Orygent Data Processing Agreement

1. Parties, instructions and applicability

1.1 This DPA applies where the customer, as controller, instructs SMARTEDTECH SL as processor for Orygent. It forms part of the subscription and is accepted with it. For the Operator’s own account, billing, security or statutory purposes the Operator may instead be a controller (Privacy Notice PUB-02).

1.2 Annex A. Subject matter: provision of the Orygent service. Duration: the subscription term plus the return and deletion period in clause 7. Nature and purpose: hosting, organising, displaying and transmitting workspace content, and AI assistance on request. Data categories: names, business contact details, roles, work items, documents, notes and messages placed in the workspace by the customer. Data subjects: the customer’s users, employees, customers, suppliers and other contacts. Location: the European Economic Area, subject to Annex C. The customer’s use of the service and its configuration are its documented instructions.

2. Documented purpose and confidentiality

2.1 The processor acts only on documented instructions, including transfers, unless binding law requires otherwise; it informs the controller of that requirement where legally permitted. It promptly flags an instruction it reasonably considers unlawful.

2.2 Only personnel needing access are authorised, trained and bound by confidentiality. No advertising, onward sale, unrelated model training, cross-platform enrichment or private data publication follows from this DPA.

3. Security and authorised access

3.1 The processor uses risk-appropriate measures under Article 32 GDPR, documented in Annex B. These are contractual requirements to be evidenced, not a certification. Material deviations are explained and corrected.

3.2 No private content is written into immutable consent logs; minimised references and lawful retention are used.

4. Subprocessors and transfers

4.1 Annex C identifies every subprocessor, its purpose and location. The controller gives general written authorisation for them. The processor notifies intended additions or replacements at least 30 days in advance and allows a reasonable objection process; if lawful safeguards cannot be agreed, the affected processing stops and the controller may terminate.

4.2 The processor imposes equivalent processing duties on each subprocessor and remains responsible as required by Article 28. Restricted transfers rely on Standard Contractual Clauses or an adequacy decision.

5. Rights and incidents

5.1 The processor assists the controller with data-subject requests using proportionate authentication and scoped search, export, correction and deletion. It does not independently decide the response unless authorised or required by law.

5.2 The processor notifies the controller of a personal-data breach without undue delay after becoming aware of it, with the available facts, categories and approximate numbers, likely effects, mitigation and contact, and supplies staged updates. The controller’s 72-hour supervisory notification duty is distinct from processor notification.

6. Assessments, audit and authorities

6.1 The processor provides information reasonably necessary for Article 28 compliance, relevant security evidence, assistance with DPIAs and prior consultation, and proportionate audits subject to confidentiality, security and others’ rights. Statutory regulator access is preserved.

7. End of service and retention

7.1 At the end of the subscription the controller may export its workspace content for 30 days. The processor then deletes personal data and existing copies within 90 days of termination, unless binding law requires particular retention. Backups expire within 35 days of deletion. Records held by law are restricted to their specific purpose and duration.

Annex B: technical and organisational measures

Workspace isolation enforced in the database with row-level security; least privilege and multi-factor authentication for privileged access; encryption in transit (TLS) and at rest; secrets kept out of code and logs; dependency and vulnerability updates; daily backups with tested restore; scoped connections to other accounts; upload type and size controls; logging of privileged actions; incident escalation to a named contact; approval by an authorised person before steps with financial or contractual effect.

Annex C: subprocessors