Data Processing Agreement

Draft — pending legal review. This page describes how a Data Processing Agreement (DPA) works with Clausewatch; it is not itself an executed agreement.

1. Who needs a DPA

If your organization is subject to GDPR, the UK GDPR, or similar data protection law, and you upload contract data that includes personal data, you likely need a signed DPA with Clausewatch as a condition of processing that data lawfully.

2. Roles

For data you upload to the Service, your organization acts as the data controller and Clausewatch acts as the data processor, processing customer data only on your documented instructions and for the purposes described in our Privacy Policy.

3. Sub-processors

Clausewatch uses a limited set of sub-processors to operate the Service, published at /subprocessors, including our AI extraction vendor, cloud storage, email delivery, and hosting infrastructure. A signed DPA includes standard flow-down obligations for these sub-processors and advance notice of material changes.

4. Security measures

Uploaded documents are encrypted at rest and in transit. Access to customer data is scoped by organization and role within the product.

5. Requesting a DPA

To request a signed DPA (including EU Standard Contractual Clauses where applicable), contact your account contact.