Data Processing Agreement (DPA)
This DPA forms part of the Syntri Terms of Service.
1. Parties
Controller
The Client
Processor
Craft Intelligence Ltd
2. Subject of Processing
Processing of organisational and personal data for the provision of:
Automated matching
Exception analytics
Reporting
Support & operations
3. Duration
The duration of the contract plus 90 days after termination.
4. Processor Obligations
Craft Intelligence will:
Act only on documented instructions
Ensure confidentiality of personnel
Apply strict security controls
Assist the Controller with data rights requests
Notify breaches within 72 hours
Delete or return data upon termination
Maintain processing records
5. Sub-processing
Permitted with:
Written agreements
Equivalent data protection obligations
Prior notification to Client
6. International Transfers
Transfers outside approved regions require:
SCCs
UK Addendum
POPIA-compliant safeguards
7. Technical & Organisational Measures
Craft Intelligence implements:
Encryption
Access controls
Firewalls & monitoring
Backups
MFA for admin users
Penetration tests
Secure development lifecycle
8. Termination of Processing
Upon termination:
Client may export their data
Processor deletes all remaining data within 90 days
Backups expire automatically