Data Processing Agreement (template)

Version 0.1 (draft) · 12 July 2026 · Executed as part of the subscription agreement for business customers.

1. Roles

The customer is the controller of workspace personal data; HEARTBEAT is the processor acting on documented instructions (the product configuration and this agreement).

2. Processing scope

Categories: employee/contractor work records, account data, and the special-design wellbeing data described in the Privacy Policy (stored as HMAC hashes; individually unreadable by design). Duration: the subscription term plus the 30-day export window.

3. Security measures (Annex II summary)

• Tenant isolation enforced with database row-level security and per-request organisation scoping;
• Role-based access from a single audited permission matrix, with hard denials that no configuration can override;
• Credentials hashed (scrypt), sessions revocable, optional TOTP MFA; transport encryption throughout;
• Audit logging of administrative and platform access;
• Individual sentiment stored only as keyed hashes — see the Security overview.

4. Subprocessors

Listed at /legal/subprocessors; changes notified 30 days in advance with a right to object.

5. Assistance & rights

We provide in-product export and anonymisation-based erasure workflows, and assist with data-subject requests, DPIAs and supervisory enquiries as reasonably required.

6. Breach notification

We notify the customer without undue delay and within 72 hours of confirming a personal-data breach, with the information required for the customer's own notifications.

7. Return & deletion

On termination, self-service export remains available for 30 days; thereafter data is deleted from production systems and rotates out of backups on the documented schedule.

[Signature blocks / SCC module selection — to be finalised with counsel.]