Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between [Legal Entity Name] (“Processor,” “Sonata”) and the customer organization (“Controller,” “Customer”). It governs Sonata’s processing of personal data contained in Customer Data on Customer’s behalf. Where applicable data protection law treats Customer as a controller and Sonata as a processor, this DPA applies.

Sonata will process personal data only to provide the Service and only on Customer’s documented instructions, including as set out in the agreement, this DPA, and Customer’s configuration and use of the Service. Sonata will not process the personal data for any other purpose, and in particular will not sell it or use it to train AI models.

Sonata will ensure that personnel authorized to process the personal data are bound by appropriate obligations of confidentiality.

Sonata will implement and maintain technical and organizational measures appropriate to the risk, including: isolation of each organization’s data at the database layer; encryption of credentials and secrets at rest; server-side-only handling of secrets and access tokens; restriction of connectable systems to vetted first-party providers or systems the Customer hosts; human approval for actions that change connected systems; least-privilege role controls enforced across interface, server, and database; and audit logging of privileged actions. A fuller description is maintained in the Trust Center.

Customer authorizes Sonata to engage the subprocessors listed on the Subprocessors page to process personal data in connection with the Service. Sonata will impose data protection obligations on each subprocessor substantially equivalent to those in this DPA, and will provide a mechanism for Customer to be informed of changes to subprocessors and to object to a new subprocessor on reasonable grounds.

Taking into account the nature of the processing, Sonata will assist Customer, by appropriate technical and organizational measures, in fulfilling Customer’s obligations to respond to requests from data subjects exercising their rights, and in ensuring compliance with Customer’s security, breach-notification, impact-assessment, and consultation obligations.

Sonata will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer’s personal data, and will provide information reasonably available to assist Customer in meeting its notification obligations.

Upon termination of the Service, and at Customer’s choice, Sonata will delete or return Customer’s personal data within a reasonable period, except to the extent retention is required by law.

Sonata will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor it mandates, subject to reasonable confidentiality and security conditions.

To the extent personal data is transferred across borders, the parties will rely on a lawful transfer mechanism. [Specific mechanism, e.g. Standard Contractual Clauses, to be incorporated.]

[Subject matter, duration, nature and purpose of processing, types of personal data, and categories of data subjects to be set out in an annex. Standard DPA annex, to be completed with counsel.]

In case of conflict, this DPA prevails over the agreement with respect to processing of personal data. This DPA is governed by [Governing jurisdiction].