Data Processing Agreement (DPA)
Draft — pending legal-counsel review. Not yet for contract use. See
README.md. Entity facts:COMPANY.md.
- Processor: byRazLabs Ltd (trading as "Dena")
- Version: 1.1 (draft) — drafted 2026-06-05, updated 2026-07-08
- Incorporated into: the Terms of Service
This DPA forms part of the agreement between Dena ("Processor") and the Customer ("Controller") and governs Dena's processing of personal data on the Controller's behalf under UK GDPR, the EU GDPR, and the Data Protection Act 2018 ("Data Protection Law"). Where it conflicts with the Terms on data-protection matters, this DPA prevails.
1. Roles
The Controller determines the purposes and means of processing Customer Data; Dena processes it only as the Controller's processor, on documented instructions. For some personal data (account data) Dena is an independent controller — that is governed by the Privacy Policy, not this DPA.
2. Processing details (Art. 28(3))
| Item | Detail |
|---|---|
| Subject-matter | Provision of the Dena inspection-and-repair platform |
| Duration | The term of the agreement, plus the deletion window in §9 |
| Nature & purpose | Hosting, storing, organising, analysing (incl. AI analysis), and making available inspection content and reports, to provide the Service |
| Types of personal data | Names and work contact details of the Controller's personnel (inspectors, reviewers, asset-owner contacts); any personal data the Controller chooses to include in inspection content (e.g. individuals incidentally visible in site photographs, metadata such as capture location/time) |
| Categories of data subject | The Controller's staff and authorised users; sub-tenant (asset-owner) users; individuals incidentally captured in inspection media |
| Special-category data | Not intended; the Controller must not submit special-category data unless agreed in writing with appropriate safeguards |
3. Dena's obligations
Dena will:
(a) process Customer personal data only on the Controller's documented instructions (the agreement, the Service's configuration, and lawful written instructions), including on international transfers, unless required otherwise by law (and will then inform the Controller unless prohibited);
(b) ensure personnel authorised to process the data are bound by confidentiality;
(c) implement the technical and organisational security measures in Annex 2;
(d) respect the sub-processor conditions in §5;
(e) assist the Controller — by appropriate technical and organisational measures, and insofar as possible — in responding to data-subject-rights requests (§6);
(f) assist the Controller in ensuring compliance with security, breach-notification, DPIA, and prior-consultation obligations (Arts. 32–36), taking account of the information available to Dena;
(g) delete or return Customer personal data at the end of the agreement per §9;
(h) make available information necessary to demonstrate compliance and allow for and contribute to audits per §8; and
(i) notify the Controller if, in Dena's opinion, an instruction infringes Data Protection Law.
4. Controller's obligations
The Controller warrants that it has a lawful basis to provide the Customer Data to Dena, has given any required notices and obtained any required consents, and that its instructions comply with Data Protection Law. The Controller is responsible for the accuracy and legality of the Customer Data it submits.
5. Sub-processors
5.1 The Controller gives general authorisation for Dena to engage sub-processors. The current list — including Google Cloud (hosting/storage), Clerk (identity), and Anthropic (AI inference) — is at sub-processors.md.
5.2 Dena imposes data-protection obligations on each sub-processor that are no less protective than this DPA, and remains liable for its sub-processors' acts and omissions.
5.3 Dena will give the Controller prior notice (at least 30 days where practicable, via the sub-processor page and/or email) of any new or replacement sub-processor. The Controller may object on reasonable data-protection grounds within that notice period; if the objection cannot be resolved, the Controller may terminate the affected Service.
6. Data-subject requests
Dena will, taking account of the nature of the processing, assist the Controller by appropriate measures (including the Service's self-service tools and the DSAR procedure) to fulfil the Controller's obligation to respond to data-subject requests. Those measures include an operator-run data-subject-rights toolset (structured export and erasure/anonymisation of the personal data Dena holds in its account, contact, and event stores) and, for individuals who hold a Dena account, in-product self-service to export their account data and opt out of usage analytics (Settings → Privacy). Personal data that appears only inside media or free-text inspection content is handled on the Controller's documented instruction; erased or anonymised data may persist in encrypted backups until they roll off (§9). If a data subject contacts Dena directly about Customer Data, Dena will refer them to the Controller and not respond substantively except on the Controller's instruction.
