Data Processing Agreement
Last updated: 2 November 2026 · Version 2026-11-02
Contract terms for customer personal data processed by Aurora in an Aurora-hosted SpecDox deployment. The deployment schedule below must be completed and agreed before processing begins.
1. Parties, scope and instructions
The customer identified in the order is controller, or a processor authorised by its controller; ACL Aurora Core Labs LTD (Aurora) is processor or subprocessor respectively. This DPA applies for the duration of hosted processing and governs personal data in customer repositories, documents, prompts and workspace activity processed on the customer’s behalf. Processing consists of receiving, storing, retrieving, editing, generating, transmitting, securing and deleting that data to provide the ordered service. Data subjects can include customer users, staff, contractors and people described in customer content. Personal data may include identifiers, contact information, authorship and content the customer supplies. Special-category or criminal-offence data requires prior written agreement and appropriate safeguards. The customer determines the lawful basis and documented instructions, including authorised integrations and transfers. Aurora processes only on those instructions unless required by law, notifying the customer of that requirement where permitted, and informs the customer if an instruction appears to infringe applicable data-protection law.
2. Confidentiality and security
Aurora limits access to authorised persons bound by confidentiality and implements risk-appropriate technical and organisational measures under Article 32 GDPR. The agreed deployment schedule must describe access controls, tenant isolation, credential protection, transmission and storage protection, logging, recovery and security review. No certification, hosting region or recovery target is implied by this text. The customer manages its user permissions, lawful content and integration choices.
3. Subprocessors
Aurora may use only subprocessors listed in the agreed schedule under the customer’s written authorisation. Aurora imposes equivalent data-protection obligations and remains responsible for their performance under this DPA. Under general authorisation, Aurora gives at least 30 days’ prior notice of intended additions or replacements and an opportunity to object on reasonable data-protection grounds. The parties seek a resolution; if unresolved before processing by the new provider, the affected processing must not proceed without an agreed lawful arrangement. Paddle is an independent controller for sales, not a subprocessor merely because it processes payment.
4. Assistance and incidents
Taking account of the processing and information available, Aurora assists with data-subject requests, security duties, impact assessments and consultation with authorities under Articles 32–36 GDPR. Aurora notifies the customer without undue delay after becoming aware of a personal data breach affecting customer data, providing available information about nature, affected data, likely consequences and mitigation, with further information as it becomes available. Aurora does not respond to customer data-subject requests except on instructions or legal obligation.
5. International transfers
Transfers outside the EEA require documented instructions and a valid GDPR Chapter V mechanism. Where required, the parties execute the appropriate EU Standard Contractual Clauses and complete their annexes, transfer assessment and supplementary measures before transfer. This DPA does not itself assert that such annexes or assessments are completed.
6. Return and deletion
On termination or the customer’s instruction, Aurora returns or deletes customer personal data at the customer’s choice, including existing copies unless law requires retention. The schedule specifies export arrangements, active-storage deletion deadlines and the backup expiry cycle. Until deletion, retained copies remain protected and used only for permitted retention or recovery purposes. Legally required retention is limited to the applicable obligation.
7. Accountability and audits
Aurora makes available information needed to demonstrate compliance and allows and contributes to audits, including inspections, by the customer or its mandated auditor. The parties coordinate reasonable confidentiality, security and scheduling arrangements without preventing statutory audit rights or regulatory access. Each party maintains records required by law. This DPA prevails over conflicting product terms for processing of customer personal data; mandatory data-subject rights and liability under the GDPR remain unaffected.
8. Required deployment schedule
The order or signed annex must identify the customer and controller contact, hosting and backup locations, processing duration, actual data categories and subjects, security measures, authorised subprocessors and functions, international-transfer safeguards, export method and deletion/backup periods, and privacy and incident contacts. Aurora’s contact is hello@auroratech.ai. No third-party provider or region is certified by this public template. Request the completed schedule before putting personal data into an Aurora-hosted deployment. A self-hosted installation with no Aurora access to customer content does not by itself appoint Aurora processor; any support access requires an appropriate arrangement.
Purchase support: Paddle · Paddle Buyer Terms · Paddle Refund Policy · Paddle Privacy Notice
Aurora: hello@auroratech.ai