Data Processing Addendum (Template)
1. Parties and scope
This Data Processing Addendum ("DPA") forms part of the agreement under which SmartShift Consulting ("Processor") provides SmartShift Central services to the customer identified in the applicable order form or service agreement ("Controller"). It applies to the extent Processor processes Personal Data on behalf of Controller.
2. Definitions
"Data Protection Law" means applicable privacy/data-protection law, including the UK GDPR, Data Protection Act 2018 as amended, DUAA 2025 amendments, PECR where relevant, the EU GDPR where applicable, and applicable US state privacy laws to the extent they govern the processing.
3. Processing instructions
Processor shall process Personal Data only on Controller's documented instructions, including instructions concerning international transfers, unless required by applicable law. Processor shall notify Controller where legally permitted if an instruction infringes applicable Data Protection Law.
4. Confidentiality
Processor shall ensure that persons authorised to process Personal Data are subject to appropriate confidentiality obligations.
5. Security
Processor shall implement appropriate technical and organisational measures taking account of the state of the art, implementation costs, and the nature, scope, context, purposes and risks of processing. Measures may include access control, authentication, audit logging, encryption/protected storage, environment separation, availability/resilience measures, vulnerability/dependency management and incident-response procedures.
6. Subprocessors
Controller provides general authorisation for Processor to engage subprocessors needed to provide the services. Processor shall maintain a current subprocessor list and impose data-protection obligations on subprocessors that are no less protective than those required by applicable law for the relevant processing. Contract-specific notification and objection arrangements shall apply as stated in the customer agreement/order form.
7. Data-subject rights
Taking account of the nature of the processing, Processor shall provide reasonable assistance to Controller, through appropriate technical and organisational measures where possible, to fulfil Controller's obligations to respond to data-subject requests.
8. Assistance and incidents
Processor shall provide reasonable assistance with security obligations, personal-data breach assessment/notification, data-protection impact assessments and prior consultation where required, taking account of the nature of the processing and information available to Processor.
9. Personal-data breaches
Processor shall notify Controller without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of Controller and shall provide available information reasonably needed for Controller's assessment and notification obligations.
10. Return and deletion
At the end of the services, Processor shall, at Controller's choice and subject to the agreement and applicable law, return or delete Personal Data processed on Controller's behalf and delete existing copies unless retention is required by law.
11. Audit and information
Processor shall make available information reasonably necessary to demonstrate compliance with applicable processor obligations and shall permit audits/inspections as required by Data Protection Law, subject to reasonable security, confidentiality, frequency and scope protections.
12. International transfers
Where a restricted international transfer requires safeguards, the parties shall use an applicable transfer mechanism, which may include the UK IDTA, the UK Addendum to EU SCCs, EU SCCs, adequacy arrangements or another legally valid mechanism. The parties shall cooperate with transfer-risk/data-protection assessments and supplementary measures where required.
Schedule 1 — Processing details
| Item | Description |
|---|---|
| Subject matter | Provision, administration, security and support of SmartShift Central. |
| Duration | For the term of the applicable customer agreement plus agreed/legally required retention and deletion periods. |
| Nature/purpose | Hosting and processing customer-submitted AI prompts, conversation content, project knowledge, uploaded files, account data and service metadata to provide governed AI services. |
| Data subjects | Customer users, personnel, contractors, clients/contacts and other persons whose information the Controller submits to the service. |
| Personal data | Identity/contact data, account data, business correspondence, prompt/content data, uploaded document content, technical/security metadata and other personal data submitted under Controller's instructions. |
| Special-category data | Not required by default. If Controller chooses to process such data, Controller is responsible for ensuring an appropriate lawful basis/condition and configuring appropriate safeguards. |
Schedule 2 — Technical and organisational measures
- Role-based access control and administrative authorisation.
- Production secret/environment management.
- TLS for network transport where supported.
- Private object storage and controlled file access.
- Audit/governance logging.
- Privacy/anonymisation controls for AI provider requests where configured.
- Backup/resilience capabilities provided through production infrastructure and operational procedures.
- Security incident response and breach escalation.
- Change control, testing and dependency maintenance.