Data Processing Addendum
Last updated 28 October 2026
This Data Processing Addendum (the “DPA”) forms part of the agreement under which a customer (“Customer”) uses the architecture.dev Components, including the architecture.dev Rider to the Gridlight Terms (the “Agreement”). It applies when Customer Content includes Personal Data. It is made between Customer and architecture.dev (“architecture.dev”).
1. Definitions
Capitalized terms not defined here have the meanings given in the Agreement.
- Personal Data: information in Customer Content that relates to an identified or identifiable natural person.
- Data Protection Laws: the laws that apply to the processing of Personal Data under the Agreement, which may include the EU and UK General Data Protection Regulation and US state privacy laws such as the California Consumer Privacy Act.
- Security Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data that architecture.dev processes.
- Subprocessor: a third party that architecture.dev engages to process Personal Data.
2. Roles
2.1 Customer is the controller of Personal Data, or acts on behalf of the controller. architecture.dev is a processor, and processes Personal Data on Customer’s behalf.
2.2 Where the California Consumer Privacy Act applies, architecture.dev is a service provider. It does not sell or share Personal Data, does not retain, use or disclose it outside the direct business relationship with Customer or for any purpose other than providing the architecture.dev Components, and does not combine it with personal information it receives from other sources except as that law permits.
3. Processing
3.1 architecture.dev processes Personal Data only on Customer’s documented instructions. The Agreement, this DPA and Customer’s use and configuration of the Platform are Customer’s complete instructions. architecture.dev will tell Customer if it believes an instruction infringes Data Protection Laws.
3.2 The subject matter, nature, purpose and duration of the processing, the types of Personal Data and the categories of data subjects are set out in Annex 1.
3.3 architecture.dev does not use Personal Data to train AI models.
4. Personnel
architecture.dev ensures that every person it authorizes to process Personal Data is bound by an obligation of confidentiality, and limits access to the personnel who need it to provide the architecture.dev Components.
5. Security
architecture.dev maintains administrative, physical and technical safeguards for Personal Data no less protective than those described in its Security Overview. Customer is responsible for the security of its own accounts, devices and configuration, and for deciding what Personal Data it submits to the Platform.
6. Subprocessors
6.1 Customer authorizes architecture.dev to engage the Subprocessors listed at architecture.dev/legal/subprocessors.
6.2 architecture.dev gives at least 30 days’ notice of a new Subprocessor. Customer may object on reasonable data protection grounds during that period. If the parties cannot resolve the objection in good faith, Customer may terminate the affected architecture.dev Components on written notice and receive a pro-rata refund of prepaid fees for the unused term.
6.3 architecture.dev imposes data protection obligations on each Subprocessor no less protective than those in this DPA, and remains responsible to Customer for each Subprocessor’s performance of them.
7. Assistance
7.1 Taking into account the nature of the processing, architecture.dev assists Customer in responding to requests from data subjects to exercise their rights under Data Protection Laws. If architecture.dev receives such a request directly, it refers the data subject to Customer and does not respond itself unless Customer instructs it to.
7.2 architecture.dev provides reasonable assistance with Customer’s data protection impact assessments and prior consultations with supervisory authorities, to the extent they concern the architecture.dev Components and the information is not otherwise available to Customer.
8. Security Breaches
8.1 After confirming a Security Breach, architecture.dev notifies Customer without undue delay, and in any event within 72 hours.
8.2 The notice describes, as far as is then known, the nature of the Security Breach, the categories and approximate volume of Personal Data concerned, its likely consequences, and the measures taken or proposed. architecture.dev provides further information as it becomes available and takes reasonable steps to contain the Security Breach.
8.3 Notifying Customer of a Security Breach is not an admission of fault or liability.
9. Return and deletion
When the architecture.dev Components end, Customer may export Customer Content, including Personal Data, for 30 days. architecture.dev then deletes it, including from its backups as they expire, within a further 30 days, except where the law requires it to keep the data. Data kept under such a requirement stays protected by this DPA for as long as it is kept.
10. Audits
10.1 On written request, architecture.dev makes available the information reasonably necessary to demonstrate its compliance with this DPA, including completed security questionnaires and any third-party audit reports it holds.
10.2 If that information is not sufficient to demonstrate compliance, or a supervisory authority requires it, Customer may conduct an audit no more than once a year, on at least 30 days’ written notice, during Business Days, at Customer’s cost, and subject to reasonable confidentiality obligations.
11. International transfers
architecture.dev hosts Customer Content in the United States. Where Data Protection Laws require a transfer mechanism for Personal Data transferred to the United States, the parties agree that the Standard Contractual Clauses adopted by the European Commission (Module Two, controller to processor), and for the United Kingdom the UK International Data Transfer Addendum, apply and are incorporated by reference, with Annex 1 of this DPA supplying their annexes.
12. General
12.1 Each party’s liability under this DPA is subject to the limitations of liability in the Agreement.
12.2 If this DPA conflicts with the Agreement on the processing of Personal Data, this DPA prevails. If the Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses prevail.
12.3 This DPA lasts as long as architecture.dev processes Personal Data for Customer.
Annex 1: Details of processing
| Item | Detail |
|---|---|
| Subject matter | Providing the architecture.dev Components under the Agreement |
| Nature of the processing | Hosting, storage, retrieval, generation of Output by AI models, support, backup and deletion |
| Purpose | To provide, secure and support the architecture.dev Components for Customer |
| Duration | The term of the Agreement, and the export and deletion periods in section 9 |
| Data subjects | Customer’s Authorized Users, and individuals whose information Customer or its Authorized Users submit to the Platform |
| Types of Personal Data | Names, business contact details and account identifiers of Authorized Users, and any Personal Data that Customer chooses to include in Customer Content |
| Special categories | None intended. Customer should not submit special category data to the Platform |
| Subprocessors | As listed at architecture.dev/legal/subprocessors |
| Security measures | As described in the Security Overview |