Data Processing Agreement

1. Purpose and scope

This Data Processing Agreement (this DPA) sets out how DeepDive, Inc. (Tokyo, Japan) handles customer personal data when you use Clavis: roles, sub-processors, international transfers, security, breach notice, deletion, and audit.

If you subscribe by card, the main contract is the Customer Terms on this portal. Completing purchase of a paid feature is also agreement to those Customer Terms. This DPA is incorporated by the Customer Terms. For Enterprise, an order form or a separate contract that states the work is the main contract, and that contract may attach data-processing terms that go beyond this page.

If there is a conflict, this DPA prevails for the handling of customer personal data.

2. Definitions and roles

Customer personal data means personal data about members of your organisation and users who sign in to your connected applications, processed on the service on your instructions and relating to that organisation or those applications. It covers membership, invitations to join, and join requests; your organisation's security contacts; additional text fields your applications configure; signing requests you make for those applications, the record when a signature completes, and records kept only while a signing procedure is in progress; records that remain on your ledger; audit notices you configure; and procedure decision records the service processes for that organisation or those applications.

A procedure decision record holds the versions of text shown, the outcome, an age band and whether the person gave it or your connected application did (with what the application said it rests on), a short note of how jurisdiction was estimated, and a withdrawal. It does not show that a consent or a legal basis is valid. Decision records for opening an account, acknowledging updated terms, and purchase are platform data. An agreement, its renewals, and the withdrawal that ends it are kept while the agreement is in force and for 730 days after it ends, or 1,095 days when it is a disclosure to a third party handled under Japan. A refusal or an abandonment is kept for 90 days from the decision, or 30 days for a person under the digital-consent age. A withdrawal when no agreement is in force is kept for 90 days. Records about one user are deleted when you instruct us to erase them. Paths that would depend on a parent's consent are not stored. When a record is stored, it is stored in the region Cloudflare designates as the European Union. That is not storage in the United Kingdom. Each record, with the text that was shown, is committed to the ledger of that organisation, or to the service's own ledger for platform data. The ledger holds only a salted commitment. When the record is deleted at the end of its retention, the commitment no longer links to it. Deleting a Clavis account does not delete these records; they follow your instructions. This description is not a statement that the processing is already offered.

Platform data (accounts and passkeys, sessions, consent records for connected applications, login history, abuse prevention, consent for purchase of a paid feature and provision to Polar, and similar) is handled by DeepDive as an independent controller under the Privacy Notice. The processor duties in this DPA do not apply to that data. Where the same user identifier appears in both, the underlying identifier record is platform data.

For customer personal data, you are the controller and DeepDive is the processor. After your connected application receives identifiers or similar data, you are an independent controller of what it has received.

3. Instructions and confidentiality

DeepDive processes customer personal data on instructions given through this DPA, the main contract, administrators' actions in the developers area, and the public API. We may refuse instructions we reasonably consider unlawful and will notify you.

We treat customer personal data as confidential. If we receive a lawful disclosure demand, we will notify your organisation's security contacts before disclosure where the law does not forbid notice.

4. Sub-processors

You authorise sub-processors listed in the Subprocessor list. Material additions or replacements are published there at least 30 days before they take effect, with notice to the security contacts registered for your organisation. Reasonable objection may be a ground to terminate the Customer Terms (or the Enterprise order, where that is the main contract). You may not refuse Cloudflare itself as used to run the service.

Polar Software Inc. is merchant of record for paid features and is not a sub-processor. We provide the purchaser's identifiers to Polar only with the purchaser's consent (Privacy Notice, section 5).

We use sub-processors under their published standard terms. We are not in a position to overwrite those terms with this DPA. For breaches of this DPA caused by a sub-processor, DeepDive's liability to you follows the liability limits in the Customer Terms.

5. International transfers

Persistent storage and execution use the region Cloudflare designates as the European Union. The provider defines that region only as the European Union and does not identify the member state. Data used for authentication procedures, consent records for connected applications, rate limits, and similar processing, where no storage region is set, may be copied without a regional limit. We do not claim that it stays in the European Union.

