Data Processing Agreement

1. Parties

Controller: You (the Aethrix account holder). You determine the purposes and means of processing your personal data.

Processor: Aethrix (the Company). Aethrix processes personal data on your behalf to provide the Services.

2. Scope & Definitions

This DPA governs the processing of personal data by Aethrix as a processor on behalf of the controller in connection with the Services.

• "Personal Data" — any information relating to an identified or identifiable natural person
• "Processing" — any operation performed on personal data
• "Services" — Aethrix Studio, CLI, cloud services, and related offerings
• "Sub-processor" — a third party engaged by Aethrix to process personal data

3. Processor Obligations

Aethrix shall:

1. Process personal data only on documented instructions from the controller
2. Ensure personnel involved are subject to confidentiality obligations
3. Implement appropriate technical and organizational security measures
4. Assist the controller with data subject rights requests
5. Assist with data protection impact assessments and consultations
6. Delete or return personal data at end of services
7. Maintain records of processing activities

4. Sub-processors

You authorise Aethrix to engage the sub-processors listed on the Sub-processor List.

• Aethrix will notify you of sub-processor changes per regional requirements
• You may object within the specified timeframe
• Sub-processors are bound by written agreements with data protection obligations equivalent to this DPA
• Sub-processors operate only in your selected region

5. Data Subject Rights

Aethrix shall promptly notify the controller of any data subject request and provide reasonable assistance in responding.

Controllers may exercise data subject rights directly via the account portal or by contacting privacy@aethrixstudio.com.

6. Security Measures

Aethrix implements technical and organizational measures including:

• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• Access controls with least-privilege principle
• Dependency vulnerability scanning on every build, and vulnerability management. No third-party penetration test has been performed to date.
• Physical security of data centers
• Employee security training and confidentiality agreements
• Incident response plan

7. Data Breach Notification

Aethrix shall notify the controller without undue delay upon becoming aware of a personal data breach.

Notification shall include: nature of breach, categories of data involved, likely consequences, and mitigation measures.

Regional breach notification timing requirements are specified in Section 10.

8. Audit & Compliance

Upon reasonable notice (at least 30 days), the controller may audit Aethrix's compliance with this DPA. Where an audit produces a report it is shared with the controller. No third-party audit has been performed to date, so there is no such report yet; until one exists we provide a current description of our controls and answer written questionnaires. Costs of audit are borne by the controller unless non-compliance is found.

9. Data Deletion & Return

Upon termination of services, Aethrix shall delete or return all personal data within 30 days, unless retention is required by applicable law.

10. Regional Provisions

Region-specific terms, governing law, and additional clauses are detailed below for Europe (EU).

EU-Specific DPA Provisions

EU Clauses

1. Standard Contractual Clauses (SCCs): Current processing stays within the EU/EEA, so no transfer mechanism is engaged and no SCCs are currently in force. If processing ever moves outside the EEA, Aethrix will execute SCCs (Module 2 - Controller-to-Processor) before the transfer begins and notify affected controllers.
2. Art. 28 Compliance: This DPA satisfies the requirements of GDPR Art. 28(3) for processor agreements.
3. Data Protection by Design: Aethrix applies Art. 25 principles — data minimization, pseudonymization, and privacy-friendly defaults.
4. Records of Processing: Not yet maintained as a formal Art. 30 register. Processing details are described in this DPA and are available on written request; a formal register is on the compliance roadmap.
5. Sub-processor Changes: 30-day notice via email. Objection within 14 days triggers discussion in good faith.
6. Dispute Resolution: Irish DPC jurisdiction as lead supervisory authority.

11. Acceptance

Signing acceptance of this agreement is done in the portal: an administrator of the organization signs in here and accepts the version shown above, which records the version, who accepted it and when.