# Data Processing Agreement Axdale. Software engineering by Michael Lip, Warsaw, Poland (CET). https://www.axdale.com. Code record https://github.com/theluckystrike. Version 1.0. 23 October 2026. Template under Article 28 of the EU General Data Protection Regulation (GDPR). This template is written in plain English. It is not legal advice. Each party should ask its own lawyer to check it before signing. Use it only when the work needs personal data. The default is no personal data. ## Parties | Field | Details | |---|---| | Controller | ____ (Client legal name, address, company number) | | Controller contact for data protection | ____ | | Processor | Michael Lip, trading as Axdale, Warsaw, Poland. Address and tax ID ____. michael@axdale.com | | Main agreement | Axdale Engagement Agreement version 1.0 and Order Form AX-OF-____ | | Effective date | ____ | ## 1. Scope 1.1 This DPA applies when the Processor processes personal data for the Controller under the main agreement. Annex 1 describes the processing. 1.2 The words controller, processor, personal data, processing, data subject, personal data breach and supervisory authority have the meaning they have in the GDPR. Where the UK GDPR or another data protection law applies, the matching terms of that law apply too. 1.3 If this DPA and the main agreement conflict about personal data, this DPA applies. ## 2. Instructions 2.1 The Processor processes personal data only on the Controller's documented instructions. The main agreement, the Order Form, each Statement of Work and this DPA are those instructions. Other instructions must be in writing from the Decision Maker or the data protection contact. 2.2 The Processor tells the Controller at once if it believes an instruction breaks data protection law. 2.3 If the law requires the Processor to process personal data in another way, the Processor tells the Controller first, unless the law forbids it. ## 3. Confidentiality 3.1 Only the Processor himself processes the personal data. Any other person who processes it under clause 5 is bound by a duty of confidentiality. ## 4. Security 4.1 The Processor applies the technical and organizational measures in Annex 2. These include full disk encryption, multi-factor authentication, least privilege access, secrets handling and deletion at the end. 4.2 The Processor does not copy personal data to his devices unless Annex 1 allows it. Where it allows it, the copy is the minimum the work needs. ## 5. Sub-processors 5.1 The Controller gives general written authorization for the sub-processors in Annex 3. AI model providers appear there only if the Controller ticked them in the Order Form. 5.2 The Processor tells the Controller in writing at least 10 Working Days before he adds or replaces a sub-processor. The Controller may object in writing in that time. If it objects, the Processor does not use the new sub-processor for the Controller's data, and either party may end the affected work. 5.3 The Processor puts data protection duties on each sub-processor that are at least as strict as this DPA. Where a sub-processor has standard terms, the Processor relies on its data processing terms. The Processor stays responsible to the Controller for each sub-processor. ## 6. Help to the Controller 6.1 The Processor helps the Controller, within reason, to answer requests from data subjects who use their rights. He sends any such request he receives to the Controller within 2 Working Days and does not answer it himself. 6.2 The Processor helps the Controller, within reason, with security, breach notices, data protection impact assessments and prior consultation under Articles 32 to 36 of the GDPR. 6.3 Help that takes more than 2 hours in a month is billed at the rate in the main agreement, unless the Processor caused the need for it. ## 7. Personal data breach 7.1 The Processor tells the Controller in writing without undue delay, and within 24 hours, after he becomes aware of a personal data breach. 7.2 The notice gives what the Processor knows at that time. It covers the nature of the breach, the categories and approximate number of data subjects and records, the likely effects, and the steps taken or proposed. The Processor sends more facts as he learns them. 7.3 The Processor does not notify a supervisory authority or data subjects for the Controller, unless the Controller asks in writing or the law requires it. ## 8. International transfers 8.1 The Processor works from Poland, inside the European Economic Area. 8.2 A transfer of personal data outside the European Economic Area happens only to a sub-processor in Annex 3 and only with a lawful transfer mechanism, such as an adequacy decision or the EU standard contractual clauses. ## 9. Audit 9.1 The Processor gives the Controller the information it needs to show that this DPA is met. He answers written audit questions within 5 Working Days. 9.2 The Controller, or an auditor bound by confidentiality, may audit the Processor's compliance once a year with 15 Working Days' written notice, or after a personal data breach. Audits are done in writing first. Each party pays its own costs. ## 10. End of processing 10.1 When the work ends, or when the Controller asks in writing, the Processor deletes or returns all personal data within 5 Working Days, at the Controller's choice. He deletes existing copies, unless the law requires him to keep them. 10.2 The Processor confirms the deletion in writing, item by item, with dates. ## 11. Liability and law 11.1 The liability terms of the main agreement apply to this DPA, to the extent data protection law allows. 11.2 This DPA follows the governing law and courts of the main agreement. 11.3 This DPA lasts as long as the Processor holds personal data for the Controller. ## Annex 1. Details of the processing | Field | Details | |---|---| | Subject matter | Software engineering work under the main agreement | | Duration | The term of the main agreement, plus the deletion period in clause 10 | | Nature and purpose | ____ (for example, read-only queries on a staging database to debug a data pipeline) | | Types of personal data | ____ (for example, names and email addresses of end users) | | Special categories of data | None, unless listed here ____ | | Categories of data subjects | ____ (for example, end users of the Controller's product) | | Where the data is held | ____ (for example, the Controller's staging database only, no local copies) | | Local copies allowed | No / Yes, limited to ____ | ## Annex 2. Technical and organizational measures 1. Full disk encryption, automatic screen lock and current security updates on every device used for the work. 2. Multi-factor authentication on every account that holds access to the Controller's systems. 3. Least privilege, read-only access by default, named accounts only, no shared logins. 4. Secrets only through the Controller's secret manager or a one-time encrypted link. 5. No personal data in AI prompts. No personal data in logs that the work creates, with tests where the work writes logs. 6. Separate project folder per client. No client data in public repositories or other clients' projects. 7. Breach notice within 24 hours. Deletion within 5 Working Days at the end, with item by item written confirmation. ## Annex 3. Sub-processors | Sub-processor | Purpose | Location | Transfer mechanism | Approved | |---|---|---|---|---| | Anthropic | AI model processing of code, only if ticked in the Order Form | ____ | ____ | [ ] | | OpenAI | AI model processing of code, only if ticked in the Order Form | ____ | ____ | [ ] | | Email provider ____ | Email between the parties | ____ | ____ | [ ] | | Other ____ | ____ | ____ | ____ | [ ] | ## Signatures | Controller | Processor | |---|---| | Name and title ____ | Michael Lip, trading as Axdale | | Signature ____ | Signature ____ | | Date ____ | Date ____ | --- Axdale. Michael Lip, independent engineer, Warsaw, Poland (CET). michael@axdale.com. https://www.axdale.com. Code record https://github.com/theluckystrike. This document is plain English and is not legal advice.