Proposed Data Processing Agreement (B2B)
Prepared 26 October 2026 · Not effective · Subprocessor lists, safeguards and retention require validation.
Parties and roles
Insofar as a business customer supplies personal data within supported paid cloud-audit input for processing on its behalf, the customer is expected to act as controller and Iadema Studio OÜ, Estonian registry code 16768134, as processor under documented instructions. The operator may separately act as controller for its own account, security, marketing if opted in, support and billing data; those uses are described in the Privacy Notice. Actual roles must be validated for each offering before executing this DPA.
Scope, duration, nature and purpose
Processing consists of receiving and temporarily analyzing permitted JSON records supplied for integrity diagnostics during the customer's subscribed service, and retaining limited audit summaries, timestamps and fingerprints necessary for service delivery and billing. The purpose is to return diagnostic anomalies and evidence for review, not to train public models, sell personal data or determine legal rights. Duration follows the purchased subscription and approved retention/deletion schedule. Use of the free, local browser audit normally does not require the supplier to receive uploaded file contents.
Categories of individuals and data
Depending on what the customer voluntarily supplies, records might refer to customer representatives, employees, end users, invoice contacts or account users; technical event IDs, subscription IDs and metadata can be personal data when linkable. **For the current beta, the customer must use synthetic or effectively anonymized data only.** Payment-card details, secrets, special-category and regulated personal data are excluded from the permitted dataset.
Controller instructions and confidentiality
The processor acts only on lawful, documented service instructions (including agreed transfers), ensures relevant authorized personnel are bound to confidentiality, limits access to what is necessary and assists the controller reasonably with security, access and deletion requests, taking into account the available information and applicable law. Instructions that contravene law must be addressed under the final agreement.
Technical and organizational security
The proposed controls include encrypted HTTPS transit, logical tenant isolation, restricted cloud credentials, hashed session credentials/tokens, database access authorization, immutable transactional credit ledger, and bounded processing input. **These are design descriptions, not an independent certification.** The final signed annex must specify tested controls, audit-log handling, access reviews, incident response and recovery objectives, including off-provider backup and restore.
Subprocessors and transfers
Cloudflare supplies hosting, Workers, D1 and Turnstile; Brevo supplies transactional email for the operator's account flow; Google may supply optional OAuth; Stripe/Link may process billing and transaction support. Not every listed provider necessarily receives customer-submitted audit data. The exact data recipients, subprocessor contractual basis, hosting geography, cross-border transfer safeguards and advance notice/object process require legal and technical review. The final DPA must include a dated list and processor rights.
Assistance, breach notification and audits
The final agreement should define how FIXLAYER assists with data subject requests, impact assessments, audits and regulator contact, and how/when the controller is informed without undue delay of an actual personal data breach, with appropriate security and incident facts. No unsupported guaranteed notification hours are asserted by this Preview document.
Return, deletion and lawfully preserved records
On termination, the final instructions should provide supported export/deletion of customer data subject to legal retention and provider backup limitations. Technical request and billing references may require preservation for accounting, abuse prevention or claims. The precise deletion timetable and implementation must be tested and agreed before processing personal customer datasets.
General and status
Applicable governing law, liability, precedence of standard contractual clauses where required and Article 28(3) obligations will be completed in the final professionally reviewed DPA. This unexecuted draft cannot be used as a signed processor agreement. Please direct proposed business-data processing questions to olverthsolutions@gmail.com.