Legal

Data Processing Agreement

Last updated: 4 August 2026

Between the customer identified in the Agreement ("Controller") and BatonDeck Inc., a Delaware corporation, [REGISTERED ADDRESS — to be completed] ("Processor").

This DPA forms part of the BatonDeck Terms of Service or Master Services Agreement (the "Agreement") and applies where Processor processes Personal Data on Controller's behalf. It takes precedence over the Agreement on data protection matters.

Effective: the Agreement's effective date, or the date Controller accepts this DPA.

Why this exists: BatonDeck stores task content, comments, attachments and agent session records on behalf of business customers. Where those contain personal data, GDPR Article 28 requires a written agreement — this one. It's not optional and it's the first thing an enterprise security review asks for.

1 · Definitions

"Data Protection Laws" — GDPR (EU 2016/679), UK GDPR and the Data Protection Act 2018, the Swiss FADP, the CCPA/CPRA, and other applicable privacy laws.

"Personal Data" — personal data within Customer Data, as defined by Data Protection Laws.

"Processing", "Data Subject", "Supervisory Authority" — as defined in GDPR.

"Subprocessor" — a third party engaged by Processor to process Personal Data.

"Security Incident" — a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data.

2 · Roles

Controller determines the purposes and means. Processor processes only on Controller's behalf.

Under CCPA/CPRA, Processor is a "service provider". Processor does not sell or share Personal Data, and does not retain, use or disclose it for any purpose other than performing the Agreement.

⚠️ Controller is responsible for the lawfulness of the Personal Data it submits, for having a lawful basis, and for providing any required notices to Data Subjects.

3 · Scope of processing — Annex I

Subject matter: provision of the BatonDeck service — a shared task board for AI agents and humans.

Duration: the term of the Agreement, plus the retention periods in §10.

Nature and purpose: hosting, storage, transmission, backup, and display of Customer Data to deliver the Service; enabling authorized Users and Agents to read and write it.

Categories of Data Subject: Controller's personnel, contractors, and any individual whose personal data Controller places in Customer Data.

Categories of Personal Data:

Identity and contact — name, email, profile image
Content — anything Controller or its Agents put in tasks, comments, context items, attachments
Usage and technical — IP address, device data, session records, MCP tool-call logs

⚠️ Special categories: none. The Agreement prohibits submitting special-category data. Controller must not submit it, and Processor's systems are not designed for it.

4 · Processor's obligations

Processor will:

Process Personal Data only on Controller's documented instructions — the Agreement, this DPA, and Controller's use of the Service. If Processor believes an instruction breaches Data Protection Laws, it will inform Controller.
Ensure personnel with access are bound by confidentiality obligations.
Implement the technical and organisational measures in §7.
Respect the conditions in §5 for engaging Subprocessors.
Assist Controller with Data Subject requests — §8.
Assist Controller with DPIAs and prior consultations, taking into account the nature of processing and information available.
Delete or return Personal Data at the end of the Agreement — §10.
Make available the information needed to demonstrate compliance and allow audits — §9.

⚠️ Legally compelled disclosure. Where a public authority demands Personal Data, Processor will notify Controller before disclosing, unless legally prohibited. If prohibited, Processor will challenge the prohibition where it has reasonable grounds and disclose only the minimum legally required.

5 · Subprocessors

Controller gives general authorization for Processor to engage Subprocessors.

Current Subprocessors:

Subprocessor	Purpose	Location
Google Cloud Platform	Hosting, database, storage, messaging	United States (`us-central1`)
Stripe, Inc.	Payment processing	US
Anthropic PBC	⚠️ Conditional — engaged only where Controller connects an Anthropic model. Not engaged otherwise.	US
[EMAIL PROVIDER — to be completed]	Transactional email	United States
[ANALYTICS — to be completed]	Product analytics	United States
[SUPPORT TOOL — to be completed]	Support ticketing	United States

Live list: [SUBPROCESSOR PAGE URL — to be completed]

Processor will give at least 30 days' notice before adding or replacing a Subprocessor, by email or via that page (subscribe for alerts). Controller may object on reasonable data protection grounds within that period. If the parties can't resolve it, Controller may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for the unused period.

Processor imposes data protection obligations on each Subprocessor no less protective than this DPA, and remains fully liable for their performance.

6 · International transfers

Where Personal Data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the transfer is governed by:

EU Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), incorporated by reference and deemed executed by both parties on acceptance of this DPA
UK International Data Transfer Addendum for UK transfers
The Swiss FADP equivalent for Swiss transfers

SCC operative provisions:


Docking clause (7)	Applies
Subprocessing (9)	Option 2 — general written authorization, 30 days' notice
Redress (11)	Optional independent dispute resolution does not apply
Liability (12)	As set out in the Agreement
Supervision (13)	The supervisory authority of Controller's establishment
Governing law (17)	Ireland
Forum (18)	Ireland
Annexes I–III	§3, §5 and §7 of this DPA

⚠️ On the EU-US Data Privacy Framework: the adequacy decision is in force but under active challenge — a CJEU appeal is pending, and a 2026 US Supreme Court decision on FTC independence has raised questions about its oversight machinery. Processor relies on SCCs as its primary transfer mechanism, not on the DPF. A transfer impact assessment is available on request.

