Data Processing Agreement

The Customer is the Controller and AdoptIQ is the Processor in respect of Customer Personal Data processed under the Agreement.

Subject matter: provision of the AdoptIQ telemetry and adoption-scoring service. Duration: the term of the Agreement plus the deletion window in clause 7.

Ingestion of usage telemetry from connected SaaS systems, aggregation into adoption scores, generation of alerts and benchmarks, and provision of dashboards and exports.

Data subjects: Customer's authorised users of connected SaaS systems.

Personal data: business contact data, system identifiers, activity events, role and permission metadata. Customers are responsible for not transmitting special-category data through the service.

Customer authorises AdoptIQ to engage the sub-processors listed at /legal/sub-processors. AdoptIQ will give 30 days' notice of any change and allow the Customer to object on reasonable data-protection grounds.

Personal data is hosted in the UK (AWS London, eu-west-2). Any onward transfer is covered by the UK IDTA / EU SCCs and a documented transfer risk assessment.

On termination, AdoptIQ will make Customer Personal Data available for export for 30 days, then delete or anonymise it within a further 30 days, unless retention is required by law.

AdoptIQ maintains the technical and organisational measures described in /security, including encryption in transit and at rest, role-based access control, MFA for staff, audit logging and quarterly penetration testing.

AdoptIQ will assist the Customer with data-subject requests, breach notifications and DPIAs, and will make available the information necessary to demonstrate compliance with this DPA.