Data Processing Agreement

Last updated 28 September 2026

Template for review. This document is not legal advice and must be reviewed by a qualified lawyer before use.

1. Roles

When we process task content or platform data for an account owner or platform, they are the controller and we are the processor. For tasker data, we are the controller.

2. Instructions

We process controller data only on documented instructions and only to deliver the services.

3. Security measures

• Encryption at rest and in transit
• Isolated virtual machines per account
• No clipboard, file transfer or USB
• Role-based access and 2FA
• Tamper-evident audit logs kept for 2 years

4. Sub-processors

We keep a current list of sub-processors (hosting, identity verification, payments) and give 30 days' notice of changes, with a right to object.

5. Breaches

We notify the controller without undue delay, and within 72 hours of becoming aware of a personal data breach.

6. Deletion and return

At the end of the service we delete or return controller data within 30 days, unless the law requires us to keep it.

7. Audits

We make information available to show compliance and allow reasonable audits once a year, with 30 days' notice.