Data Processing Agreement

Last updated: February 24, 2026 · Compliant with GDPR Article 28

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Universal Guardrail Ltd ("Processor" / "we") and the Customer ("Controller" / "you") and governs the processing of personal data by the Processor on behalf of the Controller.

1. Definitions

• "Personal Data" — any information relating to an identified or identifiable natural person as defined under GDPR Article 4(1)
• "Processing" — any operation performed on Personal Data as defined under GDPR Article 4(2)
• "GDPR" — the General Data Protection Regulation (EU) 2016/679 and its UK equivalent (UK GDPR)
• "Sub-processor" — any third party engaged by the Processor to process Personal Data

2. Scope and Nature of Processing

The Processor will process Personal Data only in connection with providing the subscription service, specifically:

• Account management (name, email, company)
• License key issuance and validation
• Billing and invoicing
• Technical support communications

The Processor does not process, store, or have access to any end-user data, AI prompts, model outputs, or audit logs generated by the Software within the Controller's infrastructure. The Controller is the sole data controller for all such data.

3. Controller Obligations

The Controller agrees to:

• Ensure it has a lawful basis for providing Personal Data to the Processor
• Ensure that data subjects have been informed of processing in accordance with GDPR Articles 13–14
• Only instruct the Processor to process Personal Data in ways consistent with applicable law
• Be solely responsible for all Personal Data processed by the Software within its own infrastructure

4. Processor Obligations

The Processor agrees to:

• Process Personal Data only on documented instructions from the Controller
• Ensure persons authorised to process data are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures (Article 32 GDPR)
• Not engage Sub-processors without prior written consent, and impose equivalent obligations on any approved Sub-processor
• Assist the Controller in responding to data subject rights requests
• Notify the Controller without undue delay upon becoming aware of a Personal Data breach
• Delete or return all Personal Data upon termination of the service

5. Sub-processors

The Controller hereby authorises the Processor to engage the following Sub-processors:

• Stripe, Inc. — Payment processing (United States, SCCs in place)
• Amazon Web Services EMEA SARL — Infrastructure hosting (EU region)
• HubSpot, Inc. — CRM (United States, SCCs in place)

The Processor will notify the Controller of any intended changes to Sub-processors, providing at least 14 days' notice and an opportunity to object.

6. International Transfers

Where Personal Data is transferred outside the UK/EEA, the Processor ensures appropriate safeguards are in place, including Standard Contractual Clauses (Module 2: Controller to Processor) as approved by the European Commission.

7. Security Measures

The Processor maintains the following security measures for data under this DPA:

• TLS 1.2+ encryption for all data in transit
• Encryption at rest for databases storing account data
• Role-based access control limiting staff access to Personal Data
• Annual internal security reviews
• Incident response procedure with 72-hour breach notification capability

8. Data Retention and Deletion

Upon termination of the Terms of Service, the Processor will delete or return all Personal Data within 30 days, unless a longer retention period is required by law. Confirmation of deletion will be provided upon request.

9. Audit Rights

The Controller may, upon 30 days' written notice and no more than once per calendar year, request a written summary of security practices or commission an independent audit at the Controller's expense. The Processor will cooperate with such requests.

10. Governing Law

This DPA is governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.

11. Execution

This DPA is incorporated into and governed by the Terms of Service. Enterprise customers requiring a countersigned DPA document for their compliance records should contact: legal@universalguardrail.io