01 / Applicability and parties
A DPA is relevant where the actual engagement involves Astrynn processing personal data on the customer’s documented instructions. Roles depend on the activity. Astrynn is not universally declared controller or processor; independent account, commercial and service-administration activities must be assessed separately.
Customer/controller: [CUSTOMER LEGAL ENTITY AND ADDRESS]. Astrynn contracting entity/processor where applicable: [LEGAL ENTITY NAME / REGISTERED ADDRESS]. Authorised contacts and executed agreement reference: [TO BE COMPLETED FOR THE ENGAGEMENT].
02 / Processing schedule
Subject matter: the specified Architecture Confrontation engagement and bounded object. Nature and purpose: authorised receipt, storage, review, analysis, production of findings/report, clarification and agreed return/deletion of relevant personal data.
Duration and post-engagement handling: [PROCESSING AND RETENTION DURATION TO BE AGREED]. Data categories: [PERSONAL DATA CATEGORIES]. Data subjects: [DATA SUBJECT CATEGORIES]. Evidence scope, permitted operations and any restricted categories: [ENGAGEMENT PROCESSING SCHEDULE]. Do not submit additional personal data before its handling is agreed.
03 / Instructions and confidentiality
The executed DPA should define the customer’s documented instructions, permitted purposes and how changes or potentially unlawful instructions are handled. It should require confidentiality for authorised persons and restrict access to the agreed delivery purpose.
The customer should establish its authority and applicable basis to provide the material. No publication, case-study, logo or independent reuse permission is created by this DPA surface. Astrynn’s pre-existing methods remain outside customer-content ownership.
04 / Security schedule
Implemented application controls include authenticated access, server-side customer ownership checks, an Astrynn operator boundary, customer-view filtering of internal notes/drafts and constrained file uploads/downloads. These are a starting point for a security schedule, not a certification.
Additional technical and organisational measures, access administration, incident response, backup handling, recovery commitments and any engagement-specific requirements: [SECURITY SCHEDULE TO BE CONFIRMED AND AGREED]. Do not infer unlisted controls or service levels.
05 / Service providers and subprocessors
Current infrastructure uses Sites / ChatGPT access and Cloudflare D1/R2 storage. Contractual processing roles, provider entities, locations, approved subprocessors and any analytical services must be validated for the engagement: [APPROVED SUBPROCESSOR SCHEDULE].
The executed DPA should specify the authorisation mechanism for subprocessors, notice of changes, any objection procedure and the applicable obligations that flow down to authorised providers. No unconfirmed subprocessor is approved merely by being mentioned here.
06 / Assistance and incident notification
The executed DPA should establish assistance for relevant individual-rights requests, security obligations, impact assessments and authority consultations, proportionate to the processing and applicable law. Request channels, escalation contacts and cooperation arrangements must be agreed.
Personal-data incident notification must follow applicable legal requirements and the executed agreement. Incident contact, notification content, escalation procedure and any contractual timescale: [INCIDENT ARRANGEMENTS TO BE AGREED]. No unsupported response deadline is promised by this page.
07 / Return, deletion and review
The executed DPA must specify return or deletion instructions at the end of the service, any legally required retention, backup handling and how completion is evidenced. The platform currently has no automatic deletion-on-close routine.
Audit, information and cooperation rights, practical security safeguards and any limits consistent with applicable law: [AUDIT / COOPERATION ARRANGEMENTS TO BE AGREED]. This page is not evidence that an independent audit or certification has occurred.
08 / International transfers and agreement
Processing locations, transfer applicability, relevant recipient entities and any required transfer safeguards must be assessed and documented: [INTERNATIONAL TRANSFER ARRANGEMENTS TO BE CONFIRMED]. No jurisdiction or transfer mechanism is presumed.
Request an engagement-specific DPA through Contact. When applicable, Astrynn records the agreed document reference in the proposed scope and the customer confirms it during acceptance. Acceptance of general Terms does not execute this uncompleted template or resolve its placeholders.