Draft pending legal review. This document is a complete working draft. Items in [square brackets] are company details still to be confirmed. It will be reviewed by a qualified lawyer before we take payments or rely on it; until then, contact m.shafih.akbari@gmail.com with any questions.
In plain words
This addendum applies when a business customer uses Autonieer and we process personal data on its behalf.
It sets out the Article 28 GDPR terms, how international transfers are protected and the security measures we maintain.
It forms part of the Terms of Service automatically; to receive a countersigned copy, email m.shafih.akbari@gmail.com.
1.Parties, scope and precedence
This Data Processing Addendum (“DPA”) is between the customer that has accepted our Terms of Service (“Customer”) and [Company legal name] (trading as Autonieer), a company registered in [Country] under number [Company number], whose registered office is at [Registered address] (“Processor”). It applies to Customer Personal Data processed by the Processor in providing the Service.
If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail.
2.Definitions
“Data Protection Law” means the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP and US state privacy laws including the CCPA/CPRA, as applicable. “Customer Personal Data” means personal data contained in Customer Content or otherwise processed by the Processor on the Customer's behalf. “Controller”, “processor”, “data subject”, “personal data breach” and “processing” have the meanings given in the GDPR.
3.Roles and instructions
- The Customer is the controller (or a processor acting for its own controller) and the Processor is its processor.
- The Processor processes Customer Personal Data only on the Customer's documented instructions — this DPA, the Terms and the Customer's use and configuration of the Service — unless required by law, in which case it will inform the Customer first unless the law forbids it. The Processor will tell the Customer if it believes an instruction infringes Data Protection Law.
- The Customer is responsible for having a lawful basis for the processing and for the accuracy of the data it provides.
4.Details of processing (Annex I)
| Subject matter | Provision of the Autonieer Service. |
|---|---|
| Duration | The term of the Customer's subscription, plus the deletion period in section 11. |
| Nature and purpose | Hosting, storage, AI-assisted generation and editing of designs, export, support, security and billing. |
| Categories of data subjects | The Customer's authorised users (members); individuals named or described in Customer Content (for example clients, site owners). |
| Types of personal data | Names, email addresses, roles; usage and log data; any personal data the Customer includes in prompts, files or designs. |
| Special categories | None intended. The Customer should not include special category data in Customer Content. |
| Frequency | Continuous for the duration of the Service. |
5.Confidentiality
The Processor ensures that everyone authorised to process Customer Personal Data is bound by an appropriate duty of confidentiality.
6.Security (Annex II)
The Processor implements and maintains appropriate technical and organizational measures under Article 32 GDPR, including:
| Area | Measures |
|---|---|
| Access control | Role-based access (owner, admin, editor, viewer); organization-scoped access checked on every request and every database query scoped to the organization; staff access requires TOTP two-factor authentication and is logged. |
| Authentication | Argon2id password hashing; 15-minute access tokens; rotating refresh tokens with reuse detection; account lockout after 10 failed attempts for 15 minutes; API keys hashed at rest and shown once. |
| Encryption | TLS for all data in transit; stored third-party credentials encrypted at rest with a dedicated key (Fernet); servers hosted by IONOS SE in Germany; [disk / database encryption at rest provided by the hosting provider]. |
| Logging and audit | Structured logs with request IDs; a hash-chained, tamper-evident audit log of security-relevant and staff actions, verified in every periodic report. |
| Availability and resilience | Integrity-checked database backups retained for 14 days; [encrypted off-site copies and a recorded restore drill — being put in place]; process supervision with automatic restart. |
| Application security | Content-Security-Policy blocking framing, plugins and third-party scripts, plus security headers; input validation and length limits; rate limiting per IP and organization; idempotency keys; dependency auditing. |
| Data minimisation | Contact and newsletter IP addresses stored only as salted hashes; card data handled solely by the payment provider. |
| Organizational measures | Confidentiality obligations for personnel; least-privilege access; secrets held only in restricted environment files; incident response procedure; documented retention schedule. |
The Processor may update these measures provided the overall level of protection is not reduced.
7.Sub-processors (Annex III)
The Customer gives general authorisation for the Processor to engage sub-processors. The current list is at /legal/subprocessors and includes: IONOS SE; Groq, Inc.; Google LLC (Gmail / Google Workspace); Stripe, Inc. / Stripe Payments Europe, Ltd..
The Processor will give at least 30 days' notice of any new or replacement sub-processor. The Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees. The Processor imposes data-protection obligations on each sub-processor at least as protective as this DPA and remains liable for its sub-processors.
8.Data subject requests and assistance
- The Processor will promptly forward any data subject request it receives about Customer Personal Data and will not respond except on the Customer's instructions. The Service provides self-service export and deletion to help the Customer respond.
- Taking into account the nature of the processing, the Processor will reasonably assist the Customer with its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation).
9.Personal data breaches
The Processor will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, likely consequences, and the measures taken or proposed. The Processor will provide further information as it becomes available and take reasonable steps to contain and remedy the breach.
10.International transfers
Where Customer Personal Data is transferred from the EEA, the UK or Switzerland to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated by reference as follows: Module Two (controller to processor) or Module Three (processor to processor) as applicable; Clause 7 (docking) applies; Clause 9(a) Option 2 (general authorisation, 30 days' notice); the optional wording in Clause 11 does not apply; Clause 13 — the supervisory authority determined by the Customer's establishment [or representative]; Clause 17 — the law of [Ireland]; Clause 18 — the courts of [Ireland]. Annexes I–III are completed by sections 4, 6 and 7 of this DPA.
For UK transfers, the UK International Data Transfer Addendum (version B1.0) is incorporated, with Table 4 allowing either party to end it as set out in its Section 19. For Swiss transfers, references to the GDPR are read as references to the FADP and the Swiss FDPIC is a competent supervisory authority.
11.Return and deletion
On termination the Customer may export its data. The Processor deletes Customer Personal Data within 30 days after the organization is deleted, and from backups as they expire (within 14 days after that), unless the law requires retention, in which case it is kept confidential and processed only for that purpose.
12.Information and audits
The Processor will make available the information reasonably necessary to demonstrate compliance with this DPA, including completed security questionnaires and summaries of its measures. Where that is not sufficient, the Customer may carry out an audit, at its own cost, on at least 30 days' notice, no more than once a year (unless required by a supervisory authority or after a breach), during business hours and subject to confidentiality.
13.US state privacy laws
For personal information subject to the CCPA/CPRA or similar laws, the Processor acts as a “service provider” or “processor”: it will not sell or share the personal information, retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Service, or combine it with personal information from other sources except as the law permits. It will notify the Customer if it can no longer meet these obligations.
14.Liability and term
Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law or the Standard Contractual Clauses do not permit it. This DPA lasts as long as the Processor processes Customer Personal Data.
15.Signature
This DPA is accepted with the Terms. For a countersigned copy, email m.shafih.akbari@gmail.com with your organization's legal name and address. Processor signatory: [name, title], for [Company legal name].