← Back to Ataski

Data Processing Agreement

v1.6-2026-10-08 · effective 2026-10-08 · GDPR Article 28 + CCPA Service Provider

This Data Processing Agreement (the “DPA”) is incorporated into and forms part of the Master Services Agreement (the “MSA”) between [Customer legal entity] (the “Controller”) and GlobalDeal Inc. (d/b/a Ataski) (the “Processor”). It governs the Processing of Personal Data carried out by the Processor on the Controller’s behalf.

1. Definitions

Terms used in this DPA carry the meaning given in the GDPR (Regulation (EU) 2016/679) and the CCPA (Cal. Civ. Code §1798.140) where applicable. The following definitions apply across both regimes:

2. Subject matter and duration

Subject matter. The Processor provides AI workforce services to the Controller (the “Services”). In the course of providing the Services the Processor processes Personal Data on the Controller’s behalf, in accordance with the Controller’s documented instructions.

Duration. This DPA takes effect on 2026-10-08 and remains in force for the duration of the underlying subscription, plus a 30-day data-retention window during which the Controller may export Customer Data via the self-service /app/settings/export.json endpoint, after which the Processor deletes all Customer Data (GDPR Article 28(3)(g)).

3. Nature and purpose of Processing

The nature and purpose of Processing is determined by the AI workforce roles the Controller activates on its workspace.

The roles available in the Service as of the effective date shown above are: Outbound Sales Assistant, Support Desk Manager, Renewal Manager, Customer Account Monitor, Contract Manager, Obligation Watch, Financial Analyst, Board Pack Drafter, AR Cash Collector. That list is descriptive of the Service as at that date. It does not create, expand or limit the Processor's obligations, which are set out in §6. Roles may be added to or withdrawn from the Service without amendment to this DPA. Withdrawal of a role does not reduce the Processor's obligations in respect of Personal Data already Processed.

Each role's capability matrix is published on the corresponding marketing page and the Controller's activation of the role constitutes documented instruction to Process Personal Data within that role's declared scope.

4. Types of Personal Data and categories of Data Subjects

Types of Personal Data. Business contact data (name, work email, work phone, job title); communications metadata (email send / receive timestamps, meeting attendance); Controller-provided content (uploaded CSVs, board materials, contract drafts); prospect data the Service collects on the Controller’s instruction (name, job title, employer, LinkedIn profile URL, location and company details from public LinkedIn data obtained through Apify, and a business email address inferred from the company’s address format and verified for deliverability); model inputs and outputs (prompts and AI-drafted responses).

Categories of Data Subjects. The Controller’s employees, contractors, customers, prospects, vendors, board members, and meeting participants whose data the Controller transmits to or through the Service, or that the Service collects on the Controller’s instruction (for example, prospects an outreach role finds for the Controller).

5. Controller's obligations

The Controller is responsible for compliance with applicable data protection laws in respect of the Personal Data it transmits to the Service, including establishing a lawful basis for Processing (GDPR Article 6) and providing required notices to Data Subjects. The Controller warrants that its documented instructions to the Processor comply with the GDPR and other applicable data protection law. This includes Personal Data the Service collects on the Controller's instruction, such as prospects an outreach role finds: the Controller decides whom to contact and why, is the sender of that outreach, and must hold a lawful basis for contacting people in each market it targets.

