Data Processing Agreement

In this DPA the following terms have the meanings set out below:

• "Controller":The customer — the natural or legal person who determines the purposes and means of processing personal data.
• "Processor":Asteria Engine Ltd, the provider of the Asteria Engine platform, acting on the Controller's documented instructions.
• "Personal Data":Any information relating to an identified or identifiable natural person, as defined in UK GDPR Article 4(1).
• "Processing":Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
• "Data Subject":The individual to whom personal data relates.
• "Sub-processor":Any third party engaged by the Processor to carry out processing activities on behalf of the Controller.
• "UK GDPR":The UK General Data Protection Regulation as retained in UK law by the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018.

This DPA covers all processing of personal data that the Processor carries out on behalf of the Controller while providing the Asteria Engine platform and related services.

This DPA remains in force for the duration of the controller's subscription and terminates automatically when the Controller's account is deleted or the agreement is otherwise terminated, subject to retention obligations described in Section 8.

The Processor agrees to:

• Process personal data only on documented instructions from the Controller, unless required to do so by UK law.
• Ensure that persons authorised to process the personal data are bound by confidentiality obligations.
• Implement and maintain appropriate technical and organisational security measures (see Section 6).
• Assist the Controller in responding to Data Subject requests (access, erasure, portability, restriction, objection) within the timeframes required by UK GDPR.
• Notify the Controller without undue delay — and in any event within 72 hours — after becoming aware of a personal data breach affecting the Controller's data.
• Delete or return all personal data to the Controller upon termination of the service, unless retention is required by applicable law.
• Make available all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits conducted by the Controller or an authorised auditor.
• Immediately inform the Controller if it believes an instruction infringes UK GDPR or other applicable data protection law.

The Controller agrees to:

• Ensure there is a lawful basis for processing personal data before instructing the Processor.
• Provide clear instructions to the Processor regarding the processing of personal data.
• Ensure that all personal data provided to the Processor is accurate and lawfully obtained.
• Comply with all applicable data protection laws in connection with their use of the Asteria Engine platform.
• Not instruct the Processor to process personal data in a manner that would breach applicable law.

The Processor maintains the following technical and organisational measures in accordance with UK GDPR Article 32:

Full details are available at /security.

The Controller grants general authorisation for the Processor to engage the following sub-processors. The Processor will notify the Controller of any intended changes to this list at least 14 days in advance via email or in-app notification, giving the Controller the opportunity to object.

Upon termination or account deletion, the Processor will delete all personal data within 30 days, except where retention is required by applicable law:

• Billing records:7 years — required by HMRC and applicable tax law
• Audit logs:12 months — for security incident investigation
• Login history:90 days — for fraud detection
• Backup copies:Up to 30 days after account deletion before purged from backup rotation

Where personal data is transferred to sub-processors outside the UK or EEA (e.g. OpenAI, Anthropic, Resend), the Processor ensures appropriate safeguards are in place via:

• Standard Contractual Clauses (SCCs) approved by the ICO or European Commission
• Adequacy decisions where applicable
• Sub-processor DPAs requiring equivalent protection

A transfer impact assessment is available upon request by emailing [email protected].

The Processor will assist the Controller in fulfilling Data Subject rights requests as follows:

• Right of access (Article 15): Data export available via account settings. Manual SAR assistance within 72 hours.
• Right to erasure (Article 17): Account self-deletion available in profile settings; all data deleted within 30 days.
• Right to portability (Article 20): Data export in JSON format available from account settings.
• Right to rectification (Article 16): User can update all profile and brand data via settings.
• Right to restriction (Article 18): Contact [email protected] — processed within 30 days.
• Right to object (Article 21): Contact [email protected] — processed within 30 days.

This DPA is governed by and construed in accordance with the laws of England and Wales. Any disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.

The Processor is registered with the Information Commissioner's Office (ICO) as a data controller and data processor under UK GDPR.