Data Processing Agreement
This Data Processing Agreement (“DPA”) forms part of the agreement between Ivy Digital and business customers whose personal data is processed in Ivy Digital products.
1. Parties and roles
This DPA is between Ivy Digital LLC, Sharjah Media City Free Zone, United Arab Emirates (“Processor”) and the customer entity that has agreed to the Terms & Conditions (“Controller”). The Controller determines the purposes and means of processing; the Processor processes personal data on the Controller’s documented instructions.
For consumer accounts where Ivy Digital acts as controller (for example a Launchpad account opened directly by an individual), this DPA does not apply; the Privacy Policy governs.
2. Scope and details of processing
- Subject matter: provision of the subscribed Ivy Digital product(s) and related support.
- Duration: for the term of the subscription plus the deletion/return period described below.
- Nature and purpose: hosting, storage, computation, AI-assisted generation and analysis, communications delivery, support, security and backups.
- Categories of data subjects: as determined by the Controller — typically employees, candidates, customers, suppliers, contacts and platform users.
- Categories of personal data: identification and contact data, employment and recruitment data, financial and invoice data, call recordings and transcripts, email and engagement data, project data, quality documents and related metadata.
- Special categories: the Controller must avoid submitting special-category data unless necessary and lawful, and must implement additional safeguards where it does.
3. Processor obligations
- Process personal data only on documented instructions from the Controller, including transfers, unless required by law (in which case the Processor will inform the Controller unless prohibited).
- Ensure personnel authorised to process data are bound by confidentiality obligations.
- Implement appropriate technical and organisational security measures as described in Security & Data Residency.
- Assist the Controller with responding to data-subject requests and with security, breach notification, impact assessments and prior consultations, taking into account the nature of processing.
- Notify the Controller without undue delay after becoming aware of a personal-data breach, and provide information reasonably required to meet regulatory obligations.
- At the Controller’s choice, delete or return personal data at the end of the provision of services, subject to legal retention obligations.
- Make available information reasonably necessary to demonstrate compliance and allow audits as described in section 8.
4. Sub-processors
The Controller authorises the Processor to engage sub-processors for infrastructure, AI inference, payments, communications, analytics and security. The current list is on the Sub-processors page. The Processor imposes data-protection obligations on sub-processors substantially equivalent to this DPA and remains liable for their performance.
The Processor will give reasonable notice of new sub-processors and the Controller may object on reasonable data-protection grounds. If the parties cannot resolve the objection, the Controller may terminate the affected service.
5. International transfers
Primary storage and backups are located in Mumbai, India. Where personal data is transferred from the UAE, EU/UK or another jurisdiction to India or another country, the parties agree that appropriate safeguards will be used, which may include the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, contractual security and confidentiality obligations, and transfer risk assessments where required. The Controller may request a signed SCC package from [email protected].
6. Security
The Processor implements measures including encryption in transit and at rest, role-based access control, multi-factor authentication for privileged access, logging and monitoring, network protections, secure development practices, backups and vendor due diligence. The Controller is responsible for configuring the product appropriately, managing user access and ensuring lawful bases and notices for the data it submits.
7. Breach notification
The Processor will notify the Controller without undue delay, and where feasible within 72 hours of confirmation, providing the nature of the breach, categories and approximate volume of data affected, likely consequences and measures taken or proposed. The Processor will cooperate on remediation and regulatory notifications led by the Controller.
8. Audits
The Processor will respond to reasonable security and compliance questionnaires and provide relevant documentation. Where required and subject to confidentiality, the Controller may conduct an audit on reasonable notice, no more than once per year (unless required by a regulator or following a breach), during business hours and without disrupting the services.
9. Deletion and return
On termination, the Controller may export data using product export features. The Processor will delete personal data within 90 days of termination, except where retention is required by law (for example tax and accounting records, which may be retained for up to 5 years) or in encrypted backups that roll off within 90 days.
10. Liability and governing law
Liability under this DPA is subject to the limitations in the Terms & Conditions. This DPA is governed by the laws of the United Arab Emirates, and the courts of Sharjah have jurisdiction, without prejudice to mandatory provisions of data-protection law applicable to the Controller.
11. Annex A — Sub-processors
The current list of sub-processors, including their purposes and processing locations, is maintained at ivydigitals.com/sub-processors and forms part of this DPA as Annex A. The Processor will notify the Controller of changes to Annex A and give the Controller an opportunity to object as described in section 4.
Primary storage and backups are located in Mumbai, India. Certain sub-processors — in particular AI model providers used for inference — may process data outside India as indicated in Annex A. Inference is performed under API access configured for no-training and, where offered, zero data retention.
12. Contact
DPA requests and data-protection enquiries: [email protected] · [email protected].
Ivy Digital LLC, Shams Business Center, Sharjah Media City Free Zone, Sharjah, United Arab Emirates.