Where adequacy covers the transfer, that adequacy decision applies. For restricted transfers of customer personal data that adequacy does not cover, this DPA incorporates by reference the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914), Module 2 (controller to processor), and the UK Addendum to those clauses, Version B1.0. The IDTA is not used. Clause choices: docking under Clause 7; Clause 9 Option 2 with 30 days' prior notice; no optional independent dispute resolution under Clause 11; Clause 17 Option 1 (Irish law); Clause 18(b) courts of Ireland; UK Addendum Table 4: neither party.

Onward transfers from DeepDive to Cloudflare, Inc. (United States) follow the Cloudflare Customer DPA (v6.4, 3 April 2026), section 6, including Module 3 and the UK Addendum where that DPA treats the transfer as restricted. DeepDive does not claim its own Data Privacy Framework certification.

This DPA covers customer personal data of people in the EU or the UK. Notice to an EU or UK supervisory authority within 72 hours remains your duty as controller; it is not a default obligation of DeepDive under this DPA. The notice periods in this DPA do not narrow DeepDive's notice and assistance duties under the Standard Contractual Clauses.

The annexes of those clauses are completed as follows. The parties are DeepDive, Inc. and your organisation. The transfer is the customer personal data this DPA describes. The supervisory authority follows your place of establishment or your representative, because you are the exporter. DeepDive appoints neither an EU representative nor a UK representative. Technical and organisational measures are those in the Privacy Notice. Sub-processors are the subprocessor list. Tables 1 to 3 of the UK Addendum use the same material. Table 4 gives the termination option to neither party.

If this DPA conflicts with the Standard Contractual Clauses, the clauses prevail. That priority does not amend the text of the clauses.

6. Security and data-subject rights

DeepDive maintains the security measures described in the Privacy Notice. We do not represent that SOC 2 or ISO/IEC 27001 certification has been obtained.

You are the primary contact for data-subject requests about customer personal data. DeepDive assists through in-product tools and [email protected] within a reasonable scope.

7. Deletion

Account deletion and erasure are available as product features. As of the date of this DPA there is no product path that bulk-erases an organisation's customer personal data at contract end. End-of-contract deletion proceeds by per-user erasure and operational deletion of residual data. A ledger leaf is a commitment your application submits. We do not receive the disclosure material, and we do not delete the leaf. Removing that material, including ciphertext stored in the vault, is what drops the link to a person. You can delete vault ciphertext, and each deletion returns a signed deletion certificate. For thirty days after the contract ends you can retrieve that vault. After that, the service physically deletes it and issues a signed deletion certificate for the organisation. The log and its anchor stay.

8. Breach notice

If we learn of a situation affecting customer personal data that Article 7 of the Enforcement Rules of Japan's APPI requires to be reported — a breach, or a possible breach, involving sensitive personal information, data whose misuse could cause financial loss, an act that may have been done for an unlawful purpose, or more than 1,000 people — we notify you without undue delay after we learn of it, even before we confirm it, with what we know at that time of the matters listed in Article 8(1) of those Rules.

After we confirm a personal-data breach affecting customer personal data, we notify the security contacts registered for your organisation (or the contact registered for an Owner or an Admin, if none is registered) without undue delay. The aim is 24 hours after confirmation; the outer limit is 48 hours. These are calendar hours and are not limited by support business hours. We do not promise around-the-clock first response. Numeric uptime SLAs and 72-hour notice to an EU/UK supervisory authority are not default obligations under this DPA.

9. Audit, liability, governing law

On request, up to once per year, we provide reasonable information in writing or remotely. On-site review, if any, is limited to documents we hold and explanations by our staff, on agreed schedule, scope, and fees. We have no duty to supply third-party certification reports.

Liability for breach of this DPA follows the Customer Terms, except for wilful misconduct or gross negligence causing a customer personal-data breach. Liability to data subjects under the Standard Contractual Clauses is not limited by those terms.

The commercial governing law and courts follow the Customer Terms and the place of incorporation declared for the organisation. Where standard contractual clauses apply, their governing law remains Irish law. If this DPA conflicts with those clauses, the clauses prevail.