Data Processing Addendum — draft template

Parties and status

Draft: not yet reviewed by a lawyer. Customer/controller: [customer legal name, address and contact]. Processor: Asterly, operated by Yash Vardhan, India; legal entity [placeholder — not yet formed], address [placeholder — needs Yash]. Effective contract date: [to agree]. Main agreement: [to identify]. Neither browsing this page nor using the staging preview executes this addendum.

Download the editable Markdown template. Complete all schedules, verify the controls and sign a final version before processing business personal data in reliance on it.

Scope and instructions

Subject matter: recording, editing, AI-assisted drafting, storage and publication of customer-directed guides. Duration: the service term plus the agreed deletion period. Nature: receipt, storage, retrieval, transmission to approved providers, editing, export, publication only on instruction, and deletion. Purpose: provide the agreed guide service, without training Asterly’s own models.

Data subjects may include customer personnel, end users and people visible in authorised screenshots. Data categories include names/emails visible in content, page paths, screenshot pixels, click/target metadata, text and reviewer notes. Special-category, financial, children’s and credential data are excluded from the intended scope; the customer must keep them out. Customer instructions must be documented, lawful and within the agreed service. Asterly must flag an instruction it believes infringes applicable data-protection law.

Processor duties

The final agreement should require Asterly to process only documented instructions, bind anyone authorised to access data to confidentiality, limit access to need, implement the verified measures in the security schedule and assist with rights requests, impact assessments and regulator enquiries where required. Any legally compelled disclosure must be notified unless prohibited. Asterly must not use customer content for its own model training or unrelated advertising.

For a personal-data breach, the proposed duty is to notify the customer without undue delay after awareness and provide available facts, impact, mitigation and follow-up updates. A proposed initial 24-hour target is for negotiation, not a verified operating capability. Statutory notification obligations remain with the responsible parties.

Subprocessors and transfers

Attach an approved list identifying each legal entity, service, data, country and safeguards, using the draft register as a starting point. The proposed authorisation is general with 30 days’ advance notice of changes and reasonable protection-based objections; agree a resolution or termination route for unresolved objections. Flow down equivalent obligations and allocate responsibility for subprocessor performance in the final contract.

Identify the exporter/importer roles, transfer destinations and onward transfers, including India, Seoul and US/global providers. EU SCC module(s), UK Addendum/IDTA, adequacy reliance and transfer assessments: [confirm with counsel]. This template does not incorporate or execute missing transfer clauses.

Return, deletion and accountability

At the customer’s choice on termination, return or delete personal data unless law requires retention. Proposed active-system deletion is 30 days and backup expiry 90 days, with restricted access until expiry; these periods need technical implementation and agreement. Handle processor/provider copies and give a completion statement identifying exceptions. Public copies outside the parties’ control cannot be recalled.

Provide reasonable information to demonstrate compliance and permit proportionate audits under agreed confidentiality, scope and notice, without preventing regulator access. Tell the customer if an instruction or security issue prevents performance. Liability, precedence, governing law and allocation of costs: [confirm with counsel and align with the main agreement]. Mandatory legal duties cannot be waived.

Schedules and signatures to complete

• Schedule 1: customer details, processing purpose, data subjects/categories, instructions, service term and customer contact.
• Schedule 2: verified technical/organisational measures, access controls, transport/storage encryption, isolation, incident process, backups and deletion. Start with Security; do not copy unverified claims.
• Schedule 3: approved subprocessors, legal entities, countries, onward routes, data categories and notice/objection contacts.
• Schedule 4: applicable transfer mechanism, executed clauses, assessments and supplementary measures.
• Signatures: [customer signatory, role, date]; [Yash Vardhan / verified contracting entity, role, date].

Contact hello@asterly.co to discuss a final agreement. The contact mailbox itself must be verified before use.