Data Processing Agreement

Effective Date: October 2026

1. Parties

This Data Processing Agreement ("DPA") forms part of the agreement between you ("Customer", "Controller") and Muhammad Uzair, trading as Asphalyn ("Asphalyn", "Processor") governing your use of the Asphalyn platform (the "Service").

Processor address: House No. 7, Street no. 47, Near Rehmaniya Masjid, Chah Miran, Lahore 54900, Punjab, Pakistan

Processor contact: contact@asphalyn.com

2. Definitions

  • "Personal Data" means any information relating to an identified or identifiable natural person processed through the Service.
  • "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, and deletion.
  • "Data Protection Laws" means the GDPR (EU 2016/679), the UK GDPR, POPIA (South Africa), and any other applicable data protection law.
  • "Subprocessor" means a third party engaged by the Processor to process Personal Data on behalf of the Controller.
  • "Standard Contractual Clauses" means the standard contractual clauses approved by the European Commission for the transfer of Personal Data to third countries.

3. Scope and Purpose of Processing

The Processor processes Personal Data only for the purpose of providing the Service, which is a cloud-based HAZOP, LOPA, incident, and action-tracking platform for process safety professionals. The categories of Personal Data and data subjects are:

  • Data subjects: Customer's employees, contractors, and other personnel whose information is entered into the Service.
  • Categories of Personal Data: names, email addresses, job titles, department, designation, assignee names, responsible person names, and any personal data included in free-text fields (such as incident descriptions or action descriptions).
  • Processing operations: storage, retrieval, display, export, and deletion of Personal Data.

4. Processor Obligations

The Processor shall:

  • Process Personal Data only on documented instructions from the Controller, including with regard to transfers to a third country.
  • Ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
  • Implement appropriate technical and organisational measures to protect Personal Data, as described in the Asphalyn Security page.
  • Assist the Controller in responding to data subject requests (access, rectification, erasure, restriction, portability, objection). The Service includes tools for exporting and deleting workspace data.
  • Assist the Controller in ensuring compliance with breach notification obligations. The Processor will notify the Controller without undue delay after becoming aware of a Personal Data breach.
  • Delete or return Personal Data on termination of the Service, as described in the Asphalyn Privacy Policy.

5. Subprocessors

The Controller grants general authorisation for the Processor to engage the subprocessors listed on our Subprocessor List. The Processor will notify the Controller at least 30 days before engaging a new subprocessor that processes Personal Data. The Controller may object to the change during that period.

The Processor imposes the same data protection obligations on each subprocessor as are set out in this DPA.

Current subprocessors:

  • Vercel Inc. — Application hosting (frontend and backend) — Frankfurt, Germany (fra1 — EU Central) and global edge network
  • Aiven Ltd — PostgreSQL database hosting — Amsterdam, Netherlands (DigitalOcean ams3)
  • DigitalOcean, LLC — Infrastructure provider underlying the Aiven database service — Amsterdam, Netherlands (ams3); backup storage in Bangalore, India (blr1)
  • Backblaze, Inc. — Object storage for attachments — United States (Reston, Virginia — us-east-005)
  • Paddle.com Market Ltd — Merchant of record: payment processing, subscription management, billing — United Kingdom
  • Google LLC — OAuth authentication (Sign in with Google) — United States
  • Hostinger International Ltd. — Transactional email delivery (workspace invitations) — 61 Lordou Vironos str., 6023 Larnaca, Cyprus

6. International Transfers

Where the Processor transfers Personal Data outside the EEA, the UK, or South Africa, it relies on:

  • EU-US Data Privacy Framework for subprocessors certified under the framework.
  • Standard Contractual Clauses for other subprocessors, as set out in the Subprocessor List.
  • UK adequacy regulations where the recipient is in the United Kingdom.

7. Liability and Indemnification

The Processor's total aggregate liability arising out of or relating to this DPA is subject to the limitations set out in the Asphalyn Terms & Conditions.

8. How to Execute This DPA

By using the Service, you accept this DPA as part of your agreement with Asphalyn. If you require a countersigned copy, email contact@asphalyn.com with your company name and the workspace name, and we will return a signed copy.