Data Processing Agreement (DPA)

• Process personal data only on documented instructions from the Customer, including transfers to third countries
• Ensure that all staff authorised to process personal data are bound by appropriate confidentiality obligations
• Implement appropriate technical and organisational security measures (see Section 6 of our Privacy Policy)
• Assist the Customer in responding to data subject rights requests (access, erasure, portability)
• Assist the Customer in meeting GDPR obligations regarding security, breach notification, DPIAs, and prior consultation
• Delete or return all personal data to the Customer on termination of the service, at the Customer's choice
• Make available all information necessary to demonstrate compliance with this DPA
• Notify the Customer without undue delay (and within 72 hours where possible) upon becoming aware of a personal data breach

AlphaClone uses the following authorised sub-processors. All sub-processors are bound by data processing agreements no less protective than this DPA. The Customer grants general authorisation for AlphaClone to use these sub-processors.

AlphaClone will notify the Customer of any intended addition or replacement of sub-processors by updating this DPA and sending an email notification at least 14 days before the change takes effect. The Customer may object to a new sub-processor in writing within 14 days.

Where personal data is transferred from the EEA, UK, or Switzerland to countries not recognised as providing adequate protection (including the United States), AlphaClone relies on the following safeguards:

• Standard Contractual Clauses (SCCs) — EU Commission Decision 2021/914, Module 2 (Controller to Processor)
• UK International Data Transfer Addendum (IDTA) for transfers from the UK
• Binding Corporate Rules where applicable

Copies of the applicable SCCs are available on request from [email protected].

AlphaClone shall make available to the Customer all information reasonably necessary to demonstrate compliance with the obligations in this DPA. The Customer may conduct an audit (or commission a third-party auditor) of AlphaClone's data processing activities, subject to:

• Giving at least 30 days' written notice to [email protected]
• Audits being conducted during normal business hours and no more than once per calendar year
• The auditor executing a non-disclosure agreement acceptable to AlphaClone
• The Customer bearing all costs of the audit

Upon becoming aware of a personal data breach affecting data processed under this DPA, AlphaClone will:

• Notify the Customer without undue delay, and where feasible within 72 hours of becoming aware
• Provide the Customer with: nature of the breach, categories and approximate number of data subjects affected, likely consequences, measures taken or proposed to address the breach
• Assist the Customer in notifying the relevant supervisory authority and affected data subjects as required

Upon termination or expiry of the subscription, AlphaClone will, at the Customer's election:

• Return all personal data to the Customer in CSV/JSON format within 30 days of a written request
• Securely delete all personal data within 90 days of account deletion
• Provide written confirmation of deletion upon request
• Backup snapshots containing personal data are purged within 30 days of account deletion

To request a signed copy of this DPA, or for any data processing queries: