Data Processing Agreement — Spekir Atlas

1. Parties

This Data Processing Agreement ("DPA") is entered into between Spekir ApS ("Processor") and the customer entity that has accepted these terms ("Controller").

2. Scope of Processing

Spekir processes personal data on behalf of the Controller to provide the Atlas enterprise architecture platform. Processing includes: storage, retrieval, AI analysis, and reporting of data entered by Controller into the Service.

3. Nature and Purpose

Nature:Collection, storage, processing, and transmission of enterprise architecture data including personal data of the Controller's employees (user accounts).
Purpose: Provision of the Atlas SaaS platform per the Terms of Service.

4. Processor Obligations

Spekir shall:

Process data only on documented instructions from the Controller
Ensure persons authorised to process data are bound by confidentiality
Implement appropriate technical and organisational security measures
Assist the Controller in responding to data subject requests
Delete or return all personal data upon termination of the service
Make available all information necessary to demonstrate compliance

5. Sub-processors

Spekir uses sub-processors listed at /legal/sub-processors. We will notify you 30 days in advance of material sub-processor changes.

6. Security Measures

Spekir maintains: encryption at rest and in transit (TLS 1.3), access controls with RBAC, audit logging, penetration testing, and incident response procedures aligned with ISO 27001 principles.

7. Data Breach Notification

Spekir will notify the Controller within 72 hours of becoming aware of a personal data breach that is likely to result in a risk to the rights of natural persons.

8. Governing Law

This DPA is governed by Danish law and EU GDPR (Regulation 2016/679).

9. Acceptance

Workspace admins are required to accept this DPA on first login. Acceptance records are stored per workspace and include version, timestamp, and IP address. Contact hello@spekir.com for signed copies.