Standard DPA
Signed by us. Counter-sign and return, no meeting needed. Includes the SCCs, the sub-processor list and the Annex II technical and organisational measures.
Version 2026.04, 14 pages
Our DPA, before your review asks for it
A standard data processing agreement under GDPR Article 28 with the EU Standard Contractual Clauses. Request it, counter-sign it, and get back to work.
Last reviewed September 23, 2026
Two ways to get it
Custom DPA
Most reviews want small edits: retention, audit frequency, specific measures. We respond to redlines within 24 hours.
What's in it
- Standard Contractual Clauses
- EU 2021/914 Module 2, incorporated by reference for international transfers.
- Sub-processor notice
- 30 days' advance notice for new sub-processors; you can object in writing.
- Breach notification
- Customer notified within 60 minutes of discovery, with a preliminary root cause within 48 hours.
- Audit rights
- One remote audit per calendar year on 30 days' notice; additional audits billed at cost.
- Data subject requests
- We help you respond to data subject requests within 15 days, at no extra fee.
- Sub-processor list
- Published on the compliance page, kept current and available as email updates. Includes Webshare and IPRoyal (residential network egress for Cloud mode).
Looking for the wider picture? The compliance page covers data roles, data subject rights and every sub-processor, and the security page covers how we protect your data.