DPA

Data Processing Addendum,
roles and boundaries first.

This page is a public outline of the product Data Processing Addendum (DPA). A binding commercial DPA is executed with your order or master agreement; this page does not replace signed text.

Roles

  • Customer: typically controller (or processor on behalf of a controller) for personal data it submits or instructs Omseek to process.
  • Omseek: processor (or sub-processor) of customer personal data as needed to provide Cloud / Studio software services.
  • Website visitor processing is described in the Privacy Notice.

Purpose and scope

Processing is limited to providing, maintaining, securing and improving the contracted software services, and to legal obligations. Customer personal data is not used for secondary marketing beyond the agreed purpose unless the customer authorises it.

Subprocessors

Hosting, messaging, observability or model capabilities may rely on subprocessors. A commercial DPA should define disclosure of the subprocessor list and a change-notification process. This public page does not invent a full vendor roster; the operative list is provided in contract schedules or a customer portal when enabled.

Security measures (high level)

Per the security baseline, engineering controls include encryption in transit and at rest, strong authentication and session management, tenant-aware authorisation with deny-by-default, secrets management, CSP and common web protections, rate and abuse controls, auditable events, protected/encrypted backups and supply-chain scanning. AI output cannot bypass authorisation and policy guardrails.

Assistance and DSAR

Within contract and product capability, Omseek assists customers with data-subject requests (export, delete/anonymise and related workflows). Legal holds may affect deletion paths with a recorded reason.

Residency and Studio

Studio keeps business content and raw evidence in the customer environment by default; cloud-assisted processing requires explicit authorisation. Residency and cross-border transfer follow the commercial DPA and deployment configuration.

Commercial DPA

A binding Data Processing Addendum is executed per contract.To request formal DPA text or a subprocessor list, use the contact page and include order or tenant details.