Data Processing Agreement

Last Updated: 2 June 2026 | Compliant with UK GDPR and EU GDPR

1. Parties and Scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between AISCKOP Technologies Ltd ("Processor") and the customer ("Controller"). It governs the processing of personal data by Processor on behalf of Controller.

2. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person processed via the Service
"Controller" means the customer organisation that determines the purposes and means of processing
"Processor" means AISCKOP Technologies Ltd, which processes Personal Data on behalf of the Controller
"Sub-processor" means any third party engaged by Processor to process Personal Data

3. Processing Instructions

Processor shall process Personal Data only:

On documented instructions from Controller, including as set out in the Terms of Service
To the extent necessary to provide the Service
In compliance with applicable data protection law (UK GDPR, EU GDPR, Data Protection Act 2018)

4. Data Subject Categories

The Personal Data processed may relate to:

Controller's employees and authorised users (names, emails, organisational affiliations)
End users of Controller's applications (if Controller integrates our API into customer-facing products)

5. Security Measures

Processor implements the following technical and organisational measures:

Encryption of data in transit using TLS 1.2 or higher
Access controls and authentication for all systems
Regular security assessments and vulnerability monitoring
Restricted personnel access on a need-to-know basis
Incident response procedures with breach notification within 72 hours

6. Sub-processors

Controller authorises the following sub-processors:

Hostinger — Web hosting and infrastructure (Netherlands / EU)
Stripe — Payment processing (USA — Standard Contractual Clauses in place)

Processor will notify Controller of any changes to sub-processors and provide opportunity to object.

7. Data Subject Rights

Processor shall assist Controller in responding to data subject requests including access, rectification, erasure, and portability. Processor shall notify Controller within 48 hours of receiving any direct data subject request.

8. Data Breach Notification

In the event of a personal data breach, Processor shall notify Controller without undue delay and in any case within 72 hours of becoming aware of the breach. Notification shall include: nature of breach, categories of data affected, likely consequences, and measures taken.

9. Data Return and Deletion

Upon termination of the Service, Processor shall, at Controller's election:

Return all Personal Data to Controller in a structured format (JSON or CSV)
Delete all Personal Data from Processor's systems within 90 days

Processor may retain anonymised or aggregated data that does not identify individuals.

10. Audit Rights

Controller may request information from Processor to verify compliance with this DPA. Processor shall provide relevant documentation within 30 days. On-site audits may be conducted once per year with 30 days' notice, at Controller's cost.

11. International Transfers

Where Personal Data is transferred outside the UK/EEA, Processor ensures appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK Secretary of State or European Commission.

12. Contact

For DPA-related inquiries, contact:
hello@aisckop.co.uk
Data Protection Officer, AISCKOP Technologies Ltd