Data processing agreement

Roles

The client is controller. Assaya Labs is processor and processes personal data only on the client's documented instructions, including on international transfers, unless law requires otherwise.

Subject matter and duration

Measurement of employee experience of AI deployment, for the term of the engagement plus the retention period set in the order form.

Nature and purpose

Collection of interview responses and scale scores, de identification, aggregation, analysis and reporting.

Categories of data subject and data

Employees and contractors of the client. Responses, scores, and the role, team and tenure metadata needed to group findings. No special category data is requested.

Security measures

• Encryption in transit and at rest
• De identification applied on ingest, before analysis
• Minimum group size enforced on every reported cut, including combinations of filters
• Role based access on least privilege, with access logged
• Staff bound by written confidentiality obligations

Sub processors

The client gives general authorisation for the sub processors listed on this page. We give at least 30 days notice before adding or replacing one, and the client may object on reasonable data protection grounds.

Assistance

We help the client answer data subject requests, carry out impact assessments, and consult supervisory authorities, taking account of the nature of processing and the information available to us.

Breach notification

We notify the client without undue delay and in any event within 48 hours of becoming aware of a personal data breach, with the detail needed for the client to meet its own obligations.

Deletion and return

At the end of the engagement we delete or return personal data at the client's choice, except where retention is required by law. Anonymised data that cannot be linked to an individual may be retained.

Audit

We make available the information needed to demonstrate compliance and allow audits by the client or its auditor, once per year on reasonable notice, or more often after a breach.