Data Processing Agreement
Last updated: October 1, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Synchronoid ("Processor") and the Customer ("Controller"). It applies when Synchronoid processes personal data on the Customer's behalf through the Synchronoid service. Terms such as "personal data", "processing" and "supervisory authority" have the meaning given in the GDPR (Regulation (EU) 2016/679).
1. Subject matter and duration
Synchronoid processes personal data to provide the Service for as long as the Customer has an active workspace, plus the deletion period in section 10.
2. Nature and purpose
Processing includes fetching, storing, transforming, merging, delivering and displaying data in pipelines that the Customer configures. The purpose is to provide the Service. The types of personal data and the categories of data subjects depend on the Customer's pipelines and are determined by the Customer.
3. Customer instructions
Synchronoid processes personal data only on documented instructions from the Customer, which include the Terms, this DPA and the Customer's use of the Service. Synchronoid will tell the Customer if it believes an instruction breaches data protection law.
4. Confidentiality
Synchronoid ensures that people authorized to process personal data are bound by confidentiality duties.
5. Security
Synchronoid applies technical and organizational measures appropriate to the risk, including encryption in transit (TLS 1.2 or higher) and at rest (AES-256), role-based access control, logging, backups and regular testing. The measures are described on our security page, and we may improve them but will not materially reduce them.
6. Subprocessors
The Customer gives general authorization to use the subprocessors listed on the security page. Synchronoid imposes data protection duties on them that are no less protective than this DPA and remains responsible for them. We will give at least 30 days' notice of new subprocessors, and the Customer may object on reasonable data protection grounds. If the matter is not resolved, the Customer may terminate the affected service.
7. Data location and transfers
Customer data is stored in the region the Customer selects for its workspace: EU (Frankfurt) or US (Virginia). Transfers of personal data from the EEA to a country without an adequacy decision are covered by the Standard Contractual Clauses (Module 2: controller to processor, and Module 3 where relevant), which are incorporated by reference, together with supplementary measures.
8. Assistance
Taking into account the nature of processing, Synchronoid will help the Customer respond to data subject requests, and meet obligations on security, breach notification, impact assessments and prior consultation. Provenance records in the Service help locate data about a person.
9. Personal data breaches
Synchronoid will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting Customer personal data. The notice will describe, as far as known, the nature of the breach, the likely consequences and the steps taken.
10. Deletion and return
On termination, Synchronoid will make Customer data available for export for 30 days. After that, we delete it from production systems within 30 days and from backups within 35 further days, unless the law requires storage.
11. Audits
Synchronoid will provide information needed to show compliance with this DPA, such as security summaries and, when available, third-party audit reports (SOC 2 Type II is in progress). Where this is not sufficient, the Customer may carry out an audit, with 30 days' notice, during business hours, subject to confidentiality and without disrupting operations. Each party bears its own costs.
12. Liability and order of precedence
Liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms on data protection, this DPA prevails. If it conflicts with the Standard Contractual Clauses, the Clauses prevail.
13. Contact
Requests to sign a customized or countersigned copy of this DPA, and privacy questions, go to privacy@synchronoid.com or the contact form.