Data Processing Agreement

Draft for product review — must be reviewed by a qualified lawyer before launch (BUILD_PLAN Phase 19).

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Averta and business customers (“Customer”) and applies where Averta processes personal data on the Customer’s behalf under Article 28 GDPR.

1. Roles and scope

Averta is an independent controller for account, booking, payment and security data. It is a processor for personal data the Customer puts into the service for its own purposes: creative files, briefs, task comments and messages that contain personal data, and contact details of the Customer’s team members and clients.

2. Instructions

Averta processes Customer personal data only to provide the service, on the Customer’s documented instructions (these terms and the Customer’s use of the product), unless EU or member-state law requires otherwise.

3. Confidentiality and security

• Staff with access are bound by confidentiality.
• Encryption in transit (TLS) and at rest; integration secrets are envelope-encrypted.
• Role-based access, two-factor authentication and an audit log of admin actions.
• Hosting in the EU (AWS, Frankfurt), with backups and tested restores.

4. Sub-processors

The Customer authorises the sub-processors listed on the sub-processor page. Averta gives at least 30 days’ notice of a new sub-processor by updating that page and emailing account owners; the Customer may object on reasonable data-protection grounds.

5. International transfers

Where a sub-processor processes data outside the EEA, transfers rely on an adequacy decision (including the EU–US Data Privacy Framework) or the Standard Contractual Clauses.

6. Assistance and data subject requests

Averta helps the Customer answer data subject requests (export and deletion are self-service), and with security, impact assessments and consultations where required.

7. Personal data breaches

Averta notifies the Customer without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Customer personal data, with the information the Customer needs to meet its own obligations.

8. Deletion and return

On termination the Customer can export its data; Averta deletes Customer personal data within 90 days, except records it must keep by law (for example invoices, for seven years).

9. Audits

Averta makes available the information needed to demonstrate compliance and allows audits by the Customer or an independent auditor, on reasonable notice and at most once a year unless a breach occurred.

To sign a countersigned copy, contact support@averta.app.