Data Processing Addendum
- Version
- 1.0 (draft)
- Published
- [Publication date]
- Effective
- [Effective date]
Draft, pending counsel review. Not in force. What this means
When your organization uploads personal data about its own people, we process it only on your instructions. This addendum sets out those terms and forms part of the Terms of Service.
1. Parties and scope
This Data Processing Addendum (DPA) is between [Aligner, Inc.] (Aligner) and the organization that accepts the Terms of Service (the Customer). It applies automatically and needs no separate signature.
It applies where Aligner processes Customer Personal Data: personal data about the Customer's employees, members or other people that the Customer puts into requests, reviews, attachments or organization settings.
Aligner is the Customer's processor for Customer Personal Data. Aligner is an independent controller for account, contributor, payment, tax, sanctions and platform-safety data, as described in the Privacy Policy.
2. Details of processing
| Item | Description |
|---|---|
| Subject matter | Hosting and processing Customer Personal Data to provide the Service |
| Duration | The term of the Terms of Service, plus the deletion period in section 9 |
| Nature and purpose | Storage, display to authorised users, transmission to contributors the Customer engages, support |
| Data subjects | Customer's employees, members, contacts and people named in requests or reviews |
| Categories of data | Names, work contact details, roles, and any personal data in request or review content |
| Special categories | None intended. The Customer must not upload special category data |
3. Aligner's obligations
Under Article 28 GDPR, the UK GDPR and Article 12 KVKK, Aligner will:
- process Customer Personal Data only on the Customer's documented instructions, including those given through the Service, unless the law requires otherwise, in which case Aligner will tell the Customer first where allowed;
- ensure that people authorised to process it are bound by confidentiality;
- apply the security measures in section 8;
- assist the Customer, taking into account the nature of processing, in answering data subject requests and in meeting its security, breach, impact assessment and consultation obligations;
- delete or return Customer Personal Data at the end of the Service, as section 9 describes;
- make available the information needed to demonstrate compliance, and allow audits under section 7.
Aligner will tell the Customer if it believes an instruction infringes data protection law.
4. The Customer's obligations
The Customer is responsible for having a lawful basis for the Customer Personal Data it uploads, for giving its people any required notice, and for the accuracy of its instructions.
5. Sub-processors
The Customer gives general authorisation for Aligner to use sub-processors. The current list is on Sub-processors.
Aligner will give at least 15 days notice before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service and receive a refund of any prepaid, unused fees.
Aligner imposes data protection terms on each sub-processor that are no less protective than this DPA, and remains responsible for their performance.
6. International transfers
Where Customer Personal Data is transferred from the EEA to Aligner in the United States, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated by reference: Module 2 (controller to processor) and, where the Customer is itself a processor, Module 3 (processor to processor).
- Clause 7 (docking clause) applies.
- Clause 9 option 2 (general authorisation) applies, with the notice period in section 5.
- Clause 11 optional language does not apply.
- Clauses 17 and 18: the law and courts of [Ireland, or another EU Member State counsel selects].
- Annexes I and II are completed by sections 2 and 8 of this DPA.
For UK data, the UK International Data Transfer Addendum is incorporated. For data from Türkiye, the parties will execute the standard contract published by the Personal Data Protection Authority, and Aligner will notify the Authority within five business days of signature.
7. Audits
Aligner will answer reasonable written security questionnaires once a year and share available third-party audit reports or certifications.
If those are not sufficient to show compliance, or a supervisory authority requires it, the Customer may conduct an audit on 30 days' notice, during business hours, at its own cost, under confidentiality, and no more than once a year.
8. Security measures
| Area | Measures |
|---|---|
| Encryption | TLS in transit; encryption at rest by the hosting provider |
| Access control | Role-based access, least privilege, multi-factor authentication for operators |
| Keys and funds | No custody of user private keys; USDC and USDT escrow held in an onchain vault per request; platform keys used only by the payments worker; operator review of large withdrawals |
| Logging | Security and administrative access logs, retained up to 12 months |
| Resilience | Managed hosting with backups and documented recovery procedures |
| People | Confidentiality obligations and security training for staff with access |
| Vendors | Due diligence and contractual terms for every sub-processor |
| Incidents | Documented breach response and notification procedure |
9. Personal data breaches
Aligner will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
The notice will describe the breach, the data and people likely affected, the likely consequences and the measures taken or proposed, as far as that information is available. Aligner will provide further information as it becomes available.
10. Return and deletion
On termination, the Customer may export its data for 30 days. Aligner will then delete Customer Personal Data within a further 60 days, unless the law requires it to keep some of it.
Data on the Solana blockchain consists only of hashes and wallet transactions and cannot be deleted. It contains no Customer Personal Data in clear form.
11. Liability and precedence
Each party's liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow those limits.
If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of Customer Personal Data. If the SCCs conflict with this DPA, the SCCs prevail.
Questions go to [privacy@aligner.network].
Version history
- Version 1.0 (draft)[Publication date]First draft for counsel review.