This Data Processing Addendum ("DPA") supplements the Talarity Terms of Service and applies to processing of personal data on behalf of customers subject to GDPR, UK GDPR, or comparable data-protection laws.
1. Definitions
"Personal Data," "Processing," "Data Subject," "Controller," and "Processor" have the meanings given in Article 4 of GDPR.
2. Roles
For Customer Content uploaded to the Service, the customer is the Controller and Talarity is the Processor.
3. Processing instructions
Talarity processes Personal Data only on documented instructions from the customer, including in the Service's published features and contracted services.
4. Confidentiality
Talarity ensures personnel authorized to process Personal Data are bound by confidentiality obligations.
5. Security
Talarity implements appropriate technical and organizational measures, summarized at our Trust Center and detailed in /legal/security.
6. Sub-processors
The customer authorizes Talarity to engage sub-processors listed at /legal/sub-processors. Talarity will notify customers of changes at least 30 days in advance and offer a right to object.
7. Data subject rights
Talarity will provide reasonable assistance to the customer in responding to data subject requests, taking into account the nature of processing.
8. Breach notification
Talarity will notify customers without undue delay (and in any event within 72 hours where required by law) after becoming aware of a Personal Data Breach affecting their data.
9. International transfers
For transfers from the EEA, UK, or Switzerland to the United States, Talarity relies on Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum where applicable.
10. Audit rights
Talarity will make available information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the customer or its mandated auditor, subject to reasonable confidentiality and operational constraints.
11. Termination
On termination of the Service, Talarity will delete or return Personal Data per the Terms of Service (60-day export window, then deletion).
12. Execution
A signed copy of this DPA is available on request. Email legal@talarity.com.