7. Personal-data breaches
Dena will notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal-data breach affecting Customer personal data, with the information required to help the Controller meet its Art. 33/34 obligations, and will cooperate and take reasonable steps to mitigate. Dena's internal handling is the Incident Response Plan and the Data Breach Procedure.
8. Audits
Dena will make available the information necessary to demonstrate compliance with Art. 28. The Controller may audit no more than once per year (and after a breach) on reasonable notice, during business hours, without unreasonably disrupting Dena. Dena may satisfy an audit request by providing its security documentation, this DPA's TOMs, and — when available — third-party reports (e.g. a SOC 2 report or ISO 27001 certificate). See the Trust page for current report status.
9. Return & deletion
On termination, or on the Controller's request, Dena will (at the Controller's choice) return or delete Customer personal data and delete existing copies, within 90 days, except where law requires retention. Backups are deleted on the rolling backup cycle in the Data Retention & Deletion Policy.
10. International transfers
Dena hosts Customer Data in GCP europe-west2 (London, UK). Where personal data is transferred to a country without UK/EU adequacy (e.g. a sub-processor outside the UK/EEA), the parties rely on the UK IDTA and/or the EU SCCs (with the relevant modules), which are incorporated by reference and completed with the parties' details and Annex 1 / Annex 2, together with a transfer risk assessment. See sub-processors.md for each transfer.
11. Liability & term
This DPA is subject to the limitation-of-liability provisions of the Terms of Service. It takes effect when the agreement does and lasts as long as Dena processes Customer personal data.
Annexes
Annex 1 — Processing & transfer details
As set out in §2 (processing details) and sub-processors.md (recipients, locations, transfer safeguards). Parties' legal details: the Controller as named in the Order Form; the Processor as in COMPANY.md.
Annex 2 — Technical and Organisational Measures (TOMs)
Dena implements, and maintains, the following measures (described in full in the security policies and summarised for customers on the Trust page):
Access control & identity
- Identity managed by a dedicated provider (Clerk); unique accounts, no shared logins.
- Multi-factor authentication enforced on administrative and cloud-console access.
- Least-privilege role-based access; access reviewed periodically and revoked on
offboarding.
- Tenant isolation enforced at the database layer via PostgreSQL **row-level
security** — every query runs under a tenant-scoped role (ADR-0008).
Encryption
- In transit: TLS for all external connections.
- At rest: provider-managed encryption (GCP) for databases, object storage, and
backups; report signing uses Cloud KMS-managed keys (ADR-0020).
Resilience & backup
- Automated database backups with point-in-time recovery (production: up to 30 daily
backups + 7 days of transaction logs); restore procedures are documented and rehearsed (backup/restore runbook).
- Object-storage versioning for media and reports.
Logging & monitoring
- Structured, centralised logging (Cloud Logging), distributed tracing, and monitoring
(ADR-0025); security-relevant events retained per the Logging & Monitoring Policy.
Secure development & change management
- Version control, peer code review, CI gates, and controlled deployments
(change-management, secure SDLC). No long-lived cloud service- account keys (Workload Identity Federation).
Organisational
- Documented information-security policies, an incident-response plan, vendor due
diligence, confidentiality obligations on personnel, and a risk-management process.
AI-specific
- Customer Data sent for AI inference is processed by a contracted sub-processor
(Anthropic) that is bound not to train on data submitted via its API; AI outputs are versioned and content-addressed for auditability.
(The TOMs evolve as the program matures; the authoritative, current version lives in the security policies and is reflected here on each DPA revision.)
Revision history
| Version | Date | Change | Author |
|---|---|---|---|
| 1.0 (draft) | 2026-06-05 | Initial draft | AI session — pending counsel review |
| 1.1 (draft) | 2026-07-08 | §6 note the operator-run data-subject-rights toolset (export + erasure/anonymisation) and account-holder self-service (export + analytics opt-out); backup-residual caveat retained | AI session — pending counsel review |