Data Processing Agreement

Standard DPA for B2B customers · GDPR Article 28 compliant · Last updated: 2026-05-31

This Data Processing Agreement ("DPA") supplements the Terms of Service for any customer ("Controller") that processes personal data through Ovriven ("Processor") on Team or Enterprise plans.

1. Subject matter

Processor processes personal data on behalf of Controller solely to provide the simulation service contracted under the Terms of Service. Personal data may include the Controller's end-users, workspace members, and simulation participants.

2. Duration

Processing continues for the term of the subscription plus any post-term retention period required by law or agreed in writing. On termination, Processor returns or deletes all Controller data within 90 days.

3. Subprocessors

Controller authorizes Processor to use the subprocessors listed at /sub-processors, the authoritative register. Processor will notify Controller before adding new subprocessors and provide a 30-day window to object.

4. Security measures

• Encryption in transit (TLS) and at rest.
• Per-tenant logical isolation via the Workspace boundary.
• Audit logging for sensitive actions (workspace-scoped audit log).
• TOTP-based MFA available for all users; required for admin step-up.
• Backup + point-in-time recovery for the application database.

5. Data subject requests

Processor will assist Controller in responding to data subject access, erasure, and portability requests within 30 days. End-users may also self-serve via Account → Privacy.

6. Breach notification

Processor will notify Controller of any confirmed personal data breach without undue delay, and within 72 hours where feasible.

7. Cross-border transfers

For transfers outside the EEA / UK, Processor relies on the Standard Contractual Clauses adopted by the European Commission. For US transfers Processor follows the EU-US Data Privacy Framework where applicable.

To execute the DPA for your organization, contact legal@ovriven.com.

A redline-friendly copy of this DPA is available at /procurement/dpa-template.md.