# Awake Data Processing Agreement

## Commercial Terms

Customer/controller and provider/processor: [names/addresses]. Main agreement/version: [details]. Processing purpose, duration, people, data categories and sensitive data: completed Processing Schedule. Locations/transfers: [schedule]. Security: attached Security Addendum. Subprocessors and change notice/objection process: [register and terms]. Privacy/security contacts: [contacts].

## 1. Roles and instructions

Determine roles for each processing activity rather than assuming the contract label decides them. Processor processes covered personal data only on documented lawful instructions, including the main agreement and completed schedules, and alerts Controller if an instruction appears unlawful. Processor has no independent general-model training or advertising right in covered data. Controller is responsible for lawful collection, notices and instructions within its role.

## 2. People and safeguards

Processor limits access to authorized people under confidentiality duties and implements the agreed risk-appropriate technical and organizational measures. Material security reductions require agreement. Retain evidence of controls without publishing credentials or sensitive configurations. Assistance, audit scope and allocation of reasonable costs are [terms], subject to mandatory rights.

## 3. Subprocessors and transfers

Use only authorized subprocessors under equivalent data duties. Notify changes and allow the completed reasonable objection process and remedy. Processor remains responsible as agreed and required by law. Identify actual international transfers and valid mechanisms; this US-first template does not itself supply EU/UK transfer clauses or guarantee adequacy. Attach applicable jurisdiction instruments before the relevant transfer.

## 4. Requests and incidents

Processor promptly forwards relevant individual/regulator requests, assists Controller as agreed and does not independently respond except when legally required. Notify Controller of a covered personal-data breach without undue delay and within the completed contractual period [hours] after awareness, with known facts, updates, containment and cooperation. Do not wait for a full investigation before initial notice. Roles for statutory notification remain distinct.

## 5. End and hierarchy

At service end, return or delete covered data at Controller's documented choice within [days], with stated backup deletion and legal-retention exceptions under continued safeguards. Provide confirmation on request. This DPA controls data-processing matters; commercial caps, remedies and other terms are [expressly identified], without overriding mandatory rights. Document any conflicting jurisdiction schedule expressly.

## General terms

Formal notices go to the contacts and delivery methods in the Commercial Terms. Governing law: [state and country]; dispute forum: [court and venue, or separately completed arbitration provision], subject to mandatory law. The parties will first meet in good faith within [days] after a dispute notice; this does not delay urgent relief or a filing deadline. This document and the signed schedules listed here constitute the agreement on this subject. Changes require a writing signed by the affected parties. A schedule overrides another document only by identifying the provision and the agreed replacement. No provision silently amends an existing equity, financing, or employment instrument. Severability applies to the extent lawful. Neither party may transfer this agreement without the other's written consent except to a successor acquiring the relevant business that assumes its obligations in writing, subject to any expressly agreed restrictions. Counterparts and electronic signatures are permitted.

## Signatures

Party A: [full legal name]. Authorized signature: [signature]. Name and title: [name and title]. Date: [date].

Party B: [full legal name]. Authorized signature: [signature]. Name and title: [name and title]. Date: [date].

Signed schedules and implementing documents: [list, dates, and versions, or none].