1. Overview
The Transformics Data Processing Agreement ("DPA") forms part of your contract with TransformicsAI and governs our processing of personal data on your behalf under the EU General Data Protection Regulation (GDPR), the UK GDPR, and equivalent data-protection laws.
The DPA is pre-signed by TransformicsAI and is ready for your counter-signature. Enterprise-tier Customers negotiating bespoke terms can also receive a redline-able version on request.
2. Request a DPA
To receive a counter-signable DPA, email privacy@transformics.ai from your account's administrative contact. Include:
- Your legal entity name, registered address, and signatory
- Whether your organization is a Financial Entity under DORA
- Whether any data subjects are UK residents (UK IDTA addendum)
- Whether any data subjects are US residents (US state privacy addendum)
We return a counter-signable document within 3 business days for standard tiers; Enterprise negotiations follow the timeline agreed on your Order Form.
3. What the DPA covers
The DPA covers the scope of processing, processor obligations, sub-processor authorization, international data transfers, data-subject rights assistance, security (TOMs), breach notification timelines, audit rights, and data return & deletion on termination. See the full Master Service Agreement (MSA) for the commercial terms that wrap around it.
4. DORA rider (financial entities)
Customers that are Financial Entities within the meaning of Regulation (EU) 2022/2554 ("DORA") receive an additional DORA Financial-Sector Rider implementing the Article 30 mandatory contractual provisions, including: exit-assistance obligations, incident-reporting timelines, sub-outsourcing transparency, competent-authority access, and aggregation-off-by-default.
5. Standard Contractual Clauses
Where personal data originating from the European Economic Area, the United Kingdom, or Switzerland is transferred to a sub-processor in a third country, transfers are governed by the EU Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (Controller to Processor), supplemented by the ICO's UK Addendum for UK transfers.
For a full list of sub-processors and the corresponding transfer mechanisms, see the sub-processor list.