6. Processor's obligations (GDPR Article 28(3))

  1. Documented instructions. The Processor processes Personal Data only on documented instructions from the Controller, including with regard to international data transfers, unless required to do so by Union or Member State law to which the Processor is subject; in that case, the Processor informs the Controller of that legal requirement before Processing, unless the law prohibits such information on important grounds of public interest.
  2. Support access. Where the Controller has raised a support request or Ataski is responding to an incident affecting the Controller, Ataski personnel may open the Controller's workspace to observe it. Such access is a documented instruction under this clause and is bounded as follows: it requires a recorded reason referencing the ticket, incident or Controller request; it is technically read-only, so no Customer Data can be created, modified, sent or deleted during it; it expires automatically after 60 minutes; its start and end are written to the append-only audit log; and Ataski notifies the Controller's workspace owner by email when it begins. Each such access is recorded in a register Ataski makes available to the Controller on request under the audit obligation in §6(9).
  3. Confidentiality. The Processor ensures that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
  4. Security. The Processor implements appropriate Technical and Organisational Measures (Appendix A) to ensure a level of security appropriate to the risk (GDPR Article 32).
  5. Sub-processing. The Processor engages Sub-processors only under the conditions in §7 below.
  6. Data Subject rights assistance. The Processor assists the Controller, by appropriate technical and organisational measures, in fulfilling the Controller’s obligation to respond to Data Subject requests under GDPR Chapter III (Articles 12–23).
  7. Article 32–36 assistance. The Processor assists the Controller in ensuring compliance with GDPR Articles 32 (Security), 33 (Breach notification), 34 (Breach communication), 35 (DPIA), and 36 (Prior consultation), taking into account the nature of Processing and the information available to the Processor.
  8. Return or deletion. Upon termination of the Services, the Processor returns or deletes all Personal Data at the Controller’s choice, and deletes existing copies unless Union or Member State law requires storage. The default window is 30 days from termination via the self-service /app/settings/export.json endpoint and the automated post-30-day deletion job.
  9. Audit. The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in GDPR Article 28 and allows for and contributes to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller. Audits may be conducted no more than once per calendar year unless required by supervisory authority order.

7. Sub-processors

The Controller hereby grants the Processor general written authorisation to engage the Sub-processors listed at /legal/subprocessors (incorporated by reference). The Processor will inform the Controller of any intended changes to that list, giving the Controller no fewer than 30 days’ advance notice, during which the Controller may object on reasonable grounds. The Processor remains liable to the Controller for the acts and omissions of every Sub-processor as if they were its own.

The Processor ensures that each Sub-processor is bound by a written agreement that imposes data protection obligations no less protective than those in this DPA. The current list of Sub-processors comprises 16 vendors as of 2026-10-07 (see the public sub-processor page for the canonical list).

8. International transfers

Where Personal Data is transferred from the European Economic Area, United Kingdom, or Switzerland to a third country that does not benefit from an adequacy decision, the Processor and the Controller agree that the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) apply, Module Two (Controller to Processor) where the Controller is established in the EEA, with Ataski acting as the data importer. The UK International Data Transfer Addendum and the Swiss Federal Data Protection and Information Commissioner’s guidance apply mutatis mutandis for UK and Swiss transfers respectively. Ataski is not itself certified under the EU–US Data Privacy Framework; where a receiving Sub-processor holds its own DPF certification, that certification provides an additional safeguard for the transfer to that Sub-processor, and the SCCs remain the transfer mechanism between the parties.

9. Personal Data breach

The Processor notifies the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach (GDPR Articles 4(12), 33). The notification describes the nature of the breach, including, where possible, the categories and approximate number of Data Subjects concerned, the likely consequences, and the measures taken or proposed to address the breach.

10. Term and termination

This DPA remains in force for as long as the Processor processes Personal Data on the Controller's behalf under the MSA. Either party may terminate this DPA only by terminating the MSA in accordance with its terms; on termination, the Processor completes the return / deletion procedure in §6(8) above.

11. Governing law

This DPA is governed by the law specified in the MSA. Nothing in this DPA derogates from the rights granted to Data Subjects by Union, Member State, or other applicable data protection law.

Appendix A — Technical and Organisational Measures (GDPR Article 32)

The Processor implements the following Technical and Organisational Measures (“TOMs”) to ensure a level of security appropriate to the risk, in accordance with GDPR Article 32:

Appendix B — Sub-processors

The current list of Sub-processors is published at /legal/subprocessors and is incorporated into this DPA by reference. As of 2026-10-07 the list comprises 16 vendors.