Data Processing Agreement (DPA)
This DPA governs AlphaClone's processing of personal data on behalf of business customers in compliance with GDPR, POPIA, and applicable data protection law.
1. Roles & Responsibilities
Customer (Data Controller)
The business or individual subscribing to AlphaClone. The Controller determines the purposes and means of processing personal data of their clients, contacts, and team members. The Controller is responsible for ensuring their instructions to AlphaClone are lawful.
Alphaclone Systems, LLC (Data Processor)
AlphaClone processes personal data only on behalf of and according to the documented instructions of the Controller. AlphaClone acts as a Controller only for its own account administration data (billing, authentication).
2. Processing Details
| Subject Matter | Operation of the AlphaClone Business OS on behalf of the Customer |
| Duration | For the term of the subscription and post-termination retention period (90 days) |
| Nature | Storage, retrieval, display, transmission, and deletion of personal data |
| Purpose | To provide CRM, billing, contract, project management, and communication features to the Customer |
| Categories of Data | Names, email addresses, phone numbers, company info, financial records, contract data, correspondence |
| Data Subjects | Customer's clients, leads, employees, team members, and contractors |
3. AlphaClone's Obligations as Processor
- Process personal data only on documented instructions from the Customer, including transfers to third countries
- Ensure that all staff authorised to process personal data are bound by appropriate confidentiality obligations
- Implement appropriate technical and organisational security measures (see Section 6 of our Privacy Policy)
- Assist the Customer in responding to data subject rights requests (access, erasure, portability)
- Assist the Customer in meeting GDPR obligations regarding security, breach notification, DPIAs, and prior consultation
- Delete or return all personal data to the Customer on termination of the service, at the Customer's choice
- Make available all information necessary to demonstrate compliance with this DPA
- Notify the Customer without undue delay (and within 72 hours where possible) upon becoming aware of a personal data breach
4. Sub-processors
AlphaClone uses the following authorised sub-processors. All sub-processors are bound by data processing agreements no less protective than this DPA. The Customer grants general authorisation for AlphaClone to use these sub-processors.
| Sub-processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Supabase, Inc. | Database & authentication | US (AWS us-east-1) | SCCs + DPA |
| Stripe, Inc. | Payment processing | US | SCCs + DPA |
| Cloudflare, Inc. | CDN, DDoS, bot protection | Global (US HQ) | SCCs + DPA |
| Railway Corp. | Application hosting | US (AWS) | SCCs + DPA |
| Resend / SendGrid | Transactional email | US | SCCs + DPA |
| Sentry, Inc. | Error monitoring | US | SCCs + DPA |
AlphaClone will notify the Customer of any intended addition or replacement of sub-processors by updating this DPA and sending an email notification at least 14 days before the change takes effect. The Customer may object to a new sub-processor in writing within 14 days.
5. International Data Transfers
Where personal data is transferred from the EEA, UK, or Switzerland to countries not recognised as providing adequate protection (including the United States), AlphaClone relies on the following safeguards:
- Standard Contractual Clauses (SCCs) — EU Commission Decision 2021/914, Module 2 (Controller to Processor)
- UK International Data Transfer Addendum (IDTA) for transfers from the UK
- Binding Corporate Rules where applicable
Copies of the applicable SCCs are available on request from [email protected].
6. Audit Rights
AlphaClone shall make available to the Customer all information reasonably necessary to demonstrate compliance with the obligations in this DPA. The Customer may conduct an audit (or commission a third-party auditor) of AlphaClone's data processing activities, subject to:
- Giving at least 30 days' written notice to [email protected]
- Audits being conducted during normal business hours and no more than once per calendar year
- The auditor executing a non-disclosure agreement acceptable to AlphaClone
- The Customer bearing all costs of the audit
7. Personal Data Breach Notification
Upon becoming aware of a personal data breach affecting data processed under this DPA, AlphaClone will:
- Notify the Customer without undue delay, and where feasible within 72 hours of becoming aware
- Provide the Customer with: nature of the breach, categories and approximate number of data subjects affected, likely consequences, measures taken or proposed to address the breach
- Assist the Customer in notifying the relevant supervisory authority and affected data subjects as required
8. Data Deletion & Return
Upon termination or expiry of the subscription, AlphaClone will, at the Customer's election:
- Return all personal data to the Customer in CSV/JSON format within 30 days of a written request
- Securely delete all personal data within 90 days of account deletion
- Provide written confirmation of deletion upon request
- Backup snapshots containing personal data are purged within 30 days of account deletion
9. Contact & DPA Requests
To request a signed copy of this DPA, or for any data processing queries:
Privacy & DPA: [email protected]
Legal: [email protected]