Data processing agreement

Parties, scope and processing details — Annex A

The customer identified in the accepted order is controller, or a processor acting with its controller's authority. Magma Productions Limited acts as processor or authorised subprocessor for customer personal data used to provide the selected workspace. Processing lasts for the contract and the authorised return/deletion period.

Subject matter and purpose: hosted business research, prospect management, requested analyses, exports, communications connections, support and security. Operations include collection, retrieval, hosting, organisation, matching, analysis, display, communications synchronisation, return and deletion. Individuals include customer users, employees, professional contacts, prospects and correspondents. Data includes business identity/contact information, roles, account identifiers, CRM notes, links, selected messages and attachments, events and generated analyses. Special-category, criminal-record and children's data are not intended or authorised for this service.

Instructions and confidentiality

We process only on documented instructions in the order, contract, account configuration and lawful support requests, including transfer instructions. If law requires other processing, we notify the customer beforehand unless prohibited. We promptly identify an instruction we believe infringes applicable data-protection law and may pause the affected processing pending clarification. Personnel authorised to process customer data must be bound by confidentiality and have access only as needed.

Security measures — Annex B

We maintain risk-appropriate organisational and technical measures covering account authentication, tenant authorisation, access control, protected transmission, credential handling, recovery, logging, incident response and secure return/deletion. The application uses salted password hashing, host-only HttpOnly session cookies, owner-scoped workspace queries and encrypted stored OAuth tokens. Production credentials are held in runtime configuration rather than published source. These measures do not amount to a promise of a particular certification or universal encryption at rest.

Hosting and backup protections depend on the contracted infrastructure and service configuration. We make relevant evidence available on a reasonable request and do not materially reduce agreed security during the term. Customers must protect their accounts and authorised endpoints.

Providers, changes and international transfers — Annex C

The customer generally authorises the hosting, transactional-email and requested AI providers described in Provider and processing information, only for the disclosed service functions and data. Customer-authorised mailbox providers and independent-controller payment/Analytics activities are distinguished there.

We are responsible for ensuring that subprocessors are bound to the relevant required processing obligations and for their performance under this DPA. We give at least 30 days' advance written notice of additions or replacements that will receive customer personal data. The customer may object within that period on reasonable data-protection grounds. We seek a reasonable alternative; if none can be provided, the customer may end the affected service and receive unused prepaid fees for it.

Restricted transfers require a valid applicable mechanism and necessary assessments and safeguards. This DPA is not itself an executed international-transfer instrument. Specific provider agreements and transfer instruments apply as required; copies or descriptions relevant to the customer's processing can be requested through the privacy contact.

Rights, incidents and cooperation

Taking account of the nature of processing and information available, we assist with rights requests, security duties, breach notifications, impact assessments and regulator consultations. We notify the customer without undue delay after becoming aware of a personal-data breach affecting its data, providing known scope, data, likely effects, containment and a contact, with updates as needed. Notification is not delayed until a complete investigation or a controller's 72-hour deadline.

We redirect relevant processor-held rights requests to the customer and assist under lawful instructions. The customer controls its required notifications unless law requires otherwise.

Return, deletion and limited retention

At the end of service, at the customer's choice we return or delete customer personal data and delete copies, except where law requires specific retention. Contact us before closure to arrange an authorised export if the account cannot export it directly. An earlier lawful deletion instruction is supported. We confirm completion on request and explain justified exceptions.

Recovery copies remain protected and outside ordinary use until the applicable backup cycle expires. Deletion instructions are reapplied after restoration. Legally retained records are limited to their justified purpose and period. Stopping subscription renewal does not itself instruct deletion.

Information, audit and precedence

We provide information needed to demonstrate compliance with applicable processing obligations and permit proportionate customer or mandated independent audits, with reasonable notice, confidentiality and safeguards for other customers. Urgent incidents and regulator requests are not subject to unreasonable delay. Routine assistance is included; any exceptional charge must be reasonable, agreed in advance and must not obstruct legal rights or cover remedying our own breach.

This DPA prevails for customer-data processing conflicts and preserves statutory rights, regulator powers and mandatory liabilities. Contact hello@magmaproductions.dev for a signed copy, supporting information or a customer-specific processing requirement.