Data processing agreement
The Article 28 terms under which we process personal data on a customer's behalf — the contents of their AI register, and the people named in it.
This document is not finished. It has not been reviewed by a solicitor and is not yet contractual. Everything under “how the product behaves” is accurate and verifiable today; the legal wording is outstanding. If you need the finished document before proceeding, ask and we will get it to you.
How the product behaves today
- The customer is the controller of everything in their workspace. We are the processor.
- Workspaces are isolated, and every request re-checks the session against the tenant it claims.
- The audit trail is append-only by design; records are not edited or removed in the ordinary course.
- The EU renewed its UK adequacy decision on 19 December 2025, running to 27 December 2031 — so a French customer's data reaching UK-hosted infrastructure needs no additional safeguards.
Still to be written
- The full Article 28(3) clauses
- Security measures described to the standard a bank's procurement expects
- Breach notification timescales
- Sub-processor change notification and objection rights
- Deletion and return on termination
360 Digital Projects Ltd, company number 11251738, registered in England and Wales. Registered office: Suite 98, 95 Mortimer Street, London W1W 7GB.