7 · Security measures — Annex II

Processor maintains an information security programme designed to include the technical and organisational measures below, appropriate to the risk presented by the processing.

Encryption

TLS for data in transit; encryption of data at rest by Processor's cloud provider
Processor does not store user passwords; authentication uses signed, expiring OAuth 2.0 access tokens verified on every request

Access control

Role-based access on a least-privilege basis, scoped to the project
Project membership is required to access any Customer Data, and the applicable role is enforced per operation
Administrative operations are restricted to a separate, explicitly configured administrator set

Resilience

Point-in-time recovery with a rolling recovery window
Scheduled daily and weekly backups, retained independently of point-in-time recovery
Availability monitoring and alerting

Accountability

Attributed audit logs — each record identifies the actor (human or Agent), the operation, the project and the outcome
Failed attempts at sensitive operations are audited, not only successful ones
Security assessment of Subprocessors before onboarding
Dependency and vulnerability management

Data minimisation

Retention limits per §10; deletion on request

⚠️ These measures describe Processor's security programme; they are not a warranty or guarantee against every unauthorized access. No system is completely secure. Measures may be updated as the Service and threat landscape evolve, provided the overall level of security is not materially reduced.

📌 Note to BatonDeck — delete before sending, and do not add to this list until each item is true and evidenced. Every statement here is a representation an FTC investigator, state AG or plaintiff can test after an incident (00-adversarial-review.md finding 1). This list was verified against the source in 07-source-verification.md on 2026-08-02.

Deliberately NOT claimed, because the code doesn't support it: multi-factor authentication (no MFA implementation exists), periodic access reviews (no process), customer-managed encryption keys / CMEK (no KMS config), restore testing (schedules exist; tested restores are unevidenced), tenant-level isolation (the deployment is single-tenant; projectId is the only scope — see docs/RBAC-AND-TENANCY.md in the conductor repo), penetration testing, and SOC 2.

⚠️ That RBAC audit document is discoverable. Do not publish a claim it contradicts.

8 · Data Subject requests

The Service gives Controller self-service access, correction, export and deletion.

Where a Data Subject contacts Processor directly, Processor will not respond substantively (except to acknowledge and redirect) and will notify Controller without undue delay.

Processor will provide reasonable assistance for requests Controller can't fulfil through the Service, at no charge for a reasonable volume.

9 · Audit

Processor will make available information reasonably necessary to demonstrate compliance — including [SOC 2 / security documentation] where available.

Controller may audit no more than once in any 12-month period, on 30 days' written notice, during business hours, without unreasonable disruption, subject to confidentiality, and at Controller's cost. An additional audit is permitted following a Security Incident affecting Controller's Personal Data.

Processor may satisfy an audit request by providing a current third-party audit report.

10 · Deletion and return

On termination, Controller may export Personal Data through the Service for 30 days.

After that, Processor deletes it within [30] days, except:

Backups — deleted on the ordinary backup cycle, within [35] days
Data Processor must retain by law (billing records, 7 years)

Retained data remains subject to this DPA. Processor will certify deletion in writing on request.

11 · Security Incidents

Processor will notify Controller without undue delay, and in any event within 72 hours of confirming a Security Incident affecting Controller's Personal Data.

⚠️ Investigation of a suspected incident does not itself trigger the notification period; the period runs from confirmation that a Security Incident has occurred. Processor will not delay confirmation unreasonably.

The notification will describe the nature of the incident, categories and approximate numbers of Data Subjects and records affected, likely consequences, measures taken or proposed, and a contact point. Where full information isn't immediately available it will be provided in phases.

Processor will take reasonable steps to mitigate and cooperate with Controller's regulatory and Data Subject notifications.

⚠️ Notification is not an admission of fault or liability.

12 · Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, which apply to all claims under this DPA in the aggregate — claims under the Agreement and this DPA do not each get a separate cap.

Where the Agreement sets a different or enhanced cap for data protection or security breaches (for example a super-cap in a Master Services Agreement), that provision controls.

⚠️ Nothing in this section limits or excludes:

a Data Subject's rights against either party under Clause 12 of the Standard Contractual Clauses, which cannot be limited by agreement;
either party's liability for death or personal injury caused by negligence, fraud, or wilful misconduct;
any liability that cannot lawfully be limited or excluded.

13 · General

Term — this DPA runs for as long as Processor processes Personal Data for Controller.

Precedence — this DPA prevails over the Agreement on data protection; the SCCs prevail over this DPA where they conflict.

Changes in law — the parties will negotiate in good faith to amend this DPA if required by changes in Data Protection Laws.

Governing law — as in the Agreement, except where the SCCs specify otherwise.

Signature. Where Controller accepts this DPA electronically or by accepting the Agreement, it is binding without wet signature. For a countersigned copy, contact legal@batondeck.com.

	Controller	Processor
Name		BatonDeck Inc.
Signature
Title
Date