Data Processing Agreement

Last updated: 2026-05-30

This Data Processing Agreement ("DPA") supplements the Terms of Service between you ("Controller") and Project Y("Processor") when Project Y processes personal data on your behalf in the course of providing the service.

1. Scope

The Processor processes only the categories of personal data, for only the purposes, and for only the duration described in the Annex to this DPA.

2. Sub-processors

A current list of sub-processors is maintained on our Privacy page. The Processor will give Controller 30 days' notice before engaging a new sub-processor; Controller may object in writing.

3. Security measures

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls on production systems
• Annual third-party penetration testing
• Incident-response runbook with 72-hour notification SLA

4. International transfers

Where personal data is transferred outside the EEA, the parties rely on the EU Standard Contractual Clauses (Commission Decision 2021/914) incorporated by reference.

5. Sign

A countersigned PDF version is available on request from legal@project-y.app.