Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the agreement between [Avicon legal entity] ("Processor", "Avicon") and the Customer named in the underlying Terms or Order Form ("Controller"). It applies where Avicon processes Personal Data on behalf of the Controller in providing the Service.

This DPA reflects the parties' commitments under Regulation (EU) 2016/679 ("GDPR") and the UK GDPR.

1. Definitions

Capitalized terms not defined here have the meaning given in GDPR. "Personal Data", "Data Subject", "Processing", "Sub-processor", "Personal Data Breach", "Supervisory Authority", and "Standard Contractual Clauses" or "SCCs" have their GDPR meanings.

2. Processing details (Annex I)

Item	Value
Subject matter	Provision of the Avicon Service to the Controller
Duration	The term of the underlying Agreement
Nature and purpose	Hosting, transmission, retrieval, display, and analysis of data submitted by Controller and its end-users in the course of using the Service
Categories of Personal Data	As determined by the Controller; typically identifiers (name, email), authentication data, and any data the Controller submits to the Service
Categories of Data Subjects	The Controller's end-users, employees, and contacts
Special categories	Not contemplated; Controller agrees not to submit special-category data without prior written agreement

3. Roles

Avicon is the Processor for Personal Data submitted by the Controller into the Service. The Controller is the Controller. Where Avicon acts as Controller (e.g., for billing contacts, support correspondence), our Privacy Policy applies.

4. Avicon's obligations

Avicon will:

Process Personal Data only on documented instructions from the Controller, including those in this DPA, the Service configuration, and customer support requests.
Ensure persons authorized to process Personal Data are bound by confidentiality.
Implement technical and organizational measures appropriate to the risk (Annex II).
Engage Sub-processors only as permitted in Section 6.
Assist the Controller in responding to requests from Data Subjects (Section 7).
Assist the Controller in fulfilling obligations under Articles 32–36 GDPR (security, breach notification, DPIAs, prior consultation), as far as reasonably practicable.
Notify the Controller of a Personal Data Breach without undue delay after becoming aware (and in any event within 24 hours of awareness for material breaches).
At Controller's choice, return or delete Personal Data after end of Services, subject to legal retention.
Make available all information necessary to demonstrate compliance with this DPA, including audit support per Section 8.

5. Controller's obligations

The Controller will:

Ensure that its instructions and use of the Service comply with applicable law, including having a lawful basis for the Processing.
Be solely responsible for the accuracy, quality, and legality of Personal Data submitted to the Service.
Not submit special-category data, government-issued identifiers, payment card numbers, or children's data without prior written agreement that addresses the additional requirements.

6. Sub-processors

The Controller authorizes Avicon to engage Sub-processors. Avicon will:

Maintain a public list of current Sub-processors at adoptiq.io/sub-processors.
Notify the Controller of any intended addition or replacement of a Sub-processor with at least 30 days' advance notice (via email subscription on the public list).
Impose data protection terms on Sub-processors substantially equivalent to those in this DPA.
Remain liable for the acts and omissions of its Sub-processors.

The Controller may object to a new Sub-processor on reasonable grounds related to data protection within 30 days of notification. If the parties cannot resolve the objection within a further 30 days, the Controller may terminate the affected portion of the Service for convenience and receive a pro-rata refund of pre-paid fees.

Initial Sub-processor list: per adoptiq.io/sub-processors.

7. Data Subject rights

Where the Controller is unable to address a Data Subject request through the Service's self-serve features (account settings, in-app deletion, export), Avicon will provide reasonable assistance to enable the Controller to respond. The Controller bears responsibility for evaluating and responding to Data Subject requests; Avicon will not respond directly to a Data Subject request relating to Personal Data Processed under this DPA except as required by law or with the Controller's instruction.

8. Audits

Once per twelve-month period, the Controller (or an independent auditor it appoints, bound by confidentiality and not a competitor of Avicon) may, at the Controller's expense and on at least 30 days' written notice, audit Avicon's compliance with this DPA. To minimise disruption, Avicon may satisfy this obligation by:

Providing current security-audit documentation (e.g. a SOC 2 Type II report or ISO 27001 certificate) upon reasonable request, and
Responding to a reasonable security questionnaire.

On-site audits will be permitted only where the foregoing is insufficient and only during business hours, no more than once per year, and will not extend to other customers' data or to Avicon's confidential information unrelated to the DPA. [LEGAL — heavily negotiated]

9. International transfers

Where Avicon transfers Personal Data outside the EEA, UK, or Switzerland to a country without an adequacy decision, the parties agree:

The EU Standard Contractual Clauses (Module Two: Controller-to-Processor) are deemed incorporated and entered into between the parties, with the Controller as data exporter and Avicon as data importer.
For UK transfers, the UK International Data Transfer Addendum applies.
For Swiss transfers, the SCCs are read in accordance with Swiss Federal Data Protection Act guidance.
Avicon completes a Transfer Impact Assessment for each transfer and makes it available on request.

10. Personal Data Breach

Avicon will notify the Controller without undue delay (and in any event within 24 hours of awareness) of any Personal Data Breach affecting Controller's Personal Data. The notification will, to the extent known, include:

Description of the nature of the breach.
Categories and approximate numbers of Data Subjects and records affected.
Likely consequences.
Measures taken or proposed.

Avicon will provide reasonable assistance to the Controller in fulfilling its obligations to notify Supervisory Authorities (Art. 33) and Data Subjects (Art. 34).

11. Liability

Liability under this DPA is governed by the limitations in the underlying Agreement. Nothing in this DPA limits liability that cannot be limited under applicable law (including, where applicable, GDPR Art. 82 claims by Data Subjects). [LEGAL]

12. Conflict and term

This DPA prevails over the underlying Agreement to the extent of any conflict on data protection matters. This DPA terminates automatically when Avicon ceases all Processing of Controller Personal Data, except for terms that by their nature survive (Sections 4 — return/delete, 8 — audit, 9 — transfers, 10 — breach, 11 — liability).

Annex I — Processing details: see Section 2. Annex II — Security measures: see [Avicon Security Overview / Trust Center URL] or on request. Annex III — Sub-processors: per adoptiq.io/sub-processors, current as of [Date].

Signatures

For the Controller (Customer): Name: ____________________ Title: ____________________ Date: ____________________ Signature: ____________________

For the Processor (Avicon): Name: [Founder name] Title: Founder Date: ____________________ Signature: ____________________