Data Processing Addendum
Last updated
Template. Replace every [bracketed] value and have a lawyer review this page before you publish it. It is a starting point, not legal advice.
This addendum applies when a business customer ("Controller") uses InkApex to process personal data, and [Company] ("Processor") processes it on the Controller's behalf.
Scope
The Processor processes personal data only to provide the service and only on the Controller's documented instructions. The content of the Controller's websites is processed to extract facts, plan keywords and write articles for the Controller.
Security
The Processor keeps appropriate technical and organizational measures, including encryption in transit and at rest, organization-scoped access, encrypted storage of provider keys, and an audit log of access to the service.
Subprocessors
Current subprocessors: [list], and the model and search providers the Controller selects. The Processor gives [30] days' notice before adding one of its own, and the Controller may object.
Breaches
The Processor tells the Controller without undue delay, and within [48] hours, after becoming aware of a personal data breach.
End of the agreement
On termination the Processor deletes or returns the personal data within [30] days, unless the law requires keeping it.