Data Processing Agreement
1. Parties and roles
This agreement is between the organisation that owns an Ovenbird workspace (the "Customer", controller) and [to be completed: company legal name] (tax ID [to be completed: tax ID (CIF/NIF)]), [to be completed: registered address], Spain (the "Provider", processor). It applies to personal data contained in Customer Content as defined in the Terms of Service, and implements article 28 of the GDPR (and, for UK customers, of the UK GDPR). It forms part of the Terms for every business customer and is accepted by the workspace owner. A signed copy is available on request from [to be completed: legal contact email].
2. Details of the processing
| Subject matter | Providing the Ovenbird service: process guidance, question answering, training and suggested document edits over the Customer's connected tools and documents. |
|---|---|
| Duration | While the Customer has a workspace, plus the 30-day period after it is closed. |
| Nature and purpose | Storage, retrieval, transmission to AI models to generate text, display to the Customer's users, reporting, and deletion. |
| Types of personal data | Names, work contact details and identifiers of the Customer's staff and of people mentioned in tickets, issues, messages and documents (such as customers and partners); the content of those records; learning records of the Customer's users. |
| Data subjects | The Customer's employees and contractors; the Customer's customers and their users; other people mentioned in connected content. |
| Special categories | Not intended. The Customer must not connect sources that routinely contain special categories of data without agreeing specific terms first. |
3. Provider obligations
- Instructions. Process personal data only on the Customer's documented instructions: the Terms, this agreement, and the configuration the Customer's admins set in the Service. The Provider will tell the Customer if it believes an instruction infringes data-protection law.
- Confidentiality. Ensure that people authorised to process the data are bound by confidentiality and access it only when needed to operate or support the Service.
- Security. Maintain the technical and organisational measures in Annex 1, and keep them appropriate to the risk.
- Sub-processors. The Customer gives general authorisation to use the sub-processors listed at /legal/subprocessors, each under a written contract with data-protection obligations equivalent to these. The Provider will email workspace owners at least 30 days before adding or replacing one; the Customer may object on reasonable data-protection grounds, and if no solution is found may terminate the affected service and receive a prorated refund of prepaid fees. The Provider remains responsible for its sub-processors.
- Data subject requests. Help the Customer answer requests from data subjects, through the export and deletion tools in the Service and, where needed, by direct assistance within 10 business days.
- Assistance. Help the Customer with security, breach notification, data-protection impact assessments and prior consultations, taking into account the nature of the processing and the information available to the Provider.
- Breach notification. Notify the Customer without undue delay, and no later than 48 hours after becoming aware of a personal-data breach affecting Customer Content, with the information the Customer needs for its own notifications, and update it as more becomes known.
- Deletion and return. Let the Customer export all Customer Content at any time. Delete all Customer Content 30 days after the workspace is closed or the agreement ends, and from backups within a further 35 days, unless EU or Member State law requires retention.
- Audit. Make available the information necessary to demonstrate compliance, and allow audits by the Customer or an independent auditor it appoints, no more than once a year unless a breach or a supervisory authority requires it, on 30 days' notice, during business hours, under confidentiality and at the Customer's cost. The Provider will first offer its latest security documentation, which may satisfy the request.
4. Customer obligations
The Customer is responsible for having a lawful basis for the personal data it connects, for informing its staff and other data subjects as required (including about the use of AI and of learning records), for the instructions it gives, and for the accounts and permissions it manages in the Service.
5. International transfers
Customer Content is stored in the EU (Amazon Web Services, Ireland region). Where a sub-processor processes it outside the EU/EEA, the transfer relies on the EU–US Data Privacy Framework for certified recipients, and otherwise on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914: module 3, processor to processor; module 2 where the Provider exports as processor for the Customer), which are incorporated by reference, with supplementary measures where needed.
6. Liability and precedence
The liability provisions of the Terms apply to this agreement. If this agreement conflicts with the Terms on data protection, this agreement prevails; if the Standard Contractual Clauses apply and conflict with it, the Clauses prevail.
Annex 1 · Technical and organisational measures
- Isolation: every workspace's data is scoped by workspace identifier at the storage layer, and requests are confined to the signed-in person's workspace.
- Encryption: TLS in transit; encryption at rest for the database and backups (AWS-managed keys); integration credentials additionally encrypted with an application key held in AWS Secrets Manager.
- Access control: roles (owner, admin, member) and per-user licences; Provider staff use separate operator accounts, and support actions are recorded against the operator.
- Authentication: salted password hashing (scrypt), sign-in rate limiting, optional single sign-on with Google and Microsoft, session expiry, and sign-out of all sessions.
- AI provider: content is sent only as needed to answer a request; the provider is bound not to train on it.
- Logging and resilience: application event and error logs, kept 1 month; health checks that replace a failing server automatically; managed infrastructure (AWS Fargate, DynamoDB) with point-in-time recovery for 35 days; infrastructure defined as code.
- Development: typed code with automated tests run before deployment; dependency updates; secrets kept out of source control.
- Minimisation: only sources the Customer connects are read; any source can be disconnected at any time; deletion tools for people and workspaces.
- Staff: confidentiality obligations, least-privilege access, access removed on departure.
Annex 2 · Sub-processors
The current list at /legal/subprocessors forms part of this agreement.