Data processing agreement (DPA)

Version 1 · effective from 2026-11-02 · in force

Draft: text not yet reviewed by a lawyer.

1. Subject, parties and roles C01

  1. This agreement ("DPA") is between the Business Customer that accepts it for its Organisation (the "Controller") and (the "Processor"), and forms part of the Terms of Codelux AI. It applies under article 28 of Regulation (EU) 2016/679 (GDPR) to the personal data that the Controller enters or generates in the Service.
  2. For that personal data the Controller decides the purposes and means and the Processor acts only on its behalf. For the account, sign-in, billing and security data of the Controller's users that the Processor uses for its own purposes, the Processor is an independent controller, as stated in the privacy policy.
  3. The DPA is accepted for the Organisation by its owner or an administrator, who declares to have the authority to do so. The acceptance is recorded as an event (art. 16).

2. Nature, purpose and duration C02

  1. Nature and purpose. The Processor hosts, stores, transmits, backs up and otherwise processes the personal data as needed to provide the Service to the Controller, to secure it and to give support.
  2. Duration. The processing lasts as long as the Controller uses the Service, plus the time needed for return or deletion (art. 11).

3. Categories of data and data subjects C03

  1. Data subjects: the Controller's users (employees, collaborators, administrators) and the other people whose data the Controller enters in the Service (such as its customers, suppliers, contacts, applicants or website visitors).
  2. Data: identification and contact data (name, email, phone, address), data about the professional role, content entered by the Controller, and the technical data of use. The Controller should not enter special categories of data (art. 9) or data on criminal convictions (art. 10) unless the product allows it and the Controller has a legal basis. Each product adds its own categories in the articles that follow.

4. Data of Codelux AI CX01

For Codelux AI the personal data processed on behalf of the Controller is limited, because the code, memories, notes and timeline of the projects stay on the users' computers. It includes: the identity data of the Controller's users sent by its identity provider through single sign-on or SCIM (email address, name, identifier, active or not); the membership, project and device data of the teams; the project list (names and folder paths); and, for Team projects, the encrypted events and their delivery metadata, which the Processor cannot read. Data subjects are the Controller's users. Tools that an administrator connects (Slack, work trackers) are the Controller's own providers.

5. Instructions and the Controller's obligations C04

  1. The Processor processes personal data only on documented instructions of the Controller, also with regard to transfers outside the EEA, unless the law requires otherwise; in that case it informs the Controller before processing, unless the law forbids it. The Terms, this DPA and the Controller's use of the Service's functions are its instructions.
  2. The Processor tells the Controller if it believes an instruction breaks data protection law.
  3. The Controller is responsible for having a legal basis for the data it enters, for informing the data subjects, and for the accuracy of its instructions. It uses the Service in line with the law.

6. Confidentiality C05

The Processor ensures that the people authorised to process the personal data are bound by confidentiality (by contract or by law), access the data only as needed for their duties, and are trained on data protection.

7. Security measures C06

Taking into account the state of the art, the costs and the risks, the Processor applies at least these measures (article 32 GDPR):

  • encryption of connections in transit and of sensitive values at rest;
  • passwords stored only as strong hashes; sign-in protections such as one-time codes and optional two-step verification;
  • access control by role, least privilege, and a record of administrative access;
  • logical separation of the data of each Organisation;
  • regular backups and the ability to restore data and service after an incident;
  • monitoring, logging and patching of systems; separation of production from test environments;
  • procedures for incidents and a regular check of the effectiveness of the measures.

The Processor may update these measures, provided that the overall level of protection does not fall.

8. Sub-processors C07

  1. General authorisation. The Controller gives the Processor a general written authorisation to use sub-processors. The current list, with purpose, data, location and safeguards, is published at /legal/subprocessors.
  2. Obligations. The Processor binds each sub-processor to data protection obligations no less protective than these, and remains responsible towards the Controller for their performance.
  3. Changes and notice. The Processor tells the Organisations that accepted this DPA, by email to the owner, before adding or replacing a sub-processor, giving at least 30 days' notice. [TO BE CONFIRMED: notice period]
  4. Right to object. The Controller may object on reasonable data protection grounds within that period. The parties then look for a solution in good faith; if none is found, the Controller may end the affected part of the Service and cancel its plan under the cancellation clause of the Terms; for the part of the paid period not used, the refund covers only the part of the Service concerned.

