divelai / legal / dpa
Data Processing Addendum
Divelai processes personal data on your instructions. The DPA is offered pre-signed so it does not become the slowest step in your procurement.
Roles
You are the controller; Divelai is the processor. Sub-processing is limited to the parties on the subprocessor list, with notice before changes.
Scope of processing
Categories of data, purposes, and duration follow your policy configuration — Divelai processes what you route to it and nothing else.
Transfers
Standard Contractual Clauses and the UK Addendum, with region pinning available for the vault. Transfer impact assessment support is available on request.
Security measures
Annexed technical and organisational measures, matching the trust center.
Breach notification
Without undue delay, and within 72 hours of Divelai confirming a personal data breach affecting your data, including what happened, the data involved, likely consequences, and the measures taken.
Audit rights
Once a year, met first through our security documentation and questionnaire responses, with an on-site audit by agreement where those are not sufficient.
Download
Request a signed copy through the contact form.