Data processing agreement

This data processing agreement (“DPA”) is part of the terms of service between you (the “customer”) and [Company legal name] (“Aria”). It applies to personal data in the applications, databases and files you run or store with Aria (“customer personal data”), and follows Article 28 of the GDPR and the UK GDPR. [If a customer needs a signed copy, contact [contact email].]

1. Roles

You are the controller of customer personal data and Aria is your processor. Aria processes it only to provide the service, following your documented instructions: these terms, your configuration (such as aria.yaml) and what you do in the app or API. If we think an instruction breaks data protection law, we tell you.

2. Details of the processing

• Subject matter and duration: hosting and operating your applications for as long as you use the service, and deleting the data afterwards (section 7).
• Nature and purpose: storage, backup, transmission, and the computing your applications perform.
• Types of data and data subjects: whatever your applications process, about their users. This can include special categories such as health data; you are responsible for having a lawful basis for it and for telling us if additional safeguards are required.

3. Confidentiality and security

People at Aria who can access customer personal data are bound by confidentiality. Aria applies these measures, among others:

• each workspace runs on its own server (or one you chose to share between your own apps), with a firewall that only opens what your configuration needs;
• secrets and credentials encrypted at rest; codes and tokens stored only as hashes;
• encrypted backups of databases and volumes, kept off the server [location and retention];
• access to production limited to named staff, with two-factor authentication, and recorded;
• agents and AI features can’t read secret values or make destructive changes without your approval;
• [vulnerability management, patching and incident response: to be described].

4. Personal data breaches

Aria tells you without undue delay, and within [48] hours, after becoming aware of a breach affecting customer personal data, with the information you need to meet your own obligations.

5. Sub-processors

You authorise Aria to use the sub-processors on the sub-processors page. Aria tells you at least [30] days before adding or replacing one. If you object on reasonable data protection grounds, we discuss it; if we can’t resolve it, you may end the affected service. Aria imposes the same data protection obligations on each sub-processor and remains responsible for them.

6. Assistance and audits

Aria helps you, taking into account the nature of the processing, with requests from data subjects, security, breach notifications, data protection impact assessments and consultations with authorities. Aria makes available the information needed to show compliance with this DPA, and allows audits [on reasonable notice, at most once a year, at the customer’s cost: to be agreed].

7. Deletion and return

You can export your databases and files at any time while the service runs. When you delete a workspace, or when a plan ends as described in the terms, its server and data are deleted, and remaining backups are deleted within [period]. Aria keeps nothing longer unless the law requires it.

8. International transfers

Customer personal data on managed servers stays in the region of your server [confirm: EU data centres]. Where a sub-processor processes it outside the UK or the EEA, the transfer is protected by [Standard Contractual Clauses / adequacy: to be confirmed].