Data Processing Agreement (outline template)
Status: Draft outline only. Not legal advice. Not an executed agreement. Pending review by Autlantic Limited counsel before use with customers.
Canonical company page: autlantic.com/dpa (prefer that URL in contracts and procurement packs).
Processor / service provider: Autlantic Limited, company number 17422039, registered office 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.
Controller / customer: the merchant legal entity using Autlantic Billing.
Governing law (intended): England and Wales.
Contact for a negotiated DPA: [email protected] only (no separate privacy@ or legal@ inboxes).
1. Purpose
Outline how Autlantic processes personal data on behalf of the merchant in connection with Autlantic Billing (hosted API, merchant portal, webhooks, and related support).
2. Roles
- Merchant determines purposes and means for end-customer / member data it submits.
- Autlantic processes that data to provide Billing services under the merchant’s instructions and Autlantic’s product Terms / Privacy Policy.
3. Categories of data (typical)
Examples only; actual scope depends on what the merchant sends:
- Account and contact identifiers (email, name, merchant refs)
- Billing metadata (subscription and invoice identifiers, amounts, statuses)
- Wallet / payout addresses and on-chain transaction references
- Webhook delivery and support correspondence
Autlantic Billing settles USDC on Base to merchant-configured addresses and does not custody merchant subscription revenue.
4. Processing instructions
Process only as needed to provide the service, comply with law, and as documented in product Terms, Privacy Policy, and written instructions from the merchant (including API and portal usage).
5. Security
Technical and organizational measures appropriate to the service (access control, secrets handling, transport encryption, webhook signing). Integrator obligations remain as documented in the Security guide, Security FAQ, and repository SECURITY.md.
6. Subprocessors
Use of infrastructure subprocessors as disclosed on the canonical autlantic.com/dpa schedule and summarized on the Trust center. Do not treat this docs page as the authoritative list. Notice / objection mechanics to be agreed in the final DPA.
7. International transfers
Transfer mechanisms (where applicable) to be completed by counsel for the merchant’s jurisdiction.
8. Retention and deletion
Retain for the life of the service relationship and as required for legal, security, and accounting purposes; deletion or return on request subject to backup and legal holds. Details to be finalized in the executed DPA.
9. Assistance
Reasonable assistance with data subject requests, security incidents, and audits as agreed in the final DPA and subject to confidentiality and cost provisions.
10. Liability and precedence
Commercial Terms, Privacy Policy, and the signed DPA control. This page has no contractual effect.
To request a counsel-reviewed DPA, email [email protected] with your legal entity name and jurisdiction.