.

8. Evidence and audits

The Provider supplies information needed to demonstrate compliance and allows and contributes to Customer or mandated independent audits, including inspections. The parties agree proportionate confidentiality, access and scheduling arrangements that protect other customers without preventing statutory audit rights. An incident or authority requirement may justify shorter notice.

9. Return, deletion and duration

This DPA lasts while the Provider processes Customer Personal Data. At service end or the Customer's lawful instruction, the Provider, at the Customer's choice, returns or deletes that data and deletes copies according to Schedule A, unless applicable law requires retention. Retained data is isolated from other use and protected until deletion. The Provider confirms completion on request.

Schedule A sets active-data, log, cache, provider-side and backup deadlines separately. Restoration from backup must reapply pending deletion instructions. Data on Customer-controlled workstations or endpoints remains under the Customer's control unless the parties expressly include it in the Provider's services.

Schedule A. Processing details

Service and deployment

[Hosted diagnosis / Customer endpoint / offline; plan, order and features]. Record any support access separately. An offline route alone does not describe account or support processing.

Subject matter, purpose and operations

[Chosen services, diagnostic requests, guide extraction/review if enabled, storage, support, transmission, return and deletion].

Data subjects

[Authorised engineers, technicians, support contacts and any individuals identifiable in submitted content].

Personal data categories

[Relevant identifiers, contact details, support messages, user-entered notes, document metadata or other personal data in selected context]. Board data is covered by this DPA where it is personal data; technical confidentiality is addressed separately.

Frequency and duration

[On-demand / continuous; contract term and deletion period].

Documented instructions and contacts

[Authorised contacts, service settings and instruction channel]. Provider privacy contact: privacy@yprobe.com.

Retention and return

[For each data class: purpose, retention trigger, active-system deadline, cache/log deadline, backup expiry, export format and deletion confirmation].

AI routes and guide uploads

[Providers/models, original PDF or excerpts sent, request retention, permitted uses, opt-in features and local caching]. Record actual provider terms; do not assume zero retention or a no-training commitment without verification.

Schedule B. Agreed security measures

Complete this schedule with implemented controls and supporting evidence. The following fields are review prompts, not certifications of the current service.

• Access: [Roles, least privilege, administrator MFA, access reviews and confidentiality training].
• Protection: [Transport encryption, encryption at rest, key management and tenant isolation].
• Minimisation: [Submitted context, separate guide consent, logging exclusions, cache controls and secret handling].
• Operations: [Monitoring, incident response, patching, vulnerability handling and periodic control evaluation].
• Availability and recovery: [Backups, restore tests, recovery objectives, resilience and deletion after restoration].
• Customer responsibilities: [Workstation security, local sessions/exports, endpoint configuration and authorised sharing].

Schedule C. Approved subprocessors and transfers

Repeat the entry below for each provider that processes Customer Personal Data on the Provider's behalf, including any hosting, AI, support or relay service used by the selected deployment. Delete unused services. Do not treat the website provider list as the complete service register.

Legal entity and service

[Full entity name, address and service].

Role and data

[Purpose, data classes and access scope].

Processing and remote-access locations

[Countries, hosting regions and support-access locations].

Retention and permitted AI use

[Provider request/file/log retention, deletion terms, training/use restrictions and contract reference].

Transfer mechanism

[No restricted transfer / adequacy / applicable clauses and module, assessment and supplementary measures].

Authorisation and change notices

[Approval date, notice recipient and notice period].

10. Agreement and signatures

Governing law and forum: [agreed law and courts, subject to mandatory data-protection law]. Other commercial terms follow the service agreement and cannot exclude mandatory rights. Both parties confirm the completed schedules and attached transfer instruments form part of this DPA.