Data Processing Agreement (DPA)
Article 28(3) GDPR controller–processor terms for business customers of Adacraft.
1. Parties and scope
1.1 This DPA is between the customer that owns a Adacraft workspace ("Customer", controller) and [Adacraft legal entity — TBD] ("Adacraft", processor). It forms part of the Terms of Service and applies when Adacraft processes personal data contained in the Customer's workspace content ("Customer Personal Data").
1.2 Adacraft is an independent controller, not a processor, for account, sign-in, consent, security and billing data of the users it serves; that processing is described in the Privacy Notice.
1.3 If this DPA conflicts with the Terms of Service, this DPA prevails for Customer Personal Data. If the Standard Contractual Clauses apply, they prevail over both.
2. Instructions
2.1 Adacraft processes Customer Personal Data only on the Customer's documented instructions. The Terms of Service, this DPA and the Customer's use of the features (for example starting an AI generation or an export) are the Customer's instructions.
2.2 Adacraft informs the Customer if it believes an instruction infringes data protection law, and processes data outside the instructions only where required by EU or member state law, after informing the Customer unless that law prohibits it.
3. Confidentiality
Adacraft ensures that persons authorised to process Customer Personal Data are bound by confidentiality.
4. Security
Adacraft implements the technical and organisational measures in Annex II, taking into account the state of the art, the costs and the risks (Art. 32 GDPR). Adacraft may update the measures as long as the overall level of protection is not reduced.
5. Sub-processors
5.1 The Customer gives general authorisation to engage sub-processors. The current list is in Annex III and on the Sub-processors page.
5.2 Adacraft announces intended changes on the Sub-processors page [and by e-mail to the workspace owner — TBD] at least [30] days in advance. The Customer may object on reasonable data protection grounds; if no solution is found, the Customer may terminate the affected service.
5.3 Adacraft imposes data protection obligations on each sub-processor that are no less protective than this DPA and remains responsible for their performance.
6. Data subject requests
Taking into account the nature of the processing, Adacraft assists the Customer with requests from data subjects. The workspace provides self-service tools: editing and deleting content, a machine-readable export and account deletion. Adacraft forwards requests it receives directly to the Customer where it can identify the Customer.
7. Assistance
Adacraft provides reasonable assistance with the Customer's obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to Adacraft.
8. Personal data breaches
Adacraft notifies the Customer without undue delay [and in any case within 48 hours — TBD] after becoming aware of a personal data breach affecting Customer Personal Data, with the information required by Art. 33(3) GDPR as it becomes available.
9. Deletion and return
At the end of the service, the Customer can export its data and delete the workspace. Adacraft then deletes Customer Personal Data, including files in storage, unless EU or member state law requires storage. [Deletion from backups within [X] days — TBD.]
10. Audits and information
Adacraft makes available the information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, by the Customer or an auditor it mandates, with reasonable notice, at most once a year unless a breach or an authority requires otherwise. [Audit cost allocation — TBD.]
11. International transfers
Where Customer Personal Data is transferred to a country outside the EU/EEA without an adequacy decision, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) apply: Module 2 between the Customer and Adacraft where Adacraft is outside the EU/EEA [Adacraft's establishment — TBD], and Module 3 between Adacraft and its sub-processors (or the EU–US Data Privacy Framework where the sub-processor is certified).
12. Term
This DPA applies as long as Adacraft processes Customer Personal Data.
Annex I — Details of processing
| Item | Description |
|---|---|
| Data subjects | The Customer's team members using the workspace; people whose personal data appears in uploaded content (for example names or faces in screenshots, screen recordings, app descriptions or reviews) |
| Categories of data | App and company information, texts, keywords, screenshots, screen recordings, generated images and videos, any personal data the Customer includes in them |
| Special categories | None intended. The Customer should not upload special categories of data (Art. 9 GDPR) |
| Nature and purpose | Hosting, editing, rendering and exporting marketing assets; sending selected inputs to AI sub-processors to generate drafts when the Customer starts an AI feature |
| Frequency | Continuous, while the Customer uses the service |
| Duration and retention | For the term of the service; content is deleted when the Customer deletes it, the workspace or the account (see the retention schedule) |
Annex II — Technical and organisational measures (summary)
| Area | Measure |
|---|---|
| Access control | Accounts with hashed passwords or Google sign-in; workspace roles (owner, admin, member) with write actions limited to permitted roles; every database query is scoped to the workspace |
| Data isolation | Files are stored under a per-workspace prefix; downloads and uploads use pre-signed URLs that expire after 60 and 15 minutes |
| Data minimisation | Image metadata (EXIF) is removed from uploads; only the inputs selected for an AI feature are sent to AI providers |
| Abuse prevention | Rate limits on API endpoints, idempotency keys for jobs, audit log of account and billing events |
| Consent and transparency gates | The AI consent/acknowledgement is checked on the server before a job is queued and again before every AI step |
| Data subject tooling | Self-service data export (JSON) and account deletion that removes or anonymises remaining traces |
| Encryption | [Encryption in transit (TLS) and at rest depend on the hosting provider — TBD] |
| Backups and recovery | [Backup frequency, retention and restore tests — TBD] |
| Personnel and incidents | [Staff access policy, logging of administrative access and incident response procedure — TBD] |
Annex III — Sub-processors
As listed on the Sub-processors page at the date of signature. Currently: Anthropic PBC (United States, Claude API — AI text and image understanding); fal.ai (United States, AI media generation — planned); hosting, database and object storage providers [TBD].