Data Processing Agreement (DPA)
How Intempt's Data Processing Addendum works: it applies automatically to every account with no signature, what it covers, and how to download it or get a countersigned copy for procurement.
Overview
A Data Processing Agreement (also called a Data Processing Addendum, or DPA) is the contract GDPR Article 28 requires between a data controller and its data processor. You are the controller: you decide what personal data to collect and why. Intempt is the processor: it handles that data on your documented instructions.
Intempt's DPA is published at intempt.com/dpa. It is incorporated into the Customer Terms of Service and applies automatically to every account, including free tier, from the moment any personal data is submitted. No separate signature is required. By using the Services or signing up, you agree to it.
📘 Good to know
The DPA covers the contractual commitments. For the day-to-day compliance workflow (consent, data subject requests), see the GDPR & CCPA Compliance Guide. For the controls behind the commitments, see Protecting user data.
How it works
It applies without signing
Most DPAs are a signature step in procurement. Intempt's is not. Because it is part of the Customer Terms of Service, it binds both parties the moment you create an account, so EU and UK customers are covered on day one with nothing to sign or send back.
What it covers
The DPA at intempt.com/dpa sets out:
| Section | What it commits to |
|---|---|
| Your responsibilities | You choose what is collected and provide the lawful basis; prohibited data categories are listed (for example HIPAA health data, PCI card data, GDPR Article 9 special categories) |
| Our obligations | Processing only on your instructions, confidentiality, security measures, 72-hour breach notification |
| Data subject requests | Tools to action access, correction, and erasure requests |
| Subprocessors | General authorization, with the current list kept at intempt.com/subprocessors |
| International data transfers | EU Standard Contractual Clauses (Module 2), the UK International Data Transfer Addendum, and the Swiss Addendum |
| Audits | Audit rights, once per year |
| Deletion and retention | Retention periods you choose, and deletion after a project or account is terminated |
| AI processing | How personal data is handled for the AI features of the Services |
Governing law for the DPA follows the Agreement: the State of Delaware.
Security measures
The technical and organizational measures Intempt maintains are listed in Annex 2 of the DPA: encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access control, and multi-factor authentication. See also the Security and trust center overview and intempt.com/security.
Getting started
Read or download the DPA
- Open intempt.com/dpa.
- Click Download PDF at the top of the page to save a copy. The download is a standard, unsigned copy of the current DPA.
The same Download PDF button is on every legal page, including the Terms of Service and Subprocessors list.
Get a countersigned copy for procurement
If your security or procurement review requires a signed DPA naming your legal entity, that is handled as part of an Enterprise agreement through an Order Form rather than self-serve. Contact hey@intempt.com to request one.
Use cases
- An EU customer's procurement team asks for your DPA. Point them to intempt.com/dpa; it is already in force, no signature needed.
- A security reviewer wants a copy for their records. Download the PDF from the DPA page.
- A buyer needs a countersigned DPA with their company name for their files. Request one through hey@intempt.com as part of an Enterprise agreement.
- A reviewer asks who else processes the data. Send them intempt.com/subprocessors, also listed in Annex 3 of the DPA.
- A customer asks how EU data leaves the EEA. The DPA relies on the EU Standard Contractual Clauses, the UK Addendum, and the Swiss Addendum.
GDPR & CCPA Compliance Guide
How Intempt supports GDPR and CCPA compliance: reviewing and managing a customer's consent on their Privacy tab, and handling data subject requests under the OpenDSR framework.
Data privacy and PII best practices
A three-phase framework for deciding what data to collect, identifying sensitive fields, and keeping your project's privacy posture healthy as it grows.