Legal

Syncopier — Data Processing Agreement (DPA)

Last updated: 15 July 2026

This Data Processing Agreement ("DPA") forms part of the agreement between Syncopier ("Syncopier", "we", "us", the "Processor") and the customer using the Service ("you", the "Controller"). It applies where, and to the extent that, we process personal data on your behalf when providing the Service, and it reflects Article 28 of the UK GDPR. Where we decide the purposes of processing ourselves, we act as controller and our Privacy Policy applies instead.

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings given in the UK GDPR. "Data protection law" means the UK GDPR, the Data Protection Act 2018, and any other applicable data protection law.

2. Roles

For personal data we process on your behalf, you are the controller and we are the processor. You are responsible for having a lawful basis for the processing and for the accuracy and legality of the personal data you provide.

3. Our obligations

We will: - process personal data only on your documented instructions, including this DPA and your normal use of the Service, unless the law requires otherwise (in which case we will tell you, unless the law prevents us); - make sure people we authorise to process the data are bound by confidentiality; - put appropriate technical and organisational security measures in place (see Annex 2); - help you, where reasonable, to respond to data subject requests and to meet your duties on security, breach notification, and data protection impact assessments; - tell you without undue delay after we become aware of a personal data breach affecting your data; - delete or return your personal data at the end of the Service, unless the law requires us to keep it; and - give you the information needed to show compliance with Article 28, and allow audits as set out in section 6.

4. Sub-processors

You give general authorisation for us to use sub-processors to help provide the Service. A current list is in Annex 3. We will place data protection obligations on our sub-processors that are equivalent to those in this DPA, and we stay responsible for their work. We will give you reasonable notice of any new or replacement sub-processor, and you may object on reasonable data protection grounds.

5. International transfers

Where personal data is transferred outside the UK, we will make sure an appropriate safeguard is in place, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

6. Audits

On reasonable written request, and no more than once a year unless a regulator requires it, we will provide information reasonably needed to show we are meeting this DPA. Any audit must respect confidentiality and must not disrupt our operations or other customers.

7. Liability

Each party's liability under this DPA is subject to the limits and exclusions of liability in the main agreement (our Terms of Service).

8. Duration

This DPA applies for as long as we process personal data on your behalf.

Annex 1 — Details of the processing

Annex 2 — Security measures

We apply measures appropriate to the risk, including encryption of data in transit and at rest, access controls and least-privilege access, protection of connection credentials, secure development practices, logging and monitoring, and regular backups.

Annex 3 — Sub-processors

← Back to Syncopier home