Data Processing Agreement

Draft status

This placeholder must be replaced by counsel-approved DPA terms before enterprise customers process personal data through Omega in production.

Required coverage

• Controller and processor roles.
• Processing instructions and service scope.
• Security measures and confidentiality.
• Subprocessor authorization and notice.
• International transfer mechanism and SCC posture where needed.
• Data subject request support.
• Breach notice, return/deletion, audit, and assistance obligations.

Roles

• Customer is generally the controller or business for customer content and determines processing purposes and means.
• Omega is generally the processor, service provider, or subprocessor for customer content processed under customer instructions.
• Omega may act as an independent controller for account, billing, website, security, marketing, and business-contact information, depending on final terms and law.

Processing instructions

Omega should process customer personal information only according to the agreement, order form, product settings, customer instructions, applicable law, and documented support or security needs.

International transfers

Final DPA terms must define transfer mechanisms, including standard contractual clauses, UK addendum, supplementary measures, or other valid mechanisms where required.

Incident notice and audit

Final DPA terms must define security-incident notice timing, customer assistance, audit/report access, confidentiality, deletion/return, and post-termination handling.