9. Assistance to the Controller C08

  1. Data subjects' requests. The Processor helps the Controller, with suitable technical and organisational measures, to answer requests to exercise rights under articles 15 to 22 GDPR. If a data subject writes to the Processor about the Controller's data, the Processor forwards the request to the Controller without answering on its merits, unless the law requires it.
  2. Security, impact assessments and consultation. Taking into account the nature of the processing and the information it has, the Processor helps the Controller to comply with articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation).
  3. The Processor may ask for a reasonable fee for assistance that goes beyond what the Service already offers and requires substantial work.

10. Personal data breaches C09

  1. The Processor notifies the Controller without undue delay and, as a target, within 48 hours after becoming aware of a personal data breach affecting the Controller's data. [TO BE CONFIRMED: 48 hours]
  2. The notice describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, and the measures taken or proposed. Further information follows as it becomes available.
  3. The Processor takes reasonable steps to contain the breach and helps the Controller with its own notification to the authority and to the data subjects. The notice is sent to the owner and administrators of the Organisation by email.

11. Deletion or return of data C10

  1. At the end of the Service, or earlier on the Controller's request, the Processor deletes or returns all the personal data, at the Controller's choice, and deletes the existing copies, unless the law requires it to keep them.
  2. The Controller can export its data through the functions of the Service. After deletion is requested, the data stays available for restoring for 30 days and is then deleted. Backups are overwritten in the normal cycle. [TO BE CONFIRMED: 30 days and backup cycle]

12. Audits and information C11

  1. The Processor gives the Controller the information needed to show compliance with article 28 GDPR, and allows and contributes to audits, including inspections, by the Controller or an auditor it appoints.
  2. Audits are requested in writing with at least 30 days' notice, take place in working hours, do not disturb the Service or other customers, do not reach the data of other customers, and are bound by confidentiality. The Controller bears their costs. Recent independent reports or certifications of the Processor or its sub-processors may satisfy the request. [TO BE CONFIRMED: notice, frequency and costs]

13. International transfers C12

The Processor transfers personal data outside the EEA only if the law allows it: to a country with an adequacy decision, to a recipient certified under the EU-US Data Privacy Framework, or under the Standard Contractual Clauses of the European Commission with the measures needed. The safeguards for each sub-processor are stated in the sub-processors list. Where the Standard Contractual Clauses are needed between the Controller and the Processor, they are incorporated into this DPA by reference (module controller to processor).

14. Liability and order of precedence C13

  1. The liability of each party under this DPA is subject to the limits of the Terms, without prejudice to what cannot be limited by law and to the rights of data subjects under the GDPR.
  2. If the Terms and this DPA conflict on the processing of personal data on behalf of the Controller, this DPA prevails. If the Standard Contractual Clauses apply, they prevail over everything else.

15. Term, changes and law C14

  1. This DPA starts when the Organisation accepts it and lasts as long as the Processor processes personal data for the Controller.
  2. New versions of the DPA are published and announced by email to the Organisations that accepted it, with a summary and the effective date, and need to be accepted again by the owner or an administrator, as for the Terms.
  3. The DPA is governed by Italian law; the court is determined as in the Terms.

16. Acceptance by the Organisation C15

  1. The DPA is accepted for each Organisation by its owner or an administrator, in Settings of the Organisation. Without the acceptance, the Organisation should not enter personal data of other people in the Service.
  2. The acceptance is recorded as an event: the Organisation, the account that accepted, the version, date and time (UTC), IP address and source. The history is kept and can be downloaded ("Download my consents").
  3. When a new version is published, the owner and administrators are told by email and are asked to accept it again.