Data Processing Agreement (DPA)

Overview

This page summarises the key terms of the standard Data Processing Agreement between Atine Labs™ Limited (as Data Processor) and clients (as Data Controllers) who use our SaaS platforms and managed services. A full DPA is provided as part of the service agreement for all clients whose use involves personal data.

Roles

Data Controller: The client organisation that determines the purposes and means of processing personal data.
Data Processor: Atine Labs™ Limited, which processes personal data on behalf of the Controller in accordance with documented instructions.

Processing Scope

Processing is limited to the activities necessary to deliver the contracted services. Atine Labs™ Limited will not process personal data for any other purpose without documented instruction from the Controller, except where required by law.

Data Security

Atine Labs™ Limited implements appropriate technical and organisational measures as described in our Information Security Policy.

Sub-processors

Atine Labs™ Limited engages sub-processors as listed in the Sub-processors Register. Controllers are notified of new sub-processors and may object within 14 days.

Data Subject Rights

Atine Labs™ Limited assists Controllers in responding to data subject rights requests within the timeframes required by applicable law.

Data Transfers

International transfers of personal data are conducted in accordance with GDPR Chapter V and Uganda PDPO requirements, using Standard Contractual Clauses or equivalent mechanisms.

Breach Notification

Atine Labs™ Limited will notify the Controller of a personal data breach without undue delay and within 24 hours of becoming aware of the breach.

Requesting a Full DPA

Organisations requiring a signed DPA should contact admin@alglobal.systems. A standard DPA document is available on request.