Data Processing Agreement

Last updated October 2026

1. Purpose

This Data Processing Agreement ("DPA") governs how The MakeWise Engine ("Processor") handles personal data on behalf of clients ("Controller") during the delivery of contracted services.

2. Scope

This DPA applies when we process personal data as part of a project, including but not limited to: handling customer databases, processing user records, managing content that contains personal information, or performing data entry involving personal data.

3. Types of Data Processed

  • Names and contact details
  • Business records and customer data
  • Content and files shared for project delivery
  • Any other personal data required for the contracted work

4. Processing Obligations

We will:

  • Process data only as instructed by the client and only for the purpose of delivering the agreed services
  • Not use client data for any other purpose
  • Not share, sell, or disclose data to third parties unless required for service delivery or by law
  • Ensure all team members handling data are bound by confidentiality

5. Security Measures

We implement appropriate technical and organizational measures including:

  • Encrypted file transfer and storage
  • Access limited to team members assigned to the project
  • Secure communication channels
  • Regular deletion of data after project completion

6. Sub-processors

We may use sub-processors (e.g. cloud storage, hosting) to deliver services. We ensure sub-processors provide adequate data protection. A list of sub-processors is available on request.

7. Data Retention and Deletion

Client data is retained only for the duration of the project plus 90 days. After that, all data is permanently deleted unless the client requests extended retention in writing.

8. Data Breach Notification

In the event of a data breach affecting client data, we will notify the client within 48 hours of becoming aware, providing details of the breach, affected data, and remedial actions taken.

9. Client Rights

The client may request access to, correction of, or deletion of their data at any time. We will comply within 7 business days.

10. Return of Data

Upon project completion or termination, we will return all client data in a standard format and delete our copies within 30 days, providing confirmation of deletion on request.