Data Processing Agreement

1. Definitions and Scope

This DPA governs the processing of personal data by Aurum AI Labs Ltd as a data processor on behalf of the client (data controller) through our services, including Aurum Flux™, Ops Packs, Aurum Flo™, and Aurum Catalyst™.

2. Processing Instructions

We process data only on documented instructions from the controller, including for Aurum Score™ calculations and marketing orchestration activities as specified in service agreements. We do not use client data to train AI models.

3. Security Measures

Technical measures: AES-256 encryption, secure APIs, access controls. Organizational measures: Staff training, confidentiality agreements, regular audits. Compliance: DIFC Data Protection standards.

4. Sub-processors

We maintain a list of approved sub-processors for specific functions. All sub-processors are bound by equivalent data protection obligations. Clients may object to new sub-processors with 30 days notice.

5. Data Subject Rights

We assist controllers in fulfilling data subject requests including access, rectification, deletion, and portability through our platform's built-in data management tools and API endpoints.

6. Breach Notification

We notify controllers of personal data breaches without undue delay and within 72 hours of awareness. Notifications include nature of breach, affected data categories, and mitigation measures taken.