Template
Data Processing Agreement
Template for execution. Have counsel review it before signature. To request a signed copy, email privacy@dealmade.ai.
1. Roles
The customer is the controller of personal data it uploads or that its users submit in a deal room. DealMade is the processor, and a controller only for its own account, billing, and security logs. Subprocessors are listed on the trust center.
2. Subject matter and duration
Processing covers deal documents, buyer and broker accounts, chat, signatures, and product events needed to run the deal room. Processing lasts for the subscription term and the retention periods published in the trust center, unless a legal hold or a deletion request says otherwise.
3. Instructions
DealMade processes customer personal data to provide the service, secure it, and meet the written instructions in the agreement and this DPA. We will tell the customer if an instruction appears to violate applicable privacy law.
4. Security
Measures include encryption in transit, encryption at rest from the hosting provider, row-level tenant isolation, access limited to authenticated roles, and an append-only audit log for privileged actions. Personnel access to production data is limited to operators who need it.
5. Breach notice
DealMade will notify the customer without undue delay after confirming a personal-data breach that affects the customer's data, and will include what we know about the nature of the breach, the data involved, and the steps already taken.
6. Deletion and return
On a verified request, or at the end of the term, DealMade deletes or returns personal data in scope, then deletes remaining copies on the retention schedule. Data under a legal hold is kept until the hold is released, and the response will say so. Backups age out on the provider window rather than being edited in place.
7. Audit
Once a year, or after a confirmed breach, the customer may ask for the current security summary and, when it exists, the SOC 2 report. No SOC 2 report is available today. On-site audits require reasonable notice and a scope that does not expose other customers' data.
8. International transfers
Where a subprocessor processes personal data outside Canada, the parties rely on the contractual clauses applicable to that transfer, including standard contractual clauses where they are required. The production database region named in the order form controls primary storage.