Data Processing Agreement

A Data Processing Agreement is a written contract that sets how personal data is processed when one party processes data on behalf of another. It is not the same as this public webpage.

A DPA may be appropriate when a client engagement requires AIONIQ to process personal data on the client’s documented instructions — for example operating a system that stores customer or employee data. Many brand and marketing briefs do not require a DPA.

Roles (controller, processor, or otherwise) depend on the actual work. They are defined in the signed DPA and related agreements, not inferred from this page.

Where AIONIQ acts on documented client instructions, those instructions sit in the DPA, statement of work, or similar writing.

People who handle personal data in an engagement are expected to keep it confidential, consistent with the Privacy Policy and any NDA or MSA.

Security measures for website and Workspace operations are described in Security. Additional measures for a specific processing activity are listed in the DPA if one is executed.

Infrastructure operators used by the public site today include Vercel, Supabase, Resend and optionally Upstash. A DPA for a client system may name a different set. See Privacy Policy.

How requests from individuals are handled in a processing relationship is defined in the DPA. For information AIONIQ holds as a studio, use the Privacy Policy contact path.

Notification duties for a personal-data incident, if any, are set in the signed DPA and applicable law — not in this summary.

Retention for a processing activity follows the DPA and the client’s instructions. Studio retention for website enquiries is described generally in the Privacy Policy.

Some operators may process data outside India. Transfer terms, if required, belong in the DPA.

What happens to personal data at the end of an engagement is defined in the DPA and the commercial agreement.

If your counsel requires a DPA as part of an AIONIQ engagement, email talk@aioniqlabs.com.