DRAFT, not reviewed by counsel

Data processing agreement (template)

Article 28 GDPR. Fill in the customer's details when you sign. This page is a template and not yet an agreement.

Parties

Controller (the customer): ______________________________
Processor: Valyrian Tech Pvt Ltd, Aster 201, Nyati Meadows, Vadgaosheri, Pune 411014, India

Subject matter, nature and purpose

The processor reads the public pages of the customer's own website, asks buyer questions of search and AI services, and writes a report and fixes for the customer (the audit). Processing lasts as long as the audit order.

Types of data and data subjects

Text of public pages of the customer's website. These pages can contain the names and business contact details of the customer's staff and of other people named on them. The processor does not ask for customer or employee records.

Processor duties

• Process only on the customer's documented instructions, which are the audit order and this agreement.
• Make sure the people who process the data are bound to confidentiality.
• Apply technical and organisational measures under Article 32 GDPR: storage and processing in the EU, encrypted connections, access limited to named people, access logging for client commercial data, and separation of customers' data.
• Help the customer answer requests from data subjects and meet its duties under Articles 32 to 36 GDPR.
• Tell the customer without undue delay after it becomes aware of a personal data breach.
• Delete or return the data at the end of the order, at the customer's choice, unless the law requires storage.
• Give the customer the information needed to show compliance, and allow audits as Article 28(3)(h) GDPR requires.

Sub-processors

The customer gives general authorisation for the sub-processors below. The processor tells the customer of any change in advance and the customer can object. The current list is kept in the processor's sub-processor registry.

• Hetzner Online GmbH
• Supabase
• DataForSEO
• Mistral AI
• Amazon Web Services

Transfers

The processor stores the data in the EU. The processor is located in India and staff there can access the data. The parties agree the standard contractual clauses of Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), and incorporate them by reference. The optional docking clause (clause 7) applies and the optional redress wording in clause 11 does not. The governing law for the clauses is the law of Germany (clause 17, option 1) and the courts of Germany have jurisdiction (clause 18). Annex I is the party data in this agreement. Annex II is the technical and organisational measures. Annex III is the sub-processor list below.